Security: Direct Internet Connections for KVM over IP devices such as iLO Advanced, iDRAC Enterprise, Intel RMM, and others = BAD

While discussing firmware and updating firmware this situation, experienced a number of years ago vicariously, came to light:

ISP: Excuse me sir, but we have a huge volume of SPAM coming out of [WAN RMM IP]
Admin: Huh?
ISP: We are seeing huge volumes of SMTP traffic outbound from [WAN RMM IP]
Admin: Oh?
* Checks non-existent documentation
Admin: Um, is that IP assigned to us?
ISP: Yes sir, along with [WAN SSL IP for internal services]
Admin: Hmmm …
[PAUSE]
Admin: Oh, wait, I think I know … [unplugs iLO/iDRAC/RMM from switch connected to ISP modem]
Admin: Is it better now?
ISP: Oh yeah, what did you do?
Admin: Oh, I fixed it.

One should never plug a RMM/iLO/iDRAC type device directly into the Internet right?

We probably blogged about this in the past, but it definitely bears repeating as we still encounter situations where the devices are plugged directly in to the Internet!

Happy New Year everyone! :)

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.s2d.rocks !
Our Web Site
Our Cloud Service

Error Fix: Trust Relationship is Broken

Here's a quick post on fixing a broken trust situation when the local administrator username and password is a known commodity.

On Windows 7:

1. Windows Explorer
2. Right click My Computer/This PC --> Properties
3. Change settings for Computer Name
4. Change button
5. Domain: Setting Now: DOMAIN.LOCAL
1. Change to DOMAIN (delete .Local)
2. Credential
6. Reboot

That process will fix things for Windows 7 unless PowerShell is up to date then for all others including it:

1. Log on with local admin user
2. Reset-ComputerMachinePassword -Credential DOMAIN\DomainAdmin
3. Log off
4. Log on with domain user account

That's it.

If you know any other methods, especially for situations where the local admin username and password is an unknown or all local admin accounts are disabled feel free to comment or ping!

Thanks for reading. :)

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.commodityclusters.com
Our Web Site
Our Cloud Service

Some Thoughts on the Starwood/Marriott Reservations Database Breach

Note: This post will _not_ be a happy one.

First: The announcement page: Starwood Guest Reservation Database Security Incident Marriott International

That page is garbage, rubbish, and so much more. It exemplifies today's epidemic of spin instead of truth and responsibility for an error that harms others.

First:

"Marriott values our guests and understands the importance of protecting personal information."

That is a complete crock of male bovine excrement.

Especially when we look to the following:

"After receiving the internal security alert, we immediately engaged leading security experts to help us determine what occurred."

Okay, so just when did that security alert come in?

"On September 8, 2018, Marriott received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database."

Cool, so things look like they got caught really quick right? That seems to be the way this article is written right?

NOT:

"Marriott learned during the investigation that there had been unauthorized access to the Starwood network since 2014."

Let's rephrase all of the above shall we:

Marriott: We let unauthorized access to our reservation database happen for FOUR YEARS.

Yeah, "We at Marriott/Starwood really care about your data/PII." Really. All said with a smile.

***

In our case, the CC used for our various stays has expired very recently. So, we should be protected that way. And, to further protect things we use KeePass with unique passwords for any and all online resources with unique e-mail addresses set up for each of them (we're doing this more and more).

Suffice it to say, if the Marriott really cared about risk to our PII (Personally Identifiable Information) the reservations system would have been segmented with designated access and no Internet access. We've been applying our knowledge of network setup to segment our client's networks for years. Especially with PCI scans being somewhat generic and different depending on what org is running the scans.

Oh, and note that credit card information was stored in there too. How in the world did that pass muster with PCI scans?

LMHYWT (Let me help you with that) " … two components needed to decrypt payment card numbers and Marriott not able to rule out both were taken."

Tis a sad day indeed when spin and lawyer speak win out over a true "Mea Culpa" we really *insert expletive here* up.

