The Comms Room

8:00 PM

Have bossman call you right before he goes to talk to them. When you know they're away from their desk, shutdown the computers (better yet, take the computers if you can)

Jacob

@HopelessN00b It's complicated, not that simple

MIfe

Anything like audit in windows?

HopelessN00b

@Jacob Only because someone's making it more complicated than it needs to be.

ewwhite

Yes

HopelessN00b

@MIfe Yes. Audit logging.

MIfe

8:00 PM

In linux you can simply setup hooks for the uid doing 'unlink' or 'truncate' or 'rmdir'.

Jacob

@HopelessN00b Seeing as that is my father, I can't tell him to uncomplicate it :P

MikeyB

@Jacob Sure you can: "If you don't make this simpler, things can slip by the cracks. Is your business important to you? Do it this way."

HopelessN00b

@Jacob I'd think that would make it easier to tell him he's got his head up his ass, but I guess that's not the case for you.

Tanner

I still don't understand the problem with two backups. How much data is it?

In bytes, not metric shit tons.

HopelessN00b

I can tell my dad he's got his head up his ass and we're still good. Can't do that with my not-related-to-me boss, for example.

Jacob

8:03 PM

@Tanner It's not the size, but the amount of files they have

Tanner

@Jacob winmerge.org

Cole

I'm not following why this is so difficult?

Jacob

@Tanner and the data inside the file?

HopelessN00b

@Jacob Not a problem, really. dir /s > somefile.txt Diff against dir /s > somefileaftertheygotfired.txt

Tanner

@Jacob If it's only their files (not on a server/modified by others), modification date. Otherwise, you're definitely looking for auditing.

Jacob

8:04 PM

@Cole It's more or less not, I'm just deciding how to do it.

@Tanner It's on the file server as a remote profile...

voretaq7

@Jacob wait wait wait wait wait

HopelessN00b

Yup, and diffing the output of two dir /s runs will catch files with different sizes or modified dates. Though again, the better way is cutting off or down their access rights.

voretaq7

your dad is considering terminating someone and not cutting off their access when the walk into the "You're Fired" meeting?

Jacob

@voretaq7 no.

voretaq7

@Jacob that's what this sounds like to me....

Jacob

8:06 PM

@voretaq7 It's more complicated than that, I won't be there more than likely. I guess he hasn't made up his mind. We're going to talk after the employee leaves

voretaq7

Anyway, take a full backup tonight before they're fired, then an incremental the next day after they're gone

anything that changed they either modified or deleted

HopelessN00b

@Jacob Also known as the less popular "better sorry than safe approach."

MikeyB

PORN TIME

Jacob

@MikeyB what is it?

voretaq7

12

Q: Horrible situation - file systems mounted simultaneously by multiple independent OS instances

How do I get out of this situation safely? Details are as follow: A xen server has got block devices allocated to VMs. But these devices have also been mounted inside Xen. In fact 44 of these block devices have been mounted like this. To make matters worse, each physical device is seen ove...

That's....that poor man

HopelessN00b

8:12 PM

SSD

MikeyB

@Jacob FusionIO 3.2TB MLC cards, 1.5GBps, up to 535K write IOPS

Cole

@MikeyB brb fapping

3

and done

HopelessN00b

@MikeyB Don't suppose I could get hooked up with one to "evaluate" as well... could I?

Chris S

@HopelessN00b Pft, get in line!

voretaq7

@ChrisS it's a long line. It's easier to find someone who has one and club them over the back of the head with an old VME backplane...

:edges closer to @MikeyB and brandishes antique hardware menacingly:

HopelessN00b

8:15 PM

@voretaq7 Thanks, I needed that. Makes my current SCCM hell seem downright utopian in comparison.

voretaq7

@HopelessN00b sometimes I think "Server Fault is the internet's goddamn toilet - we get the worst configuration possible dropped in our laps".... then I go over to U&L and I'm just like.... wow.

Scott Pack

Cole

I got to play with some of the Fusion IO stuff at $oldjob

HopelessN00b

@voretaq7 Yeah, it's like some of SuperUser's bigger retards got the chance to play around on a mainframe. Actually, I wonder if it is that.

