Talk About IT!

BitLocker and Active Directory

Summary: We will use Bitlocker to secure device data, requiring a PIN or Password to boot into Windows or read the hard drive. This is aimed to be the definitive guide to getting started and managing BitLocker. Technical Details Bitlocker locks the key for decryption with multiple keys (“Protectors”). This can include TPM, TPM and PIN, Password, a USB key, and even certificates. You can have multiple ways to unlock the decryption key The keys appear transparent to the user, even during recovery The hard drive can be removed and put into another computer.

ssh

SSH Agents

Summary: SSH Agents hold your SSH keys while you traverse to other SSH targets, without revealing your private keys. Longer Explanation The concept of SSH keys should not be lost on you; if it is, check out my post about SSH keys made easy. However, if your ~/.ssh/authorized_keys file is getting long, and especially if you’re the only user, then you could use an SSH agent to help out.

hugo

Hugo Update

It’s happened - Wordpress is gone, and Hugo is now powering my blog

remote desktop

Creating RemoteApp RDP Sessions

If you are running a full Remote Desktop session to only run one application, you are wasting resources and time! In this article, we will make a connection to single-programs that look as though they’re running locally on our workstation!

registry

Set default printer (without creating a printer) with Group Policy

I got disappointed after searching high and low on Google for how to use Group Policy in order to set a default printer. Almost every article I read assumed the reader had a print server available, or would deploy a local printer connection right from the Group Policy Management Console. Finally, I found the solution! In the environment that I support, we have “Printer Packages” by the manufacturer. These packages are essentially printer queues with default settings already entered for the Printer Preferences - you know, the items you CAN NOT change easily from a remote location, to many systems?

2-factor SSH Login

Purpose This will let us use our phone as a second-factor for logging in to an SSH session. This helps harden our SSH security, and encourages users to use 2FA in general. Because it asks for a password that changes every 60 seconds along with your known password, it makes the server MUCH harder to brute-force, especially if it is an Internet-facing server. Posted on Github as well - comments welcome!

story

My Cisco Meraki Equipment arrived

On LinkedIn, I found an ad for a free access point… I thought, “Sweet!”. I signed up for the webinar, watched an hour long demo, and thought to myself, “This is awesome!” I watched 2 more webinars, about their Security Appliance (MX), and their Switch (MS).

best practices

Files Preferences FAQ

Group Policy Files CSE allows SysAdmins to ensure file(s) exist on clients when logging into the domain. If you’ve never used it before, you can beat your head against the wall, so learn from my mistakes / tributions with setting this up.

best practices

Setup BIND9 with ISC-DHCP-SERVER dynamic host registration

Having a decent DNS system is mandatory if you have more than a few devices on your network. If WINS fails (or becomes obsolete), or Bonjour doesn’t fit your needs, try this out on your Linux server!

debian

Growing 2-disk RAID1 array to a 4-disk RAID10 array in Debian

Question: I have a two-disk RAID-1 array in mdadm, and I purchased two more disks. How can I grow the array to use the new disks?

Answer: This took some strategy and time. In short, we install the disks, create a new RAID-10 with two missing disks, copy data over, and replace disks one at a time.

encryption

SSH Keys Made Easy

Let’s talk about what makes an SSH key pair work, making them secure, and how to actually use them, in plain English!

SSID

Forcing Wireless Networks on clients

Do your employees complain they can’t connect to your network resources, only to find they are on a different Wireless network?

installation

Deploying Windows Monthly Updates (without WSUS)

In connection with another article about Deploying Windows Updates via the Command Line, I have come to notice that it is not the end-all we thought it once was. With the Roll-Up Updates for Windows 7, 8.1, and 10, I have found a better way to deploy updates.

Name Resolution Woes

It’s 2017, and DNS has taken over as the de-facto standard for name resolution. It’s been this way for many years, and we like it! It’s organized, hierarchical, and makes sense!

However, DNS is not always what computers will use.

admin share

Add Network Clients, Protocols and Services via Command Line

In a previous post, I talked about why I couldn’t access any file shares, or connect remotely to some systems. The issue was caused by services, protocols and clients missing from the network adapters. Now that the issue had been identified, I had two choices: manually touch every machine, using the mouse for most of the work, or automate the process. This post describes the latter.

dell

Bypass BIOS passwords

Ever forget your BIOS password? This is the definitive guide to getting back in.

digital ocean

Digital Ocean, you’re awesome!

I must say, without a doubt, that Digital Ocean is one of the best companies available for hosting services. This is not a sales pitch, but an actual account of what has happened since I joined them over a year ago.

admin share

Can’t connect to the ADMIN$ or IPC$ shares on a computer?

Troubleshooting the ADMIN$ or IPC$ shares can be a painful ordeal for some.

dell

Installing Windows 7 on Dell’s new Skylake-based Systems

Recently, I’ve been seeing posts about the new Skylake-based Intel processors that Dell is using in their Precision, Optiplex and Latitude lines of products. It makes the system fast, even without using much power, but it causes an issue if a SysAdmin needs to install Windows 7 from their installation media - most notably, the USB drive is not available, and neither is the hard drive from the Windows 7 WinPE environment.

best practices

Developing for others – Dev Servers

What is a Dev Server, and why should I use it for my clients?

lifehack

Easy Mobile Access to your Reward Cards

I have a few gift / store / reward cards that I use at some stores, simply for the free rewards - A free drink every now and again, 10% off, etc. One store I used to frequent for my caffeine fix switched from a magnetic stripe card to an app-only system, for mobile phones.

debian

Troubleshooting your Exim Server

In the previous post, we setup a very basic Exim SMTP server for relaying outgoing mail to GMail from your server. Now, we are going to look at troubleshooting your Exim installation, and dealing with issues that may come up.

vbs

Do your Windows Automatic Updates via the Command Line

For administrators without a WSUS server, you need this script.

debian

Creating an SSH Tunnel

So today, I was helping someone with a multi-site WordPress issue, and I linked to my blog. But guess what? It wasn’t coming up! All my external tests seemed to work, including Down for Everyone or Just Me, and even Cloudflare! I could still SSH into my server (as I was watching log files scroll by anyways!), so I knew it was up and accessible. So, what’s next?

debian

Setting up Exim4 with GMail and 2-factor Authentication

Setting up Exim 4 is relatively easy on Debian, especially if you’re only sending mail to yourself (i.e. Server messages, Forget Password requests, etc). Because I have home-level Internet service from my Canadian ISP, I can’t host mail directly on this box - but I also don’t want to rely on Shaw’s mail servers if I ever change service later on in life.

backup

Hello world! We’re back

Welcome back to Talk About IT! We had a bit of a mishap, so all the previous content is gone. Backup, backup backup! Luckily, all the customer data has been recovered, with no loss. The server has been reconfigured, with a proper RAID setup, and off-site backups. It is going to make things a lot easier to recover, hopefully! Once the extra computers I’ve ordered have arrived, I’ll work on setting up haproxy and getting some clustering going.