This Marriott incident is a gross breach of trust and it is time companies be held liable for such.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.s2d.rocks !
Our Web Site
Our Cloud Service

Security: RBC Royal Bank: Best laid plans of mice and men

We did some banking work with our bank, RBC Canada. In the process they sent us a few "Secure Document Access" requests that the agent provided the password for via a phone conversation.

When the first one came in, it was a bit of a system shock.

RBC Royal Bank "Secure Message"

The highlight is ours. Huh?!?

Given the nature of today's phishing attacks a phone call was very quick to happen to our contact after receiving the above to verify its legitimacy.

We received a number of subsequent "secure" e-mails using the same method.

The encryption process we use, and our clients use, on the ExchangeDefender (xD) system is a link to an Internet property owned by xD with the appropriate SSL properties in place to assure the recipient that they are in the right place. That's after we indicate to the recipient in a prior e-mail of the upcoming process to obtain the encrypted content.

The RBC Royal Bank method is close to that but why the .HTM attachment requirement? That's just plain weird. :S

Sure enough, this is what was in an Inbox here this morning:

Phishing Message

It's a poorly crafted phish attempt at best.

E-mail Header

The trail is pretty clear as far as where it came from and the "how" looks to be fairly clear as well.

All it would have taken was a bit better in the way of timing on the phisher's part and a bit of distraction on our part and BOOM we could have been hooked. :(

RBC Royal Bank Canada needs to change their secure document transmission methodologies please.

And, Microsoft, please give us built-in DKIM abilities for on-premises Exchange instead of keeping that to online properties only. That's not polite in the least.*See Note Below

Outlook Header How-To

Outlook users, here's how to get the header information shown above:

1. Double click on the e-mail
2. Click the Message tab
3. Click the break-out button on the bottom right of the Tags category
• 
4. Click anywhere in the small information window
• 
5. Keyboard:  CTRL+A then CTRL+C
6. Click Close and close the e-mail
7. Paste the content into the destined app (we use Notepad)

After examining a few headers it gets pretty easy to identify the legit and illegitimate messages hitting our Inbox every day. While the process may be a bit time consuming, figuring out whether something is legit or not could be the difference between DELETE and an encryption event or Inbox/Contacts harvesting.

Happy Monday everyone and thanks for reading! :)

2018-09-10 EDIT: Oops, that Microsoft sentence should have been CUT along with the other sentences that were in a previous paragraph. Suffice it to say, we've been working on DMARC/DKIM requests and discovered that Microsoft seems to be holding DKIM off from on-premises Exchange. Thus, we need to go third party to get to use that business critical security feature. :(

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.s2d.rocks !
Our Web Site
Our Cloud Service

When Software Bugs can Kill: Dodge RAM 1500 Cruise Control Bug

A while back there was a scary moment where the cruise control in our 2016 RAM 1500 refused to release via any of the buttons on the steering wheel.

In that moment, rushing up on a vehicle fairly far ahead of us and going over a bridge, there were only a few options left:

1. Brakes release the cruise
2. Try and Power Down & Brake
3. Ditch @ 100KM/H on a bridge bank

Fortunately, the cruise released when the brakes got hit, we were able to avoid rear ending the person in front of us, and in fact the cruise system crashed right after the brakes were applied.

When addressing the complaint with Dodge and the dealer there's the, "Oh, no we didn't realize there was a problem there" type of response.

Well, obviously there was a problem that needed to be addressed as the bellow letter shows.

So, being that the problem could be life threatening we took the truck in to have it flashed as soon as the above showed up and the dealer had a spot open.

Here we are a few weeks or more from the day the flash was done and the behaviour happened again this morning. :S

Fortunately, at that moment there was less panic and more "Oh, hopefully the brakes work to kick it off this time" happening. ;)

A call into the dealer and the service tech indicated they'd have a conversation with the service manager since the tech was not sure whether there would be a "re-flash" of the module or the problem would need to head further up the Fiat Chrysler Canada food chain.