David

woo @ Securely Erasing HDDs

takes FOREVER

MikeyB

8:19 PM

@voretaq7 That is pretty fucking stellar.

HopelessN00b

@David Not really. I can do it inside 3 seconds.

voretaq7

there's also this one

but that one just herps the derp a little bit

Scott Pack

@David What's your method?

voretaq7

HopelessN00b

voretaq7

8:21 PM

that's MY method.

@HopelessN00b Less fun - only use that if I have a lot of drives to destroy

HopelessN00b

@voretaq7 Not that secure unfortunately.

Scott Pack

@HopelessN00b This one is fun too

voretaq7

@HopelessN00b THERE ARE NO DEGREES OF SECURE. If you're not pulverizing the platters into a fine silver dust you're giving your data to the terrorists!

HopelessN00b

@ScottPack What is it? Electromagnet or hole puncher?

MIfe

I guess that dude can try doing e2image and seeing what the metadata thinks will happen if you were to remount it.

David

8:22 PM

@ScottPack :8691706 well, they're for giving away, so can't actually destroy the HDD

Scott Pack

@HopelessN00b It's a pneumatic press.

@David So I go back to my original question...what's your method?

David

Just doing a 7-pass secure erase

Scott Pack

Oh jesus christ!

HopelessN00b

@ScottPack Ah, fun.

voretaq7

@ScottPack I think the NSA can recover from that

HopelessN00b

8:23 PM

@voretaq7 DoD secure. (And no, the NSA can't.)

Scott Pack

@voretaq7 Anything that sensitive goes through a shredder.

@David That's going to be a big waste of time. Since sometime in the late 90s a single pass zero wipe is considered good enough.

MikeyB

jebus:
[root@dhcp149 ~]# netperf -C -c -H fc00::1:6
MIGRATED TCP STREAM TEST from ::0 (::) port 0 AF_INET6 to fc00::1:6 () port 0 AF_INET6
Recv   Send    Send                          Utilization       Service Demand
Socket Socket  Message  Elapsed              Send     Recv     Send    Recv
Size   Size    Size     Time     Throughput  local    remote   local   remote
bytes  bytes   bytes    secs.    10^6bits/s  % S      % S      us/KB   us/KB

 87380  16384  16384    10.01      7639.35   0.71     4.49     0.244   1.539

voretaq7

@HopelessN00b the platters are still physical units(they haven't been chipped and shredded to unrecognizable bits, just stretched a lot), and you underestimate the NSA

MikeyB

Heck of a difference!

David

@ScottPack meh, too late

already started, one computer says 5 hours, the other 4

Scott Pack

8:24 PM

@David It's never too late for a ctrl+c

voretaq7

@ScottPack @David yeah, if you're paranoid - one pass of zeros, one pass of 1s, then a third pass of 0s.

HopelessN00b

@ScottPack But what if they get their hands on the hard drive dust? No, gotta do a Guttman wipe, then shred it, to keep your data safe for intelligence agency magiks!

David

and i'm outta here in 1.5, till Friday lol

so they can take their sweet time

MikeyB

@David D-D-D-D-DBAN!

Scott Pack

@voretaq7 That's not considered appropriate values.

MIfe

8:25 PM

@voretaq7 Pretty sure random writes onto the block device about 4 times will make it impossible to recover the original data.

HopelessN00b

@voretaq7 I don't, no. If he's using a proper DoD-compliant 7 pass wipe, no one can recover that data, at least not at present.

voretaq7

@ScottPack If you want to use random values you can do that too I suppose

MikeyB

@MIfe You know, if you were REALLY paranoid, you'd use sg_write_long to write the RAW data to the sectors…

voretaq7

@HopelessN00b I thought you were talking about the crusher. I have no comment on N-pass wipes, save that I would not trust any truly sensitive data to a purely software destruction

David

@HopelessN00b dunno if its "proper", its just from Disk Utility on imacs

Scott Pack

8:26 PM

And yea it was told upon high to look to the NISPOM and be glad and lo he read paragraphs 5-704 and 5-705 and it was good.

