48

You can use qwinsta from the command line to display the current RDP sessions. qwinsta /server:computer01 SESSIONNAME USERNAME ID STATE TYPE DEVICE console 0 Conn wdcon rdp-tcp 65536 Listen rdpwd administrator 2 Disc ...


32

Yep, tsadmin is gone. Kinda' sucks. There's RDMS through Server Manager and the Remote Desktop Powershell cmdlets (get-command *RD*), but those both require that a full Remote Desktop Services deployment exist on that server. Those don't work on servers without RDS deployments or on workstations. You can use Task Manager... or, if you want something ...


29

Since the operational responsibility of a production system usually pertains to a Sysadmin, only a Sysadmin should have full administrative access to the system - it's as simple as that. Now, you might say "Well, sometimes we make code changes that require system reconfiguration, shouldn't we have access to reconfigure the systems accordingly?" NO If your ...


23

logrotate has the create option: create mode owner group Immediately after rotation (before the postrotate script is run) the log file is created (with the same name as the log file just rotated). mode specifies the mode for the log file in octal (the same as chmod(2)), owner specifies the user name who will own ...


16

I am not saying sysadmins are perfect, but there are a huge number of examples of developers that shouldn't even be developers. Let alone being permitted to having root access to systems with mission critical data. But in any case it is mostly about taking responsibility for changes made. For many sysadmins it seems that developers will go do things on ...


16

The user directive takes two parameters, your user and your group name. If you do not specify a group name, it assumes it's the same as your username. The error is because the group name ayush does not exist. See this document for details.


15

You're correct, the Power Users group does not do anything at all in Windows Vista and later. From http://technet.microsoft.com/en-us/library/cc771990.aspx: By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific ...


13

Just open the Users tab in Task Manager. You'll get a full list of user sessions, their states, and running processes. Also you can log them off through the right-click menu. It seems this is the replacement for tsadmin


12

I'll try to explain with a metaphor (I'm a developer, occasionally doing sysadmin stuff btw.) Painter and Interior decorator Let's say the developer is a painter, and creates a lot of fantastic paintings. Ok, maybe they aren't fantastic but he made what his employer asked him to make. He's good at that so all the paintings turn out fine. Now the paintings ...


12

I think giving jenkins group privileges to docker unix socket solves the issue. This can be modified with configuring docker daemon startup options in configuration file by adding this line DOCKER_OPTS=' -G jenkins' In ubuntu /etc/default/docker is the docker configuration file.


11

The accepted answer (using mysqldump to backup mysql.user table) is a very dangerous approach if you are migrating to a new server version. I did that in the past (migrating users from Mysql 4 to Mysql 5.1), and later I had problems trying to grant or modify privileges to my database users. This happens because mysql.users table structure differs between ...


11

No. There is no way to prevent an admin from being an admin. You cannot simultaneously have your files encrypted in such a manner so as to keep them safe from the prying eyes of another administrator on the system, and have an application seamlessly decrypt and access those files in a way that an administrator could not also mimic. To suggest otherwise ...


10

You're looking for Delegation of Control in Active Directory (AD) to grant your "IT Helper" access to perform limited administrative operations in AD. This functionality is very flexible, and I'd recommend you do some reading and make up some test scenarios to become familiar. The specific steps for delegating rights to join computers to a domain are ...


10

Subuids aren't meant to work the way you expect them to work. They are designed to map UIDs in a user namespace to different UIDs outside that namespace, which comes in handy (and actually was designed) for containers. However, a process still can have only one UID set (user namespace), and users are not permitted to change ownership of files, for obvious ...


8

I advise turning it around around and putting yourself in the position as the other party. So, in that vein: Why shouldn't sysadmins have full access to modify the source code? The long and short of it, to me, is that developers shouldn't have root access because they don't necessarily know what they're doing from the perspective of systems ...


8

I've just discovered that most of the actions can be performed from TaskManager, right on users (logoff, send messages etc...)


8

Why are your users browsing somewhere that they can see this in the first place? There are a few things I'd like to address, so bear with me. It appears you're using a domain controller as a file server if your users are seeing NETLOGON and SYSVOL. Don't do this. Have your domain controllers run AD DS, DNS, and nothing else if at all possible. You don't ...


7

It looks like you may have removed the resourcemanager.organizationAdmin role from your super admin account. You can try these steps to set it back: Navigate to https://console.cloud.google.com and ensure your are logged in with the same account that is your GSuite super admin account. Launch the Cloud Shell by clicking on the '>_' icon next to the project ...


6

Set its immutable bit to prevent even root from deleting it: chattr +i file


6

I may be wrong, but I believe that sudoers also restricts parameters that can be passed to a command/script, not just the command itself. If you try to run your .sh without the parameter it will likely work e.g. sudo /bin/bash /var/www/my_bash_script.sh So, to tell sudoers to allow that script to be run with any parameters (by apache), you would need to ...


6

That is what sudo is for. If configured correctly, a user in the sudoers file can do everything root can do as well. To edit a file: Instead of vim filename you just use sudo vim filename and similar for every other command. Creating an additional actual root user is not really possible - you can give another user the id 0 as well, but then that's the ...


6

There is a program lxc-usernsexec that comes along with lxc. This allows you to remap user id's using the maps /etc/subuid and /etc/subgid. Specifically, you can do the following. lxc-usernsexec -- touch /tmp/test ls -l /tmp/test will show that the file is owner:group the same as the first subuid:subgid pair in your map. rm /tmp/test should give an error ...


6

An LDAP search is not enough, because the ability to perform an interactive logon is controlled by the security policy in the destination computer. The policy itself ("Allow Interactive Logon") can be managed by Group Policies in the domain (which you can check using RSOP, but not using LDAP), but it can also be manually configured on any given computer; ...


5

The approach of limiting cores/cpu usage is most likely not what you want. Is it that you have a user who likes to run multicore/intensive tasks, and it ends up slowing down the whole server? The solution is to "nice" that user automatically. In your /etc/security/limits.conf, you would want to add an entry for your abusive user (-19 to 19, with 19 being ...


5

In MacOS group name is a number (Use the command: id -g -n $whoami or open MacOS Setting -> Users and Groups -> Right click on your account and choose Advanced Options). But nginx only work if I specify the group name as 'staff'. My nginx config: user MyUserName staff; ...


5

If the user is going to log in, they're going to have to be able to read some bits of the file system. You simply can't launch an interactive shell without access to certain files. If all they need to do is authenticate far enough to tunnel other connections (including, as in this case, taking advantage of the ssh SOCKS proxying facility), it's better to ...


5

In Active Directory you specify users and to to which groups they belong. These groups can be anything. The permissions related to a group can be defined anywhere outside of AD, so there is no overview of 'permissions' in AD. For instance, on a particular server you can view your file access permissions on that server. These permissions are not visible on ...


5

You get the permission denied error because the /home/builder directory is missing the x (execution) bit for group and others. This prevents that group members and others can change into the /home/builder directory or access anything beneath. Depending on what if that was just set accidentally, you could just add the x (execution) bit for group to /home/...


4

You are receiving this error because (as you correctly surmised) foouser is not a superuser, and does not have the CREATE DATABASE privilege. You can create the database as your postgres superuser, with foouser as the owner, which is probably the most sane option. Alternatively you could make foouser a DB superuser (definitely not recommended), or grant ...


4

This advice feels a little dated; It comes from an era where naughty developers who had a root password would go in and make changes on the live system. These days no one should be making changes to a live system, neither developer nor sysadmin. Making changes on a server is the job of a system such as Chef or Puppet. Our industry moved beyond the ...


Only top voted, non community-wiki answers of a minimum length are eligible