The Customer Service Wall

It's understandable that companies try and hide their mistakes. Yet, time and time again it's been shown that companies that are up-front about mistakes made and changes made to mitigate or eliminate them happening again tend to do quite well. It seems the lawyers tend to win this argument, and the ridiculous cases that have forced the issue, to keep things relatively hidden.

For the end-user it's very frustrating to face that "Customer Service Wall" with virtually no hope of getting anywhere beyond the person standing in front of that wall. In this case, it's the "Service Technician" that is in front of the Wall.

The reality is that the Customer Service Wall is a very well designed system to keep the person/user who is essentially paying the bills as far away from the manufacturer/vendor as is possible.

The same is true of voice recognition systems that users/customers hit as soon as they call "Customer Service".

There is no lack of irony in the above two sentences.

Conclusion

Sadly, the situation with the Dodge software bug, which can be deadly, will remain a mystery for a little while longer. With a bit of awareness, and a good dose of caution, we will be able to mitigate the bug's release block and not hit anyone including the ditch.

But for now, we wait until the folks that do the programming can figure out where the bug really lies and hopefully fix it … without introducing an even deadlier bug.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.s2d.rocks !
Our Web Site
Our Cloud Service

Legacy Windows XP for Industrial Machine Access and Management and Accounting Apps

There are quite a few systems out there that still use Windows XP or an earlier operating system to run the equipment.

So, what do we do when we need to get access to one of these kinds of machines?

Well for one, we make sure they are completely isolated and not accessible from anywhere except perhaps one secure jump point.

For another, when we do need to access the legacy system here's one method that allows for maintaining the legacy system's isolation:

1. Enable RDP Inbound on the legacy system (Windows)
2. Set up a vanilla Windows 7 Service Pack 1 VM that is set to not update
• This would be our jump point
• The Win7 VM would be left off except when needed
• If need be, set this VM up on a laptop that can be plugged in to the legacy system's network
3. Set up any needed tools on the Win7 VM
• RMM, Remote Desktop Shadow/Sharing tools, Firefox (leave the base level IE in place), any needed tools
4. Log on to the legacy Windows XP via RDP
• Make sure Drive Redirection is enabled
• Use Drive Redirection to transfer any files that won't go via Copy & Paste (Clipboard)
5. Use the Win7 VM as the default work-from desktop
6. When done, shut the Win7VM down
• Unplug from the legacy network when done if using a laptop with the Win7VM

For legacy systems require some form of *NIX the above process can be used for a vanilla install of the needed distro and kept offline until needed.

The principle at work here is to keep the legacy systems isolated from everywhere especially the Internet. And, to keep any jump points running an intermediary operating system that is too far back to keep safe and secure offline until needed.

As an FYI, we keep one or two legacy Windows 7 and Windows XP VMs in an offline state with legacy accounting applications installed as a just-in-case. There are times where a firm may need to go way back for a client file.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.commodityclusters.com
Our Web Site
Our Cloud Service

Client E-mail Warning for the Current Malware Campaigns

This went out this morning. The first place in any "security strategy" should be to train the human.

Folks,

I hope you had a great summer!

With anti-SPAM services getting better and better the malicious folks out there are getting a lot more subtle in their efforts plus we’re seeing an uptick of baddies in the Inbox.

Things to note in the message below:

1. The FROM domain @fmelaw.com does not match the domain in the link
2. After hovering the mouse over the Here link the URL listed contains a bunch of gibberish
3. Watch for language, spelling, and grammar errors as there tends to be a lot of them
4. Is the Subject and/or Sender legit? Call them first!
5. Do NOT open any Word documents and especially do NOT click Enable Macros if prompted!
6. Be cautious with any PDF attachments. If in doubt call the sender or forward to here with a question.

NOTE: We are seeing _a lot_ of compromised e-mail addresses and mailboxes as a result of users opening something or clicking on something they should not have.

One attack vector is via a Macro enabled Word document harvests both E-mail and Addresses to send out _replies_ to a legitimate e-mail thread/conversation. If the Word document gets clicked on and a prompt comes for enabling Macros the Word document is BAD. CLOSE Word and SHIFT+DELETE the e-mail!

