Tag Info

Hot answers tagged

22

Each user who performs administrative activities should have a dedicated account to perform those activities. In a Windows environment, the built-in (RID 500) Administrator account should have a complex password set, printed, and locked away in a safe, etc. for emergencies. A general tenet of security goes like this: You want to know who is performing which ...


19

If you're doing it via T-SQL: Granting a Windows Login the ability to connect to SQL Server: CREATE LOGIN [Domain\User] FROM WINDOWS; or CREATE LOGIN [Domain\Group] FROM WINDOWS; If SQL Server-based login: CREATE LOGIN [LoginName] WITH PASSWORD = 'SomePassword'; After that, you can do one of two things. You can add it to the membership of the ...


19

There is no such thing as "admins per server". You can not apply "miles-per-gallon" metric here. It's possible to have 5 smart guys administering a well designed farm of 4,000 servers. It's also possible to have 5 dumbasses not knowing how to administer a single Windows server even though they had all the right acronyms on their resumes. UPDATE: I am ...


18

I'm at a Tier 1 PCI vendor. We have something like this in place, with a few differences. The auditors are actually attempting to describe a very real problem, but doing an incredibly poor job explaining the implications and needs analysis. It is now more effective to compromise a system by using a hash of a password or an existing token. Put plainly, ...


13

There's already plenty of information(Questions/Posts) in ServerFault for a beginner Linux administrator: Linux How-to/Tutorial sites Setting-up Linux at home Tools you should absolutely know as a Windows/Linux Admin Good Linux Podcasts/Links for beginners Hidden Features in Linux How to recruit a Linux Guru What a beginner should know about a SysAdmin Job ...


13

function Test-Administrator { $user = [Security.Principal.WindowsIdentity]::GetCurrent(); (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) } Execute the above function. IF the a result is True, the user has admin privileges.


12

We currently have three levels of support for the users: Full support. The users only have basic access and a standard set of applications Limited support. We do central patching of the OS and supply applications. The user has root access. No support. We supply the user with an internet connection. The user takes responsibility for the computer, including ...


11

Web For pen testing web sites, try these Firefox extensions: (All are free.) Firebug LiveHTTPHeaders Tamper Data I've also heard good things about Fiddler (freeware, any browser, Windows only). General Networking Wireshark - protocol analysis; see what's on your network. Free, for any OS. Netcat - generic low-level client and server; the "TCP/IP ...


11

The easiest way to do this is to launch Powershell with administration tokens. To do this, you right click on Powershell (or a shortcut to it) and click on "run as administrator". Alternatively you can use elevate.cmd.


10

A collision domain is basically a network segment in which only one device can communicate at a time. This would apply to devices connected through a hub. | RTR | | | | | |switch1| |switch2| | ...


10

RHEL/CentOS uses SELinux quite extensively. Ubuntu has AppArmor as stated earlier. RHEL/CentOS has by default much less software available than Ubuntu; you may need to add repositories such as EPEL, depending what your server needs to run. RHEL uses more traditional way for booting and managing services, Ubuntu uses upstart. RHEL has more comprehensive ...


8

Check /etc/aliases, look for the line root: root@workdomain.com edit: as a test, try this echo "test" | mail root -s "this is a test" then check /var/log/maillog, and the headers when it is received on your admins machine


8

Before that I think we need to be able to login to SQL Server first. I have experienced being a server administrator, but I couldn't login since SQL Server was installed by a Domain Admin account. So you might need to start SQL Server with command-line option -m (single user mode), sqlserver.exe -m and then do as K. Brian Kelley said. More ...


8

What you're attempting to do is not a simple thing, so looking for a simple solution is a snipe hunt. Your best bet would be to pick up the Zenoss VM image and use that. It's the closest non-commercial turn-key solution you'll get. Easy. Cheap. Good. Pick two.


8

This cannot be done, in any true meaning anyway. If you don't trust the administrators you're out of options - there's always a way for them to get to the data in the described scenarios as they control your hardware (client and/or server) and your infrastructure. Regulate access through written policy.


8

If these PCs are joined to a domain and their computer accounts are still valid, you can login using a domain admin account and reset any local passwords that way. If they aren't on a domain, or their computer accounts have expired, been delete, etc. then you can try ntpasswd, a bootable utility for resetting passwords. It's Linux-based and has no fancy ...


8

I'm going to take the opposite tack as @TheCleaner. Those Domain Admin accounts' password hashes are probably laying all around your network, just waiting for a pass-the-hash scenario. Because of that, I'd recommend you remove those accounts from Domain Admins immediately, and start using them as limited users. (You should still change the passwords, too.) ...


7

Here is a simple 2 line script that performs this function $group = [ADSI]("WinNT://"+$env:COMPUTERNAME+"/administrators,group") $group.add("WinNT://$env:USERDOMAIN/usernameiwantoadd,user") For more information see Hey, Scripting Guy! How Can I Use Windows PowerShell to Add a Domain User to a Local Group? So there are a couple of notes. In the first ...


7

Though there may be a technical solution to this, it's really more of a policy/HR issue. Inform that user's manager of the situation as well as the HR department. If they turn a blind eye to the situation, then there's not a whole lot left for you to do. In this situation, they're implicitly condoning his behavior and even if you disabled his ability to turn ...


7

The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences: builtin\administrators is a domain local group, where as domain admins is a global group Domain admins are a memeber of builtin\administrators Domain admins are a ...


7

OmniGraffle for Mac is great for just kind of thing, have you considered using VisioCafe's excellent make/model-specific stencils with Visio? - actually having representative graphics of the actual servers/switches etc. adds so much.


7

I believe WMI service is enabled on most Windows Servers (as well as Desktops) by default. http://blogs.technet.com/b/josebda/archive/2007/08/08/comparing-default-services-on-windows-server-2003-r2-and-windows-server-2008-core-and-full.aspx However, you may need to configure your default Windows Firewall rules to allow this service to be queried remotely ...


7

The domain admins group should automatically be a member of the local administrators group on any given domain member, unless it has been explicity removed. Non-domain-admins can be added to the local administrators group on any domain member.


7

UAC is still turned on. This means that, while unelevated, your administrator user account is actually just the same as a regular user account. More information here.


7

use groupadd admin to add the group then you could run adduser myuser admin. However you may want to instead use usermod -G myuser,admin myuser to remove yourself from the root group. (instead of myuser,admin, list the exact list of groups your user should be a member of. If you ever get tempted to edit /etc/group directly, please use the vigr command, ...


7

Instead of publishing updates to their desktop and using those scripts (which allow the password to be sniffed out since it has to be passed in plain text to run as) you should use Group Policy Software Installation in Publish mode instead of Assign mode. This will allow users to go into Add/Remove Programs and install it on demand.


7

No. You must be a local admin on the machine to join it to the domain.


6

Think about scale, audit trail and backouts. In the real world you need to do stuff often and you often need to do it to lots of servers. So scripting and automation become important. The level of rigour tends to be higher than what you might use at home. So you need to think about how you can record your changes (the better to identify what change it was ...


6

Have a look at: http://serverfault.com/questions/11320/command-line-safety-tricks/29261#29261



Only top voted, non community-wiki answers of a minimum length are eligible