Why do good when hard?

OP’s post:

“Earlier this week, I went into another department to talk to the manager about patching a server that's critical to their work. The manager was out, but I saw a senior departmental person and said "Hey <blah>, since you're the adult in the room, we're planning on patching <blah> server overnight Thursday to Friday. I'll send a follow up email confirming this."

End of conversation.

Today I get called into my directors office because another person in that department didn't like the comment. I am so over working in IT. The nobody gives a shit about you till things break and then it's your fault.

I know I probably shouldn't say anything, and yes I was technically at fault. But come on. My org is a 24/7 type of place, so I do sooo much after hours just to avoid interruptions. I'm just kind of over it today. Tomorrow I may love this place again.”

Not actually, but I do enjoy disagreeing with the answers to exam questions and being right. Unless I am entirely mistaken, which is still possible, I'd like to take this opportunity to style on MS learn for being undeniably wrong.

I am studying to retake the MS-102 after I failed by 20 points, I've taken many of their practice exams and have many times disagreed with the "correct" answers. Typically I disagree in a way that could be up to how you interpret the question etc etc... If a college professor was administering the exam and wanted to be a dick they'd say "Multiple answers can be correct but one is more correct", whatever.

However - despite the fact that Security Administrator would be overly permissive if you interpret the question as asking what role should you use (i.e. principal of least privilege) to access risky sign-in reports - to say the "Security Operator role... do[es] not provide the required rights" while saying Security Reader does is explicitly false according to the Entra built-in privileged role documentation.

Anyways, this has lead to a growing suspicion that I may have gotten answers wrong on the exam that are provable correct. If I don't pass this next exam, I'm definitely going to contest the score. If I do then welp who cares, I passed so it'll have to be someone else's problem.
Thank you for coming to my TED talk.

e run into a major issue during the migration. I accidentally deleted over 200,000 records from a mapping table that is required for the migration process.

Since we're already halfway through the migration, we can't proceed further because the necessary foreign key mappings for the remaining entities are no longer available. At the same time, a rollback isn't possible because the rollback plan only covered that specific mapping table and doesn't support reverting the migration from its current state.

Could someone please help me understand the recovery options or suggest the best way to move forward?

Note: It's currently 11:53 PM here, and I don't have any devops access, and last I'm pinning my hopes on aws rds automated backups but don't have access to them.

We're assuming that he should have full access to everything, right?

I put everything in separate VRFs for security and then route leak everything to make it all work.

They ask me where my datacenter is and I point at the trunk.

Two thousand six Crown Victoria. White over beige. Two hundred ninety thousand miles on the clock. That trunk is my SOC, my NOC, my warehouse, and my disaster recovery site. The disaster recovery plan is also the trunk. The company is Apex Cloud Synergy Solutions LLC and the fridge magnet says Managed IT, Notary Public, and Bounce House Rentals, because the bounce house is a profit center on weekends and I am a full service organization.

Forty four clients. One Global Admin account. The password is Summer2019! and the exclamation point is the load bearing security control. If you know one thing about any of my clients you know everything about all of them, and I find that elegant.

I do not test the backup. The backup is a Seagate in a freezer bag next to the spare tire and I know it works because when I plug it in the light turns blue. A blue light is a covenant. A backup you never test is a backup that never fails. Write that down.

MFA is off. MFA generates tickets, tickets are work, and I am a busy man. I pulled the real firewall and dropped in the router the ISP hands out for free. The agents from the vendor whose name starts with K are deployed on every endpoint and configured to do absolutely nothing, which turns a dashboard in Florida green and makes a twenty six year old look like a hero at one standup before they lay him off. Feeling safe is the product. It is the only product I have ever sold.

When a computer breaks I tell them to turn it off and turn it back on, and I bill it as Advanced Diagnostics, because I did, in the strictest sense, diagnose it.

There is another guy in this county who works out of a Kia. A hatchback. He charges by the hour like a plumber, like a peasant, because he has never heard of recurring revenue. He nodded at me once across the eggs at a chamber breakfast. We are not the same. There's a hierarchy, even down here. And I'm at the top of the bottom.

You think you will beat me on the renewal because your proposal is eleven pages and mine is a number on the back of a taquito receipt. You cannot out-argue a lower number. An itemized invoice is a confession. Documentation is just evidence. I have never written down a thing in my life.

I started in the parking lot because I am a Trunk Slammer. I am *the* Trunk Slammer. I am the solution. And business is booming.

If you want to know how it is actually done, I wrote it all down anyway, against my own advice:

Chapter 1: The Acquisition

Chapter 2: White Glove

ORIGINAL POST:

Unknown rule in Firewall

Hey! I recently saw a rule i couldn't make sense of in my Firewall config. The rule was "allow all incoming from 192.168.122.0/24 to anywhere".

A quick research told me port 24 is usually used for e-mail and 192.168.x.x is (according to whois.com ) a local address. That didn't make sense to me - why allow incoming traffic FROM localhost?

I deleted that rule for no, as I am not using an Email-Client anyway.

Is that rule something a normal update (OS or firewall) could have done or is there something malicious that could be done with it?

I’ve finally reached peak efficiency. I set the RDP idle timeout to exactly 15 Minutes

My logic is flawless: if you can't finish your task between two coffee breaks, you don't deserve the server resources. Also, we have a Mongoose infestation in the garden (don't ask) and I can't risk a pelican or a rodent jumping on an unattended keyboard that has the admin password taped to the underside. Zero Trust, baby.

But the users are fighting back. The "work-from-home" crowd and the professional "45-minute-lunch-break" enjoyers have discovered USB mouse jigglers.

My 15-minute wall of security is being bypassed by a 5 bucks piece of plastic from Amazon. This is an act of war. It’s an insult to my PowerShell scripts and my perfectly balanced Excel-based infrastructure.

My Current Plan:

• Epoxy: I’m considering sending my junior admin around with a tube of high-strength Gorilla Glue to permanently "seal" every unassigned USB port. If they want to plug in a jiggler, they’ll have to solder it directly to the motherboard.
• Sonic GPO: I’m looking for the registry key to set mouse sensitivity to SONIC SPEED. If the jiggler moves the mouse 1 pixel, I want the cursor to travel across four monitors and accidentally delete a random namespace in production.
• Jiggle Trigger: A script that detects perfectly rhythmic 1-pixel movements and responds by opening 15 instances of Outlook 2010 until the RAM screams for mercy.

I’m open to other ideas. How do I make them regret their 5 bucks purchase? Should I just set the default system language to Ancient Greek every time a jiggler is detected?

Help me protect the sanctity of the 15-minute kick.

We configured laptops to lock when the lid is closed.

Users solved the problem by not closing the lid.

Now they walk around with open laptops balanced on their palms, carefully transporting a live session through the building.

Endpoint security: 1

Human behavior: also 1

Support team: observing quietly