If in doubt, don’t open or click on it! Do _not_ hesitate to call or forward the questionable content!

Thank you and have a wonderful day! :)

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Cloud Service
Twitter: @MPECSInc

Enable 2FA (Two Factor Authentication) Everywhere It's Available!

Yes, it's a bit of an extra inconvenience.

But, that inconvenience may save the account and any data associated with it from being hijacked!

As an example, after logging into my Microsoft ID and heading into the Security section I can check and see if there is anything out of the ordinary.

And, low and behold what do I find? That I've attempted to log on from some interesting places!

2FA is enabled on this Microsoft ID and all others. Amazon, Blogger, Microsoft,and any other that offer 2FA has it enabled.

There's absolutely no way in this day and age that it should not be used.

Thanks for reading. :)

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Cloud Service

Security: A Sample E-mail How-To Guide For End Users

With the plethora of e-mail born Office documents with active macros in them to pull down malware/ransomware we sent out the following e-mail to all of our clients for distribution internally.

***

Good day everyone,

It’s gotten to the point now where we are considering a universal restriction on incoming Office Documents. By that we mean plucking them right out of the e-mail via ExchangeDefender by default.

We have somehow travelled back to the 1990s where the bad guys are setting up Office documents with a Macro, an automatic script that runs when the document gets opened, that goes on to pull down their nefarious malware or ransomware.

Here are some steps to help protect us:

1. Microsoft Office has a Save As PDF feature built-in. Please have all outside folks send a PDF instead of an Office document
1. This is especially critical for Resumes. All job postings _must_ request PDF and note that Office documents would be deleted on the spot!
2. If collaboration is required for Office documents use ShareFile
3. Preferred over Dropbox since security is questionable with the Dropbox service
2. Most Office documents that have Macros built-in have an “m” in the extension
1. 
2. Save the Office document to Downloads and verify!
3. If extensions are not shown then right click the file and left click on Properties
4. 
3. Users _should_ be prompted:
1. 
4. Obviously, the answer should be to NOT click that button
5. If they do, there is one last cause for pause
1. 
6. This is what happens if I try and click on something that is Macro driven _before_ clicking Enable Content
1. 

Along with the need to be mindful of any Microsoft Office attachments in our e-mail we should also remember the following:

1. Never click on a link in an e-mail without at the least verifying its destination:
1. 
2. Hover the mouse cursor over the link to verify
3. As a rule: Never, ever, click on a link in an e-mail. Go to the web site after opening a new browser window (IE, Firefox, Chrome, Safari)
2. It may _look_ like it came from someone you know but never trust that. Call and ask!
1. There are a few exceptions to this rule thus make sure to hover your mouse over the link before clicking!
2. Advanced users can check the headers
1. 
2. 
3. Follow the flow from origin server to destination server
3. Don’t save important site’s information in the browser
1. Banking IDs and passwords
2. CRA and critical site’s IDs and passwords
3. Do not disable the secondary question for any computer
1. Banking sites use this feature to help protect the account as one example
2. Answer the question, it only takes a couple seconds and could save your savings!
4. Never call the 800 number that comes up in a Search for Support!
1. Go to the manufacturer’s web site and click on the Support link to find the correct phone number
5. Never believe a pop-up message that says your computer is infected with something!
1. And never, EVER, call the 800 number on that pop-up!
2. Don’t click anywhere, close and save your work if needed then, reboot!
3. Do NOT click anywhere in the pop-up window. Looks are deceiving as all areas of that pop-up = YES/ACCEPT/CONTINUE
6. Never volunteer a credit card number or banking information to anyone
1. Social Security/Social Insurance Numbers too!
2. Folks can garner a lot about us online. Never volunteer any information when asked via any incoming call/e-mail/forum
3. Always call them back!
7. Caller says they are from the bank, CRA, or other seemingly critical business?
1. Ask for their badge number, an 800 number to call, and an extension
2. Open a browser and verify the 800 number belongs to the bank/CRA/CritBiz.
3. Then call them back after hanging up if the number proves true!

