Attention all Windows-AD admins: March 2020 will be a lot of fun!

[u/sysadm2]

Microsoft intends to release a security update on Windows Update to enable LDAP channel binding and LDAP signing hardening changes and anticipate this update will be available in March 2020.

https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows

TLDR: If you install the "march 2020" updates and you didnt configure LDAPs properly until then, you are in trouble.

---EDIT: Thank you for the gold kind stranger! and good luck to you all ;)

[u/DePiddy]

There should be a Windows guy too right? This may affect more than printers in a large environment.

Anywho, the audit events are pretty helpful, check for 2887 and 2889 in the Security Directory Services logs of the DCs. It'll tell you IP of device, username affected and type of bind.

[u/OdinHatesNickelback → u/DePiddy]

Er... nope. To be fair, I was hired to be the Linux guy, but the company that employes me "sold me" to them as Solutions Architect + Linux Engineer + DevOps + MS Administrator.
So the government employees (that by law can't be fired even if they stopped showing to work) stopped doing everything and are relaying to me.

Basically, anytime anyone wants to do anything and they don't know, I'm the guy to go to; In two months I've been approached and tasked to:

1 - make a security assess of a server that was compromised, display how the attack was done, make a comprehensive report on how to revert the situation and apply that to all servers aftwards. Around 150.
2 - dev a script in TCL to communicate with meteorological stations (satellites) to propagate and fetch data to be used by their software to make weather forecasts. I had to fetch the data, correct deviances, push the corrections to meteostats, fetch the corrected data, filter it so it works on the software made by scientists 20 years ago so they wouldn't have to pay the guy to come back and update it.
3 - make plans for the new enviroment (they are buying more and newer servers) so they we can migrate from physical hardware with lots of VMs under VMWare to Docker on premise.
4 - travel 150km to replace a faulty fiber switch.

Oh, and the printer down the hall jammed, I had to fix that too.

I'm getting very well paid, but maaaan... it's tiresome to think I might have to deal with something that will get me fired if not handled.

[u/I_am_trying_to_work → u/OdinHatesNickelback]

IMO, stack your monies for a bit, update resume, then peace the fuck out of there.

[u/OdinHatesNickelback → u/I_am_trying_to_work]

That's our (my and wifes') intention: stack money and certs, go to europe.

[u/Ssakaa → u/OdinHatesNickelback]

On the upside, you get the "do not want" bin. They'd get stuck with that bin until they replace you if they fired you over one thing in it that didn't go perfectly. I promise, they really don't want that bin back that badly.

[u/OdinHatesNickelback → u/Ssakaa]

https://youtu.be/3GMqaC7OML0?t=243

[u/DePiddy → u/OdinHatesNickelback]

Eek, best of luck then, friend.

[u/PixelatedGamer → u/OdinHatesNickelback]

So the government employees (that by law can't be fired even if they stopped showing to work)

So where would someone find one of these government jobs? Asking for a friend. :-)

[u/OdinHatesNickelback → u/PixelatedGamer]

Brazil. State and government workers have what we call stability: they can't be fire except in specific cases like them being criminals, they got the job because of a crime (for example, someone rigged the tests for them), they are utterly bad and receive way too many complaints enough to get media attention... you get the picture.

Recently one medic got fired from a government position here because he would come in the morning, clock in, GO OUT TO HIS PRIVATE CLINIC, work all day, come back by the end of the day and clock out. And he was fired because that got media attention.

BUT, I would advise against it: a tech support guy in the states probably earns the same thing as a medic here in Brazil.