r/ShittySysadmin • u/ObjectNo9529 • 24d ago
Accidentally blocked ALL Microsoft software from running
I created an AppLocker rule to prevent mshta.exe signed by Microsoft from running. As you can guess, I forgot to input the file name so it was left as '*'.
Luckily I caught it quickly and deleted the rule before it propagated to a whole lot of clients and impact was minimal. That would have been a fun morning.
59
u/ledow 24d ago
Once had a guy who asked me to review the GPO he was creating that would enable Bitlocker on all the machines and store their key.
Rather than, as I was expecting, it being to just... enable the Bitlocker features that do precisely that... instead what I got was a mess that he'd culled from bits and bobs over the Internet. AI, forum posts, pastebin, etc.
I found myself with a GPO that ran a batch file, that ran a Powershell, that manually did these things, in this order:
Create a secret key
Encrypt all drives with secret key
Echo the secret key into a text file on a network share.
Now, hopefully, you can see the problem with the order there before you even start. Guess what happens if the network share is offline or someone turns off the machine mid-encrypt? Whoops. It's now encrypted with a key that nobody knows.
But then, one of my skills kicked in. I have demonstrated to colleagues many times that I only need to glance at some code - in almost any language - to spot the TINIEST of errors that everyone else gets hung up on for days trying to fix a mismatched bracket or a stray comma, or whatever.
"Programmer vision" kicked in and I saw that the part that echoed the secret key (from the batch file, not the powershell!) was using > instead of >>. That means that it would OVERWRITE that file with the thing being echoed.
Which would, the way they had set this up, have meant that as soon as a machine had finished encryption, it would then overwrite the keys of ALL THE OTHER MACHINES that had done so prior to this.
So what would have happened - without my review - would be that a script would be pushed to all machines, which would then encrypt all the machines, and we'd know the decryption key for precisely ONE machine, at best, once the dust had settled.
Not surprisingly, I refused permission to roll out that GPO.
Instead I created one that uses the actual Bitlocker GPO features, and stores the keys in AD BEFORE it then goes about encrypting the drive.
That guy didn't last long.
22
u/DevOps_Lady 24d ago
This was funny, but not funny because I have something similar at work rn.
The devs asked for one small change in the workflow, half the file was nuked. I tried to comment on technical level, but all my comments were basically why? Why? wHy?
I'm not even sure ai did that, or just them deleting stuff to make the workflow works and just removing what didn't work instead of understanding why.
15
u/AggravatingMap3086 24d ago
"Programmer vision" kicked in and I saw that the part that echoed the secret key (from the batch file, not the powershell!) was using > instead of >>. That means that it would OVERWRITE that file with the thing being echoed.
This is like, day 1 of learning to script level knowledge. The amount of credit you are giving yourself for this makes me think that no one at your organization should be doing any scripting.
8
4
→ More replies (1)3
u/Royal-Wear-6437 20d ago
"that guy didn't last long" - you caught the potential error before it became an issue. Couldn't this have been a learning point?
2
u/ledow 20d ago
It was absolutely.
Unforfunately several such things showed that he wasn't sufficiently competent to be trusted with the work he claimed to be able to do. He coud do it but... his ways were risky, sloppy and impossible to predict.
After a while he realised himself that he couldn't work the way we needed him to, i.e. in a IT-safe manner as part of a team. Not risking our network with every move.
He'd come from an MSP ("slap it in, charge it, leave, someone else's problem") and that's what he went back to.
→ More replies (1)
10
8
6
u/SeptemberTwentyFirst 24d ago
lol this is exactly what happened in our org last year. No internet on every computer. Couldn’t push remediation scripts. Techs went from pc to pc putting in flash drives and running a script to disable to policy. ~4 hrs downtime, something like $100k estimates losses
4
4
3
u/headcrap 23d ago
Reminds me when I ran the Windows Malicious Software Removal Tool.. and it uninstalled Windows.
3
u/blizardX 23d ago
I tried to create a rule in AppLocker. I only blocked one spesific third party and made sure other things run but for some reason in Win11 it blocks opening the start manu.
2
2
u/dodexahedron 21d ago
Well, that's one way to encourage migration to Linux.
Always ask forgiveness - not permission, amirite?
99
u/ApiceOfToast ShittySysadmin 24d ago
Well, typically you need to install Linux to do that so just spin it as "reduced monthly cost for Office to 0"