While the above list is far from complete, by following these guidelines we can greatly reduce the chances of a malware or ransomware infection.

And, as always, e-mail or call if you are not sure about something!

***

Please feel free to use this as a template for training users!

Have a great weekend everyone. It’s +10C here and much like an awesome Spring day!

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Some Thoughts On Security Layering for SMB and SME

We are by no means masters of security for our SMB and SME clients. Since we have to wear many hats we sometimes need to bring folks in that can help us to fine tune the security layers in our client’s networks.

Here are some of the Pearls (blog category) that we have garnered over the years. This was posted originally to the SBS2K Yahoo List and has been modified for this post.

***

Layering is important.

Some examples follow.

Windows Firewall

• Windows Firewall is managed by Group Policy
• All Profiles: ON
• All Profiles: Block ON
• All Profiles: Logging ON
• All Profiles: Pop-Up for new services ON
• DOMAIN Profile: Custom Inbound rule sets for required services beyond the default.
• Private and Public Profile: INBOUND BLOCK ALL
• If data sharing is required then a small and inexpensive NAS should be set up

Mail Sanitation and Continuity

ExchangeDefender (xD), for us, is one of the principle ways we keep bad stuff outside of the network.
Why allow it to hit the edge in the first place? Plus, it eliminates SMTP Auth attacks as the WAN IP is not published via MX among other attacks. Interested? Ping us and we’ll set you up.

Edge (Router)

A solid edge device, we use SonicWALL, with a BLOCK ALWAYS rule for ALL outbound traffic is a key element. Rule sets for outbound traffic are very specific and tailored to a client’s needs.

• Examples:
• DNS queries to non on-premises DNS servers are blocked. All DNS queries must go through the on-premises DCs.
• On-Premises edge only or DCs can have the DNS Forwarders set to DNS filtering services.
• SMTP traffic outbound only from the on-premises Exchange server. Or, local copiers/MFPs to ISP SMTP server IP only
• Inbound is HTTPS via ANY
• SMTP via xD subnets only.
• RDP on ANY port should NEVER be published to the Internet.
• RD Gateway with Network Level Authentication is a must today.
• Any exceptions require a static IP on the source end to allow inbound rule filtering based on IP.
• Look up TSGrinder if not sure why…

Ransomware Protection

Third Tier’s Ransomware Protection Kit is another layer of protection. Everything is contained in this kit to deploy a very tight layer of protection against today’s Ransomware.

Microsoft Office Group Policy Security

Office Group Policy structures with Macros disabled by default, non-local sources blocked, and other security settings for Office files provide another layer.

• This one gives users grief because they need a few extra steps to get to the documents.
• We’ve started requesting that clients have a PDF only policy on their Jobs listing pages and such.

A User Focused Effort

IMNSHO, A/V at the endpoint has become virtually useless today. Things seem to be a lot more targeted on the virus side with ransomware taking over as the big cash cow. We still install A/V on all endpoints. :)

What we are saying, is that the principle portion of the risk of infection comes via the user.

A well trained user means the risk of infection drops substantially.

A user’s browsing habits and link clicking are the two key areas of training we focus on. Sites visited are another.

We suggest to clients that a company policy of allowing browsing for business related tasks only while connected to the company’s network resources. This policy can further reduce exposure.

Part of our training regimen is a somewhat regular e-mail from an outside account to users to test them and challenge them is a good idea every once in a while.

• Link hovering to discover the true destination
• Attached Word doc with *BUZZ WRONG* when opened
• Just because it SAYS it’s “FROM” someone we know doesn’t mean it is!

Backup Protection

Oh, and protect the backup loop (blog post on closing the backup loop)!

BTW, we just heard about another NAS based backup that was ransomware encrypted as a result of the destination folder being open to users.

Anyone, and I mean ANYONE, that has a backup structure, whether NAS or HDD based, that allows users and admins access outside of the backup software username and password setup needs to close that loop NOW. Not on the To Do List, not for tomorrow, not next week, but NOW.

Just in case: Close that Backup Loop Now.