@HopelessN00b Hell, if he did a single zero pass there's zero enough chance of recovering the data anyway.

MIfe

@MikeyB not a bad idea. Most disks have a number of reserved sectors meant to replace bad sectors which you may miss on a standard 'shred' type operation.

MikeyB

Dec 18 '12 at 18:33, by MikeyB

I'm doing work right now for a telecomm provider whose security people can be a little… overzealous.
Shredding disks from decommissioned servers? That's pretty standard.
They shred RAM.

HopelessN00b

@ScottPack Yeah, depends on who you're securing it against. NSA would be able to recover the data.

Scott Pack

@HopelessN00b Physics seems to disagree.

HopelessN00b

@MikeyB <faceplam>

Scott Pack

8:28 PM

Shredding RAM is considered required in certain situations according to federal spec.

MikeyB

@ScottPack What federation?

Tanner

@MikeyB wut

Scott Pack

NIST SP800-88 is a good read.

MikeyB

@Tanner I shit you not.

Scott Pack

@MikeyB You stilly Canadians. Just wait for your new passports to arrive

voretaq7

8:29 PM

@ScottPack There's enough uncertainty in my mind with GMR drives (and flash) that I'd just as soon go over the data with some kind of scrub pattern

then again if we're talking about flash I'm firmly in the "Incinerate that shit, quench it with holy water, then burn the ashes" camp

HopelessN00b

@ScottPack Not really, no.

MikeyB

@voretaq7 hdparm --secure-erase "" /dev/sd? You don't trust your drives? :)

voretaq7

@HopelessN00b They're generally talking about "format c:" or "newfs /dev/sda" type stuff. There's less clarity on whether or not you can recover from a single pass of a fixed value (0/1)

David

no C4 for HDD, no secure

voretaq7

@MikeyB trust.... hardware? You must be new here.

@David Please. Real men use thermite

►

freiheit

8:33 PM

@voretaq7 My assumption is that a major national government (US, China, Russia) could recover data from a drive written once with zeros, but it would cost them on the order of $100k-$1M to do...

David

@voretaq7 have a friend in the USAF, they used C4

Michael Hampton

@MikeyB Actually I've demonstrated that (due to firmware bugs) certain WD drives do not actually erase the entire drive given a SECURITY ERASE UNIT command.

David

took a bunch of HDDs out into the middle of nowhere, dug a hole, piled in HDDs and C4, kaboom

voretaq7

@freiheit that's generally my understanding of the practicality too

@David that's the "fun" definition of pulverized

MikeyB

@MichaelHampton nice.

HopelessN00b

8:34 PM

@voretaq7 No, it's doable and has been done... looking it up now...

Michael Hampton

@MikeyB Worse, I actually managed to completely brick one drive by sending it nothing but SECURITY ERASE UNIT commands. Worthless because the data is still there, only awaiting someone to switch the logic board.

freiheit

@voretaq7 OTOH, if my data was worth $10M to the Russian government, I'd be more worried about your basic rubber hose attacks, really... How much time with a rubber hose before I give up my passwords? Do you even have to actually hit me with it? Stuff me in the back of a van and you've got all the passwords.

MIfe

@freiheit ^this.

voretaq7

@freiheit Generally we're less concerned about people getting their hands on our people than getting their hands on our E-Waste

MIfe

If they are out to get you, they'll get your production drives out of the running systems not the old ones you threw out.

HopelessN00b

8:36 PM

@freiheit Right, throw it in the shredder so the password, and the rubber hose attacks to get said password are useless too.

freiheit

I do one pass of 0s. If the drive is failed it goes the degausser (yes, we have an HDD capable degausser).

MikeyB

@freiheit ObXKCD:

Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)

voretaq7

Also they could beat the ever-loving fuck out of any employee in my company and still only get a little piece of the overall system. SCI is handled in pretty much the same way - you'd have to get a lot of people to get the whole thing.

@freiheit doesn't everybody?

HopelessN00b

@freiheit Why fixed value pass, and not a random value or pattern?

