Delegating DHCP Server Administration

Although it is easy to delegate dhcp server administration tasks but still some admin gets confuse because they treat DHCP delegation as AD delegation or they don't know who to give DHCP delegation access to other users.

Very important to know.

It will not be possible to assign DHCP administration and monitoring privileges to other user accounts on the server.

So, question comes then how to do that. Whenever you install and configure DHCP server role, by default it creates two active directory security account "DHCP Administrators" and "DHCP Users".

SMB Insecurely Configured Service vulnerability

This vulnerability can be cause due to many services which uses SMB in some ways. There are many related articles which you will found and they will tell you which service has problem and what should be the fix.

Articles : Tenable, Nessus, Microsoft

When i worked on this security incident, i found that there are some policies which are wrongly configured in GPO which is applying on all laptops and workstations.

There are only 4 things which you have to check on all service settings which are coming from GPO or manually configured. Then you have to remove them from ACL of those services.

1. Authenticated Users
2. Domain Users
3. Users
4. Everyone

If service is disabled, then there is not need to check this on it. If it is enabled either in Automatic Mode or Manual Mode, it is important to check.

RoboCopy Of Data Excluding Multiple System Directories

Sometimes we get a requirement to copy the complete volume to other file server and add it in DFSN and DFSR.

When you create a root folder of the volume on other server new volume which has lots of NTFS permissions. It gets difficult to copy the exact ACL on the folder of new volume. If we robocopy the entire volume then we ended up with some system folders which we don't want on our new volume, like $RECYCLE.BIN, System Volume Information and DFSR Private. Cleaning these folders are also time consuming.

You can use /xd filter in robocopy command to exclude all system folders which will reduce you work load while copying the data. Like below,

Re-Apply Configuration Profiles

Many time it happened that users who have administrator access on their macOS systems remove MDM profile, due to which all other profiles remove from the system.

If you have worked on Profile Manager as well, JAMF MDM profile is same as Profile Manager Enrollment Profile. Once it is pushed to the macOS system, all other policies which are available for your system will be pushed.

Now, you know that why MDM profile is necessary. So, we have to find a way to either restrict it or create an ongoing policy to check the MDM profiles every time and enroll it if it is missing.

Change Primary Member On DFS Replication Group

First, you need to know which member server is acting as a primary member of a replication group. From which other member servers will consider this server which would have the authorized data to replicate.