Hyper-V Standalone Setups

One more point of order: In standalone Hyper-V settings leave the host in workgroup mode.

No one on the network should have the admin username and password to that host. No. One. It should be documented somewhere but not public knowledge.

Please feel free to add the layers you use to this post via comments.

Thanks for reading!

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Folder Permissions: How To Properly Disinherit Permissions

We run into a lot of ACL corruption issues and access issues when a folder has not been disinherited properly.

The following is the best method for disinheriting permissions a folder receives from its parent:

1. Right click on the folder and click Properties
2. Click the Advanced button
3. Click the Change Permissions button if required
4. Click the Disable inheritance button
5. Click the Convert inherited permissions into explicit permissions on this object.
• 
• DO NOT CLICK REMOVE
6. Click on DOMAIN\Domain Users or MACHINE\Users and then the Remove button
• This removes access to that folder to all domain users
7. Add the necessary security groups and give them MOD
8. OPTION: On existing folder sets one can click Replace all child object permission entries with inheritable permission entries from this object
• Does one want to click this? If there are customized permissions _below_ the folder being disinherited those permissions would be lost.
9. Click Apply and OK.

From there our folder would now have the necessary permissions for users in the specific security group(s) to make changes.

We enable Access-based Enumeration on _all_ shares we deploy by default. This means that users that are not in the above assigned security group(s) will not see the folder in their File Explorer.

One of the warning signs that the above process was not followed will be for domain admin or local admin accounts to get a UAC prompt when navigating the physical folder set.

As a rule we follow a trunk –> branch –> leaf structure for our folders. All users have a single point of entry with some subfolders having their inheritance blocked.

From there we prefer to _not_ disinherit any further down-level folders unless absolutely necessary because that inevitably leads to access issues and/or permissions corruption.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

E-mail NDR: #5.1.1 SMTP; 550 Rejecting for Sender Policy Framework (SPF too many lookups)

One of our clients was having issues sending an e-mail to one of our regional ISP’s e-mail servers.

• Remote Server returned ‘<inbound.server.com #5.1.1 SMTP; 550 Rejecting for Sender Policy Framework>’
• SPF too many lookups

There was no further information. The specifics came from a very helpful mail technician at the ISP.

So, we started to dig around and came up with the following:

• Sender Policy Framework Site: OpenSPF.org
• Kitterman Technical Services’ excellent SPF Tool

A ticket went through Third Tier’s Help Desk this week that was based on this problem with Dave Shakelford pointing to the following blog post:

• JangoMail Help Center: SPF ‘too many lookups” Error

So, what does all of this mean?

It means that we need to make sure all of our clients that send mail via an ISP SMTP server, third party sanitation and continuity service, or mail hosting service need to have a correct SPF record in place.

As the JangoMail blog post makes clear, we may have to jump through a few hoops to get it right, but get it right we must as our client’s mail is critical to their business.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Our Default OU and Group Policy Structure

Over the years between our experiences with the Small Business Server Organizational Unit (OU) and Group Policy Object (GPO) structures plus wearing out a few copies of Jeremy Moskowitz’s books we’ve come to hone our Group Policy configurations down to an _almost_ science. ;)

Today, with our own Small Business Solution (SBS) in production we use the following OU and GPO structure as a starting point:

We tailor all GPO settings around the intended recipient of those settings.

We use the WMI filters to delineate desktop OS versus Server and DC based operating systems. Note that the GPOs for those two sets of systems are not present in the above snip.

They would be:

• Default Update Services Client Computers Policy
• Default Update Services Server Computers Policy

Both enable Client-Side Targeting for WSUS managed updating.

NOTE: We _never_ edit the Default Domain Policy or the Default Domain Controllers Policy. EVER!

When we need something we create the GPO and link it to the OU containing the intended recipient objects or we scope the GPO via Security Group membership.

Some GP Pearls

All GPOs scoped to computers have the User Configuration settings disabled while GPOs scoped to users have the Computer Configuration settings disabled.

