Is there a better room for this site? Also, this may not be the best room for me to ask this question in, so shoo me in another direction.

What would you monitor to monitor what your IT department is doing? Besides RSoP. Assume a Windows network. Things like what RSoP shows changes over time.

$repoFolder = Split-Path -parent $MyInvocation.MyCommand.Definition;

git pull origin master;

$runtime = [DateTime]::Now.ToString("yyyy-MM-dd HH:mm");

$userName = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name;
$userFilename = "$($env:UserName).txt".ToLower();
$machineFilename = "$($env:ComputerName).txt".ToLower();

$userFilePath = (Join-Path (Join-Path $repoFolder "users") $userFilename);
$machineFilePath = (Join-Path (Join-Path $repoFolder "computers") $machineFilename);

[IO.File]::WriteAllLines($userFilePath, (gpresult /user $userName /scope user /z))

Not everyone speaks git, or powershell, but all I'm doing there is gathering the RSOP and writing it to a file, once for the computer, and once for the user, on the assumption that I have rights to do so, and dropping it into a git repo that I control.

I also setup a scheduled task to run this in the background silently.

Param(
	[Parameter(Mandatory=$false)][switch]$Force
)

$existingTask = Get-ScheduledTask MonitorRSoP;
if (!!$existingTask -and $Force) {
	Unregister-ScheduledTask MonitorRSoP -Confirm:$false;
} elseif (!!$existingTask) {
	Write-Host "Task already registered. Use -Force to recreate the task.`r`n";
	exit 0;
}

$NewTaskCredential = $HOST.UI.PromptForCredential("Task Credentials","Please specify credentials for the scheduled task.", ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name), "")

So what I'm curious about is what else would you, if you were me and paranoid about your IT group making changes that devastatingly break the dev environments, what would you monitor here?

I know they mean well, and we've had the round and round about that they should tell us when they make changes that are that breaking, but sometimes they "forget" or they just aren't motivated to keep us in the loop

Okay, that's enough room spam for a bit, I'll wait on replies

If they are working on a big project, they need to use some sort of revision system, in which case it doesn't really matter if they make a breaking change, because you can easily git blame (or whatever equivalent your revision system has). If you're all working on a single monolithic blob of code and the only revision history is the previous file.c.bak, you're in for a rough time.

@forest Are you replying to me? I may have overwhelmed the chat window if so, and I can re-state the question

> What would you monitor to monitor what your IT department is doing? Besides RSoP. Assume a Windows network. Things like what RSoP shows changes over time.

I know close to nothing about Windows, unfortunately.

But I think this raises the question, what do you define as "doing"?

Do you want to monitor just changes they make to a source repo? Changes a sysadmin makes to a production server? The porn^WStackOverflow posts they browse on their work computer when they're waiting for a project to compile?

I think in this case it would be helpful for you to run a gpresult on a computer >.>

blog.thesysadmins.co.uk/group-policy-gpresult-examples.html

Don't even have a Windows computer with me. I guess I can't be much help for a Windows-specific question.

Heh

I'v seen good question about scam in finance stackexchange, but this one is just "a rondom guy want my credit card for no reason. sure it seems like a scam but he seems to know me so no way it's a scam. is it a scam?"

Every once in a while, it's something like this that reminds me that obviously the only reason scammers keep at it is because it actually works, no matter how much I'd like to think that no one would be dumb enough to fall for it...

uuuh, why is someone VTCing questions that are older than a year?

I didn't even know it was that old, I just saw it in the close queue or wherever, skimmed it, and VTC.

Also jesus christ, promoting GRC should be a bannable offense.

well, I did too, to get it ouf of the queue

lulz

he is da man!!1

:p

Also, just for opinions, this is spam, right?

It looks almost vaguely relevant, not quite as bad as a markov bot, but still seems to miss the point while linking to commercial sites.

> You can do the following in order to secure your smartwatch:

> 1. Shield your smartphone

yup

pretty good spam to be fair

as in well crafted

Agreed, kinda surprised me.

But they forgot one thing... We all know that shielding your phone does not prevent flooding the system with electricity.

nothing prevents your system from getting flooded with electricity

Especially if someone can capture the internet long enough to cut antivirus.

Hey guys ! Im new to kali linux. Im currently trying to pentest my own system. But somehow all my attacks are blocked by norton security. Is it somehow possible to bypass that ? Im using eternalblue and currently generic/windows/reverse_tcp as a payload :)

Anyone here ? :D

Anyone here to help ?

Guys ?

Well, it's lunch time in Europe, and wake-up time in US, so don't expect any answer in minutes :(

Well... i guess i need to wait than :c

Well i just generated an custom payload using mfsvenom. I also encoded it using x64/xor.... but somehow my av still blocks the attack. I someone heard that encoding the payload would make the attack bypass the av

So anyone already returned from launch ?

Well somehow metasploit is waiting for "Receiving response from exploit package"... it doesnt receive anything... hmmm why could this happen ?

Well i could still need some help

Why don't you ask a question on the site?

Already did ^^

But i hoped someone here in the chat would be faster

Does anyone know if Windows 7 Professional is secured from eternalblue ?

do you mean currently?

Yeah ... i have installed win 7 professional on my test pc ... the auxiliary tool tells me it isnt vulunarable...

This win7 version is up to date

My win7 machines architecture is also x64... And the service pack is 1... so everything should be fine for eternalblue

@genaray - So you have current updates, and an AV - and you are surprised your exploit didn't work?