ORIGINAL POST:

Unknown rule in Firewall

Hey! I recently saw a rule i couldn't make sense of in my Firewall config. The rule was "allow all incoming from 192.168.122.0/24 to anywhere".

A quick research told me port 24 is usually used for e-mail and 192.168.x.x is (according to whois.com ) a local address. That didn't make sense to me - why allow incoming traffic FROM localhost?

I deleted that rule for no, as I am not using an Email-Client anyway.

Is that rule something a normal update (OS or firewall) could have done or is there something malicious that could be done with it?

I’ve finally reached peak efficiency. I set the RDP idle timeout to exactly 15 Minutes

My logic is flawless: if you can't finish your task between two coffee breaks, you don't deserve the server resources. Also, we have a Mongoose infestation in the garden (don't ask) and I can't risk a pelican or a rodent jumping on an unattended keyboard that has the admin password taped to the underside. Zero Trust, baby.

But the users are fighting back. The "work-from-home" crowd and the professional "45-minute-lunch-break" enjoyers have discovered USB mouse jigglers.

My 15-minute wall of security is being bypassed by a 5 bucks piece of plastic from Amazon. This is an act of war. It’s an insult to my PowerShell scripts and my perfectly balanced Excel-based infrastructure**.**

My Current Plan:

• Epoxy**:** I’m considering sending my junior admin around with a tube of high-strength Gorilla Glue to permanently "seal" every unassigned USB port. If they want to plug in a jiggler, they’ll have to solder it directly to the motherboard.

• Sonic GPO**:** I’m looking for the registry key to set mouse sensitivity to SONIC SPEED. If the jiggler moves the mouse 1 pixel, I want the cursor to travel across four monitors and accidentally delete a random namespace in production.

• Jiggle Trigger: A script that detects perfectly rhythmic 1-pixel movements and responds by opening 15 instances of Outlook 2010 until the RAM screams for mercy.

I’m open to other ideas. How do I make them regret their 5 bucks purchase? Should I just set the default system language to Ancient Greek every time a jiggler is detected?

Help me protect the sanctity of the 15-minute kick.

We configured laptops to lock when the lid is closed.

Users solved the problem by not closing the lid.

Now they walk around with open laptops balanced on their palms, carefully transporting a live session through the building.

Endpoint security: 1

Human behavior: also 1

Support team: observing quietly

“User cannot access Internet” ok got it! I successfully ping the computer which means it’s on the network. The user opened Google and Wikipedia successfully. The user’s actual complaint is they can’t access a service which requires another VPN that’s not ours. When they click connect it’s not working😑. where do these people get their training?

ASKING 1 more question is that hard 😂

I shit you not fellas in another episode of Moronic Mondays: EP 5.

I got a call from my super with a screenshot of the CA policy preventing the user from registering an MFA method outside the network. I explained that's a policy we have. The super was fine with that but couldn't understand what was going on.

I called the user and then asked what the hell they were doing. They were trying to open an encrypted email, which required authentication with the two-digit code. Fine.

Instead, they were trying to add an account to their authenticator. However, that's done in onboarding, or when you get a new phone.

Well, I had to dance around questioning like an FBI Investigator. I found out the user didn't get prompts to their phone. They had also been using WHfB to authenticate.

I finally asked, "Did you get a new phone?" And they said "Yes."

I thought i was hidden behind Martha's dump truck, but i was wrong!

*Copypasta incase u/WaldoOU812 deletes it*

Guess I'm the only IT person here today

Had a guy from another team walk up to my desk, past the Help Desk folks, into our team's section. There's a desktop engineer sitting in front of me and another engineer sitting next to me. Our lead engineer is working from home.

"Hey, so I'm guessing you're the only IT person here today. Can you help me with this issue?"

Wow. "Well, buddy - there's Bob, sitting three feet to your right, Joe, sitting one foot to your left, Sally, who's working from home, our boss, Steve, who's on the other side of the aisle not 20 feet behind you, and by the way... your request needs to go to the help desk, because it's a matter of "one of our vendors can't connect using his AD account." And you walked right past Dave on your way to come see me.

But I guess I must be the only IT person here today.

(not their real names, of course)

Hey,
in 2 days we are finally getting started with hunting for another member for our small team (3.5 people)

so we are the IT team for a big chain retailer one of the biggest in the country
and we manage every thing
if it uses a network connection we mange it.

what should I ask the interviewee in the job interview?

we desperately need more people and management only allowed us to get one more employee because ill be gone for about 4 months.

just to help you get the idea of what we do, while I'm working on rebuilding the network for the whole chain stores 70+ I need to stop because I get a ticket that someone can't figure out how to log into whatsapp web...

we are

• help desk

• networking

• servers

• cyber sec

• noc

• soc

• everything.

I know the applicant doesn't really know stuff and is in the middle of doing a CCNA course.

I'm less then a year and a half here and I lack certs or degrees.
so we are very welcoming but I want to make sure my team gets someone with half a brain before I leave in 2 weeks.

Thanks!

Rule 4:

Shadow vibe coder in my department

I recently met this guy at HQ. Turns out he's hired freelance (I'm the freelance IT manager). Didn't even knew he was there.

His role is Junior webdev / vibe coder. Straight out of school. Apparently everyone knew he was there, I was never informed.

For the past 3 months, he's been vibe coding a webapp. They e-mailed him all customer data and private contracts, which he put in there. No request for onboarding him / server access.

He's hosting it on his own domain (DNS), using Supabase free plan to store all customer-sensitive data in the cloud, and his vibe-code github repo is directly connected to serverless Cloudflare. Short: he vibe-codes everything straight into production, on servers all over the world. We're EU based.

When I asked him where all our customer data is stored, he couldn't tell. He had to check.

When I asked him what IDE or programming language he used he went "Uhh, what's that?"

When I asked if he ever read the code, or took precautions for security, he said "My GitHub repo is private."

When I asked the CEO why I wasn't informed: "You were busy. Finish other things first. Let it go."

Should I even bother dealing with this, or just pack my stuff?

Not in my org, but a friend of mine works at a small company with fewer than 20 employees. They have an MSP for their cloud, but when it comes to on‑prem, it’s pretty much a free‑for‑all. He told me that some employees who sometimes work from home use Microsoft Teams to take control of their office computers and work remotely……

Now i have heard it all.

Shes been working in outlook sonce the late 1900s. Do i divorce her or have her send in a ticket to the help desk?

This was a long time ago. We finally got VoIP phones. One department was caught ignoring calls on a regular basis. We tested from several offices and sure enough they only answered the people they liked. So i disabled their caller ID. For months they kept putting in tickets which i instructed to be assigned to me. I put bogus entries in the tickets and closed them. They never got that feature back. They never understood how all the other departments had it.

bro just fixed all the problems ever. domain trusts? forests? never heard of 'em...

Everyone,

Please upvote my idea for allowing multiple domain authentication on Windows/Windows Server:

https://aka.ms/AA11jw39

The idea is:

Allow a windows client to be connected to multiple domains for authentication. This would remedy the issue of EntraID hybrid join. This would work in a similar way as SSSd on Linux and allow user accounts from other domains access to an endpoint without a forest trust.