We don’t use Group Policy Loopback Processing. There’s just too much room for unintended consequences. Our structure above gives us the flexibility we need to hone our GPO settings down to a user or computer if need be.

Filters are OU membership, Security Group membership, or WMI Filtering.

GPO settings are like Cascading Style Sheets. Settings cascade from the domain level down through the OU structure to the recipient object. The closer the GPO to that object the more weight that GPO’s settings have.

We do not duplicate settings or put opposite settings in GPOs further down the OU structure. We create and link our GPOs accordingly.

We always enable the Group Policy Central Store (blog post) on our DCs. This makes things so much easier in the long run!

We always enable the AD Recycle Bin and if at all possible have the Forest and Domain at the latest available OS version level.

We test any intended changes we intend to make in a lab setting on a restored version of our client’s networks first! We test _any_ and _all_ intended settings changes/additions in a lab first!

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Sample Client Phish Prevention E-mail

Here’s a sample of an e-mail we would send to our clients on a semi-frequent basis to help keep users wary and informed.

If there is ever a doubt about an e-mail claiming to represent anything from a bank to a newspaper NEVER click on any link in that e-mail.

Open a new browser session and navigate directly to the purported site and log on there.

In today’s day and age we need to be very mindful of clicking on anything.

For anything with a link in it hover your mouse over and a small pop-up will happen:

The above snip came from hovering over the Unsubscribe link in the email below.

As a rule, NEVER click on a link on any e-mail with perhaps the exception of the ones CONTACT sends out with software update links. Even then, hover your mouse over the link in her e-mail just in case someone is specifically targeting the firm!

One more point: We’ve been seeing a LOT of Word and Excel based macro virus transmission files. Anyone sending something should be requested to do so in PDF format if at all possible. For folks on the not-so computer savvy side they can click on FILE –> SAVE AS –> PDF (change Save As Type to).

While PDF files are not much safer than Office files they, at least at this point, marginally better. ;)

Happy Monday everyone. :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

KB913086: Security Updates Available as ISO Files at Microsoft Download Centre

Microsoft’s security updates can be downloaded in ISO form.

• Microsoft Support KB913086: Security updates are available on ISO-9660 DVD5 image files from the Microsoft Download Center

The above site has a list of links to the ISO downloads.

We have set up a link on Microsoft’s Download Centre site to sort the ISO files with newest at the top:

• Microsoft Download Centre: Security Release ISO Image – Search Microsoft.com

We suggest bookmarking this link to gain quick access to the newest or latest ISO downloads.

Hat Tip: Thanks to Derek Knight and Russ Stamm (quietman7).

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Use Group Policy Preferences to Reveal Extensions in Windows Explorer

We have a number of different default Group Policy Objects that are set up and linked to specific Organizational Units.

With the advent of a flat OU setup in Windows Server Essentials we made an active decision to maintain a similar OU structure to Small Business Server Standard as it made more sense from so many perspectives.

One of our default GPOs that is created and linked at the domain level is the Default Domain User Security Policy. Once created we edit the GPO's properties to disable Computer Configuration settings and set a comment in place for the date created and by whom.

In this GPO we have a number of settings but the one we are focusing on here has to do with the recent RTF zero-day vulnerability we are hearing about.

Under User Configuration --> Preferences --> Control Panel Settings --> Folder Options we see the above.

We set Show hidden files and folders and uncheck Hide extensions for known file types.

Since these settings are user oriented they will be picked up by users on their next logon.

Note that while these settings help users to understand what they are seeing nothing replaces training users to hover over links, not click on links in an e-mail, or be cautious about the sites they visit.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Protecting Your Yahoo Account

So, apparently Yahoo has suffered yet another breach. A quick search of the news sites (Bing Search) would bring up more info.

Sign in to Yahoo and change the account password as soon as possible.

Then, enable Second Sign-In Verification:

We suggest using SMS as the primary method for protecting the account as opposed to the security questions.

