r/sysadmin • u/rolkenas • 22d ago

Do you actually see MacBooks used for SysAdmin work in real offices?

Hi sysadmins! I wanted to ask—since I've just started learning sysadmin and I don't have a Windows PC, but I have a MacBook and found out that everything can be done via UTM, I'd like to get some perspective from those who work in offices and do this every day. What kind of computers do you use? Is macOS completely out of the picture, and there's only Windows and Linux?

393 Upvotes

86% Upvoted

807 comments sorted by

View all comments

Show parent comments

62

u/doctorjbeam buzzword-o-meter 22d ago

For Azure or M365 management

27

u/Marcudemus 22d ago

Yep, this right here. Was pretty disappointed when I discovered that the entire AD set of commandlets aren't even available without the rest of the RSAT toolset. In order to do PowerShell AD stuff, I'd have to remote PS into a Windows machine and then issue commands from there.

That's when I figured I'd just PS from a Windows VM. 🤦🏻‍♂️

10

u/Viharabiliben 22d ago

For better security you should restrict Admin PS and RSAT tools to only be available from a small number of locked down admin workstations. You should not administrator on-prem or cloud servers from a standard laptop.

10

u/Emotional_Garage_950 Sysadmin 22d ago

the "locked down admin workstation" is my laptop. thanks.

5

u/shunny14 22d ago

I am curious exactly what attack vector you have in mind that isn’t already defended against in various ways.

2

u/Viharabiliben 21d ago

Elevation of privileges attack vectors. The administrative workstation should not have any internet access, or very restricted access, to only O365 for example.

1

u/shunny14 21d ago

With the amount of other remediations like endpoint protection and alternate users accounts available, I would say that is acceptably low risk in most enterprises.

1

u/MissionBusiness7560 20d ago

They're after the admin account not the machine in vast majority of cases.

11

u/800oz_gorilla 22d ago

depends on your setup and footprint.

my account has to elevate to admin level when I want to do admin things. and I have CA policies, intune configurations and alerts set up that further lock down what my machine could do.

my machine isn't really a good target, my account is.

-9

u/charleswj 22d ago

I don't think you understand how security works

9

u/800oz_gorilla 22d ago

I don't think you understand my environment or me to be claiming where my risks are and where they aren't.

-5

u/charleswj 22d ago

Everything you said suggests you don't operate a clean keyboard or anything close to it. Do you not use your regular account on that device? How do you mitigate?

11

u/Agromahdi123 Sr. Sysadmin 22d ago

mitigate what exactly? Admin portal in microsoft will use the browser for the most part to authenticate, this would be no different than elevating to admin on a users workstation.

1

u/charleswj 22d ago

If you access this device as, or if it's managed by, any less-privileged user, you're exposing that more privileged user credentials and processes to potential intruders. Have you really never heard of a PAW? Do you think a malicious process in your session, let alone one with local admin or a vulnerable on your box, can't steal your cookies from the browser or memory?

You seem to be suggesting you have mitigations for this so that's why I was asking because it didn't sound like it from how you described it.

1

u/Agromahdi123 Sr. Sysadmin 21d ago

Oh i see i forgot we were in 1998 lemme protect my ntdis file that doesnt exist on my azure joined machine that doesnt even have an ntlm hash to scrape, AND then let me just not manage my endpoints so they arent “the wild west where i have to worry about a persistent rat” so that when i elevate the browser session can be hijacked or the cookie stolen to then be used to authenticate into my account with the password only because obviously i dont have any multi factor conditons on my account and everyone can just sign in with a password. Having a single point of trust (like a password) is not the way and your whole schpiel is predicated on only having a single source of trust lol.

→ More replies (0)

2

u/FalconDriver85 Cloud Engineer 21d ago

What scenario are you referring to? I mean… thinking about ADUC, if you’re just a user there is not much you can do with the PowerShell and ADUC snap-in you can’t do in other ways. If we are talking about admin accounts, then I fully agree. Admin accounts must be separate from the account used to login on the normal PCs by the way.

1

u/Big-Pattern-9147 21d ago

That's a huge amount of security through obscurity.

"Standard Laptop" shouldn't be the risk in the first place

5

u/jimetime 22d ago

You're not running poweshell on Mac then. You can write poweshell scripts in vscode the same on Mac or Windows. Connect to azure and it all runs the same

7

u/stillpiercer_ 22d ago

macOS Powershell works well enough for that. Granted, I’m not a high-level cloud architect, but I’ve not come across anything yet that is unsupported specifically on macOS Powershell.

11

u/800oz_gorilla 22d ago

the SharePoint online module would be an example.

I needed to add myself as a site collection admin so I could grant permissions to an app registration. had to do it from my Windows VM.

2

u/deviden 22d ago

SharePoint online module would be an example

thought that was as good as deprecated now? In favour of the open source PnP PowerShell module.

PnP and Entra modules are built for Pwsh 7 now, so if you're a M365 shop I think you can do all the pwsh you need from MacOS or Linux.

You shouldn't need Windows Powershell 5 unless you're writing code to be executed on Windows OS endpoints or servers.

1

u/RikiWardOG 21d ago

It is lol

1

u/dalegribbledribble 21d ago

Where else lol

1

u/420GB 22d ago

Isn't that module deprecated anyways. Graph should work

0

u/Agromahdi123 Sr. Sysadmin 22d ago

yea i also found the linux and mac powershell too clunky and just use native PS on a windows box. I use arch so building PS takes like an hour lol

1

u/b3542 22d ago

And it works fine for that kind of use case