MikeyB

@MIfe Cue the self-encrypting drives

voretaq7

8:39 PM

@HopelessN00b because who is the attacker you're trying to protect against?

freiheit

@HopelessN00b Because dd if=/dev/zero is faster than dd if=/dev/random and there's no real difference (both render the drive useless to Drive Savers or anything else beyond one of the 10 largest governments in the world)

@voretaq7 Our official policy is "degaussing [...] a three pass format" which is extra stupid

HopelessN00b

@voretaq7 Enh, if you're going to bother wiping, it seems to me that the minimal extra effort to overwrite with a random pattern would be well worth it.

David

Where does YOUR state stand? mobify.com/blog/ios-vs-android-in-2012

freiheit

@HopelessN00b it's seriously not worth the extra few characters of typing

Scott Pack

@voretaq7 Exactly. A simple format doesn't touch the data, it just fiddles with the superblock and such. The data densities on any drive manufactured in the last decade or so are such that a proper overwrite, of any number of passes, is sufficient. There's the pretty weak hypothesis that working with an electron scanning microscope might result in data recovery, but it's never been proven. /cc @HopelessN00b

Degaussing is generally seen as not that great because it also renders the media unauditable.

voretaq7

8:42 PM

which leaves open the possibility of rewriting the same value to a given spot on the platter, which could theoretically be detected in an analysis. That's why I'm a fan of a wipe that alternates every sector at least once, if you MUST wipe as opposed to degauss or pulverize.

WesleyDavid

voretaq7

@ScottPack doesn't pulverizing technically do the same? :-)

Tanner

@David Hm, surprised Washington is Android...

voretaq7

After I've beaten the drives to the point where they shake like maracas, cracked the cases open, and dumped them all into one bin so their platter-dust comingles I'm reasonably sure that nobody can recover that data :-)

Scott Pack

@voretaq7 Degaussing is such that you have no way of knowing if the platter still contains data. Pulverizing to spec? Yeah, you have a pretty good idea that even if there was data you're not going to be able to recover it.

voretaq7

8:43 PM

(plus it's SO MUCH FUN)

Scott Pack

That works a lot better on glass or ceramic platters.

David

@Tanner same % as CA

MIfe

Well, at this stage I'm going to up the ante. All our disks are sent by private rocket straight to the sun. Not before being plasma vaporized with a tesla coil and chemically decomposed in red hot acid.

freiheit

@ScottPack degaussing is good for a failed drive

WesleyDavid

@voretaq7 watchitshred.com

voretaq7

8:44 PM

@ScottPack true - you're trusting that the degaussing equipment (pulse or spinny-magnet) had sufficient penetration to zorch everything

MIfe

They'll never get hold of my customer database!

voretaq7

@ScottPack do they still make metal-platter disks? I haven't seen one in at least 5 years

WesleyDavid

►

Scott Pack

@voretaq7 Right. It'll definitely render the electronics unusable, but it may not render the platters unusable.

@voretaq7 Outside of 2.5 units I rarely come in contact with a non-metal drive.

voretaq7

@ScottPack spinny-magnet degaussers usually won't wreck the circuits. 50/50 magnetizing the head or similar.

Scott Pack

8:45 PM

Magnetic head sounds like fun.

freiheit

If the platters are still usable, a company like Drive Savers can get the data off

voretaq7

@ScottPack all our workstation drives have been ceramic lately

Scott Pack

@freiheit Which is why we don't like fiddling with degaussing.

voretaq7

haven't crushed a server drive in a while

HopelessN00b

@MIfe Enh, problem is that a low-paid, disgruntled astronaut could always grab the drives before they make it to the the sun. Not secure enough.

freiheit

8:46 PM

(they basically stick the platter in the same model drive and pull an image)

Scott Pack

@freiheit Except for tape, in which case it works great.

freiheit

@ScottPack You need a much stronger degausser to work on an HDD

voretaq7

@ScottPack well tape is all plastic and ferrous oxide coating - you can wipe those with a pair of strong fridge magnets if you try :-)

Scott Pack

@freiheit Much.

MIfe

@HopelessN00b Yes, this could be true. Erm, in that case we nuke all our storage media from orbit. Its the only way to be safe.

Scott Pack

8:46 PM

@voretaq7 I have many fond memories of wiping tape in the radio studio.

voretaq7

@ScottPack I sense a market for used 2.0T MRI machines...

Scott Pack

@voretaq7 Honestly, we can blame tape for all these "single pass is unsafe! zomg" nonsense.

voretaq7

and if you don't secure the drive in the chamber it's dual-purpose: Degausses AND pulverizes!

@ScottPack bullshit, I can single-pass erase any tape.

Dennis Kaarsemaker

@voretaq7 starting your amateur proctology business again?

voretaq7

(just replace the tape head with sandpaper)

well actually - almost any tape.

old-school metal tape won't erase so easily

Scott Pack

8:49 PM

@voretaq7 What I mean is that if you just reused a tape without wiping it, particularly on audio, it might maintain some "memory" (for lack of a better term) of what was on it before.

voretaq7

but where the hell are you going to find 9-track metal foil tape in this century (cough*NASA*cough)

@ScottPack "ghosting" - yeah

Scott Pack

@voretaq7 Say, you get to a silent point between songs, and if you turn it up real loud you can still hear some stuff from the previous recording.

Ghosting, thanks. It's been blessedly far too long.

voretaq7

@ScottPack it's still a term that turns up FAR too often in video security systems

where they're still recording to the same betamax deck they got in the 70s

in other news, I want the DoD to sanction thermite for media destruction!

HopelessN00b

@voretaq7 That was presumably a problem with older hard drives too, since data recovery labs did develop techniques and machinery to recover ghosted data from HD platters. The increasing density of modern HDs probably killed that off a while ago, though.

Scott Pack

@voretaq7 Talk to NISPOM.

voretaq7

8:51 PM

@ScottPack they never let you do anything fun!

freiheit

@voretaq7 You just want any excuse to get your hands on some thermite

(if you get some, please share with the rest of us)

voretaq7

"But the hard drive is melted into a slag pile"
"Doesn't matter. you were all cackling too maniacally while you were doing it."

@freiheit I have plenty of thermite

or more accurately I could have plenty of thermite, given 15 minutes and a little bit of magnesium ribbon

RobM

Lots of thermite and a tendancy to quote yelling bird. Nothing to be concerned about there :-)

4

Dennis Kaarsemaker

@RobM yelling bird cumming thermite over harddisks?

voretaq7

@RobM Don't forget about Foamy! (NSFW: BOOBS)

Scott Pack

8:54 PM

@voretaq7 What I mean is that the DoD doesn't really make any decisions like that any more. They've pawned it all off on NISPOM.

RobM

Gotta love foamy

voretaq7

@ScottPack mmhmm, let's take a moment here and peruse the history of DoD technical decisions. ADA - 'nuff said?

RobM

@DennisKaarsemaker yelling voretaq7 cumming thermite over hard disks seems more likely

voretaq7

@RobM man if I could jizz (ignited) thermite that would be AWESOME.

2

RobM

I'm so not touching that one

freiheit

8:56 PM

@voretaq7 BLINDINGLY awesome!

Dennis Kaarsemaker

@RobM that's what she said!

voretaq7

@DennisKaarsemaker ...after the thermite burned her arm off.

RobM

yes

Scott Pack

@voretaq7 I'm not commenting on their decisions. Also, the NISPOM requirements were, pretty much, just drop lifted from the 5220.22-M sanitization standard.

voretaq7

@ScottPack it's hard to screw up "smash it until it's unrecognizable"

even the DoD would have to work hard to mess that up.

Scott Pack

8:57 PM

@HopelessN00b Oh, here's my data. The magnetic force microscopy recovery method that Guttman suggested was debunked in 2006 by NIST for "ATA drives manufactured after 2001".

@voretaq7 Trufth.

@HopelessN00b As I recall they discussed it in SP800-88

voretaq7

@ScottPack to be fair that was 12 years ago -- who knows what the spook brigade has been up to in the name of homeland security and such

The NSA: "Our budget isn't unlimited, but if you say no the terrorists win."

Scott Pack

@voretaq7 2006 was 12 years ago?

voretaq7

2001 was 12 years ago

Scott Pack

@voretaq7 But the research was conducted in 2006. The discovery was that the data densities for anything newer than 2001 was too high for that method to be effective.

voretaq7

@ScottPack and again, "who knows what the spook brigade has been up to"

Michael Hampton

9:01 PM

@voretaq7 That doesn't really justify "data protection by voodoo".

2

MIfe

Maybe they can suck up the binary via satellite from anywhere.

voretaq7

maybe they've found a recovery method, maybe they haven't, but isn't one of the core tenets of security to assume that everything can be compromised?

@MIfe well OF COURSE they can do that, why do you think I wrap my servers in tinfoil?!

freiheit

@voretaq7 Wrap the whole DC, too, for extra protection

voretaq7

@MichaelHampton I agree - there are SENSIBLE data wipe procedures that provide excellent security. If you need better than excellent you should take the "Destroy the data and everything that's ever contained it" approach of true paranoia

HopelessN00b

@voretaq7 Yeah. And for the minimal extra costs incurred by wiping with a one-pass random over a one-pass fixed value, it seems like a no-brainer to me. <shrug>

Scott Pack

9:03 PM

@voretaq7 Fucking kerberos.

voretaq7

@ScottPack why all the hate?... oh... kerberos

a technology born in the fires of Mount Suck

HopelessN00b

@MichaelHampton For that matter, we do protect against unproven, theoretical attacks in other areas of computer security, so why is it voodoo to do so WRT data security?

voretaq7

@HopelessN00b speaking of theoretical unproven attacks

everyone heard about NetBSD pulling a Debian, right?

Michael Hampton

@HopelessN00b He was talking about "unknown" attacks, not "unproven" attacks.

freiheit

@HopelessN00b Your public-facing app having a buffer overrun exploit, a SQL injection exploit and a cross-site-scripting exploit? That's not theoretical, that's just waiting for a CVE id to be assigned.

voretaq7

9:05 PM

@MichaelHampton we protect against unknown attacks too

Good Job NetBSD. Have a pie.

Michael Hampton

If you don't even know what class of attack the adversary might launch...

MIfe

@voretaq7 I think at that stage your entering very subjective grounds.

I can make up an 'unknown attack' of 'time travel intrusion'. Protect that.

voretaq7

@MIfe the only thing that's subjective is the "why" (at least NetBSD developers didn't go on a "Warnings R BAD!" spree without understanding what they were doing)

@MIfe BRB, finding general relativity textbook...

@MichaelHampton are we ever really sure about that? Hell I found a side-channel privilege escalation in our software yesterday!

HopelessN00b

@voretaq7 So you're saying at least NetBSD learned something* from Microsoft's implementation of UAC? At least some good came out of it, then...

voretaq7

@HopelessN00b No, I'm saying the responsible party should be beaten publicly as a warning to others to be more careful when touching /dev/random

but at least this I feel I can chalk up to "accident" rather than "incompetence"

►

HopelessN00b

9:27 PM

So.. if there's anyone hanging around that uses SCCM to deploy Windows Updates... is it necessarily a royal pain in the ass, or does the implementation here just suck?

Joel E Salas

9:42 PM

@HopelessN00b I've only heard good things

DanBig

Can someone give me a quick sanity check on SBS licensing? I was pulled to a customer site to look at an issue, they are running SBS2003 and are out of CALs. Can i call CDW right now and purchase SBS 2008 CALs and apply them without issue?

Joel E Salas

9:54 PM

@DanBig CDW is expensive but yes

DanBig

Do you know of a site where i can purchase, and get the key immediately?

Joel E Salas

@DanBig MS licensing has never been that easy for me, I think the slowness is on MS's side

@MDMarra What's the quickest turn around between buying a CAL and applying it?

HopelessN00b

@DanBig Erm, SBS keys aren't activated on the server and are handled on the honor system, IIRC. So you should be able to apply them as soon as you get the code, and not have to wait for the media to arrive.

DanBig

not in 2003 :(

HopelessN00b

Oh, sheeet, I just saw the 2008 at the end. Yeah, 2003 treats you like a pirate.

I think I'd prefer to upgrade them to SBS 2011 rather than dick around with Windows Server 2000 technology and CAL activation in SBS 2003. <shudder>

DanBig

10:06 PM

I would love to upgrade them, not in the cards at the moment

HopelessN00b

Ouch. Hope they know SQL Server 2000 and Exchange 2003 that are part of SBS 2003 go out of support within a few months. (SQL in April, Exchange in June or July).

DanBig

Yep, ill be working on that.

Anyone have an old SBS2003 cal 5 pack lying around? ;)

Joel E Salas

@DanBig I have a CentOS ISO, that's probably a better endeavor

DanBig

They are aware, i want to move them to Server 2012, and get away from SBS

MDMarra

10:35 PM

@JoelESalas what product?

Joel E Salas

@MDMarra @DanBig is talking about SBS2K3. How much does it vary per product?

MDMarra

Generally CALs are honor system except for RDS/Terminal Services

so as long as you've bought it you're good to go

i didn't know SBS cared about CALs other than the X users in AD artificial cap that you can't change.

But then again, I've never implemented SBS, so my knowledge there is thin

Zoredache

@MDMarra I don't think they even check the TS cals very closely.

I was at a place and they had 50 TS cals. A tech punched in a value of 1000, along with the correct codes, and it all seemed to validate.

MDMarra

Yeah, not sure about that, TBH

pauska

that sounds weird.. rds licensing is very picky

MDMarra

10:39 PM

The whole RDS License Host role was revamped in 2008+

Maybe you could get away with that in 2003, not sure

Zoredache

I suspect it all goes into some database and mostly gets ignored.

MDMarra

it's a hard limit

If you exceed CALs for your RDS farm no new connections can be made

pauska

they even put licensing data on ad user objects

(for rds)

Zoredache

I am saying they punched in an invalid quantity (insanely large) of cals and was accepted. Perhaps it had to do with the volume licensing plan though...

pauska

could be an enterprise agreement key

it doesn't have a limit

Joel E Salas

10:48 PM

@pauska Delicious

MDMarra

@pauska have you done anything with Intune?

HopelessN00b

@JoelESalas Well, they still charge per CAL used, it's just that the key doesn't have a limit on how many that is.

pauska

@MDMarra never touched it. popular with schools, so robm/dan probably has experience

MDMarra

It integrates with SCCM 2012 SP1 now

So you can use Intune for MDM and manage it from your on premise SCCM

It's pretty slick

pauska

but when would you use it instead of direct access + sccm?

I heard you can license per month, so it's fully understandable why schools do it

HopelessN00b

10:53 PM

@pauska When your boss hears that it's a "cloud" solution and wants to cloud all the things because the cloud brings clouding cloud cloud cloud of the cloud?

pauska

good point

I love that my CTO hates everything cloud

gaaaaaaaaaaaaaah our wsus runs on WIDS

Joel E Salas

@pauska Why

pauska

@JoelESalas because he believes that we can run stuff on our own and get much more flexibility

WesleyDavid

Clouds are good where clouds are good and not where they're not.

HopelessN00b

@pauska Oh, hey, you'd know this... do you use SCCM to deploy WSUS updates? We do and it seems like a huge pain in the ass/step backwards from having a WSUS server. Is that necessarily the case, or are we just implementing it badly?

pauska

10:57 PM

we outsource the obvious stuff like antispam.. other than that, nope

WesleyDavid

BEHOLD @CHOPPER3 LORD OF THE CLOUDS

pauska

@HopelessN00b that's my general opinion aswell. WSUS is so damn easy! but you can't really plan or guarantee that servers install updates..

WesleyDavid

Awww yisss. Screenshots == upboats.

pauska

we're about to implement SCCM (again).. first to push out regular software. Not sure about windows updates yet..

HopelessN00b