Under Account Info:

Once the mobile is confirmed make the following setting:

This at least will provide a layer of protection unless the verification system itself also gets compromised. But, if that's the case Yahoo would probably have bigger problems on their hands! :S

While you're at it please enable 2FA (2 Factor Authentication) on all Microsoft IDs and download the Authentication App to your mobile device and _use_ it!

Now that online service providers are starting to allow us to protect ourselves with additional security steps the onus is on us to use those features!

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
Third Tier: Enterprise Solutions for Small Business

Some Mobile Phone Related Security Reading and Videos

This from Susan Bradley as far as what our mobile phone can say about us:

Now, take that the to the next level.

MVP Doug Spindler provided links to the following very informative videos.

• TED: Malte Spitz: Your phone company is watching (YouTube)

Malte went to the extent to sue the mobile phone carrier his phone was hooked up with to acquire the "Metadata" they held on him. His talk brings to light some aspects of what that data does for the NSA and other intelligence gathering agencies.

Doug also shared the following TED Playlist called The dark side of data (11 talks).

All of the talks are worth watching . . . and not for the faint of heart!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Our Client CryptoLocker Warning E-Mail

This is a copy of an e-mail we are sending out on a somewhat frequent basis to our clients to keep being Internet Street Smart at the top of their minds:

Hello all,

I may have mentioned this in the past while but it bears being mentioned again.

There is a really bad malware being spread via links in e-mail that take the user to a bad site or attachments in an e-mail that contain the bad software. Its name is CryptoLocker.

If the link is clicked on or the attachment is opened the software starts up and goes on to encrypt, that is make unavailable, EVERY file the user has access to. There are two ways to get out of the mess once the infected system is found and quarantined:
1.    Best Option: Recover the files from Previous Versions (Volume Shadow Copy snapshot) … may be out by a few hours.
2.    Okay Option: Recover or from Backup … may be a bit out of time in the form of hours.
3.    Worst Option: Pay the bad guys to decrypt the data and risk identity theft among other problems of handing over a credit card number.

Simple rule of thumb: NEVER click on a link in an e-mail and avoid opening attachments if at all possible (Especially ZIP archives). And, if a link must be clicked on in an e-mail hover the mouse cursor over the link to see where it leads to. If it looks suspicious please ask!

Our systems are designed to provide maximum recoverability however the snapshots and backups are timed throughout the day. So, if there is an infection some work may be lost!

As always, please be very careful and aware that bad folks out there are always on the hunt for more victims. No business large or small is exempt from these folks nefarious activities.

We are aware of firms, fortunately not our own clients, that are on the brink of possibly being lost due to CryptoLocker and bad or unavailable backups!

Thanks and have a wonderful day! :)

We do our best to keep folks aware of what is happening out there but things are getting even more nasty for e-mail transmissions.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

CryptoLocker Word Of Caution

One of the things we have done from the get-go when it comes to setting up ShadowProtect to stream backups to either a drive set connected to a standalone Hyper-V host or to the standalone DC in a Hyper-V cluster setting is to set the shares to allow the Domain Admin MOD.

Inheritance on the folder’s NTFS permission set is removed/copied out then Domain Users/Machine Users group will get removed altogether.

We do this for a number of reasons

• Users cannot connect to the ShadowProtect images
• They are password protected and are using at least AES128bit
• Users cannot delete the images

While we are into our client’s servers on a regular basis sometimes the occasional domain admin account password will expire in the interim.

ShadowProtect will start failing to back up to the shared folder as a result of not being able to log on so a small bonus in the mix.

We are seeing CryptoLocker problems abound lately where someone clicks on a link in an e-mail or is drawn to a compromised site. What that means is that _any_ file/folder set the user has permissions to access and modify may end up encrypted by the malware.

The _only_ way to “recover” from this situation is via Shadow Copies or backup.

If the backup drive and/or backup folder destinations for those ShadowProtect backup files, or any other product that lays down files for backup, is open for users to access then we all know what can happen.

Point of order: Any backup product that uses the volume snapshot service should have its backup times staggered over the Volume Shadow Copy snapshots as having two snapshots running simultaneously could end up with data toast on both sides.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer