GeneMoody-Action1

I am glad support got you sorted out before I even got out of bed, they are good! Personally when I had to delete a profile, I just spun off a process in the background that temporarily disabled Action1, deleted the profile, and started the service back. Not something do often as most the systems I manage are single user, and policy is to wipe between users. Only done it through Action1 once as a diagnostic step. They were spot on with the holding of profiles, that is just how they function. And is pretty common in other systems that search the systems for malware/software/etc. The penalty of trying to get clever like making occasional copies and loading the copies is A. is introduce an inaccuracy / race condition B. To actual in them for any remediation process, then means you have to load them anyway. Just so you know as well in the future, if you want to see what is holding any file handle on the system, Microsoft sysinternals makes a tool called "handle", you can run it elevated, redirect its output to a text file, and search for the offender. It is real helpful when you are trying to do file operations and it tells you something is in use!

Correct, when you create a task one of the options when you add a trigger is "On an event" And in case you did not know and or never noticed, when in the event viewer, you can right click an event and choose "Attach a task to this event", saves the guesswork on getting the trigger details correct. Just be careful especially in events you expect to happen rapidly or in high volume. There is a massive race condition there, so what can happen is you catch the first event but by the time the script fires and reads yo read the "top 1" and it is an event that is newer, having happened between trigger and that read. Also be very very careful on script security, when you reference a script on disk vs a one liner, one of my favorite ways to get escalation is when someone creates a folder of scripts with tasks tied to them, runs the task elevated but does not set proper ACLs on the scripts to edit! (Happens more than you know) An example of a oneliner below as well, -Command "& {Send-MailMessage -From 'AD Monitor ' -To '[email protected]' -Subject 'AD Group Member Addition' -Body $((Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4728} -MaxEvents 1).Message) -SmtpServer 'smtp.example.com'}" SO I will stress again, these are *ways* and nice tricks to have up your sleeve, if you expect high volumes though there are better logging/alerting products.

Just in case people did not know these are out there. https://www.microsoft.com/en-us/download/details.aspx?id=106255 And https://admx.help/ Both great resources for better understanding all the minute configuration points in windows.

Yes, I use a powershell script, scheduled task, and email / ticket system. I impersonate the user so the "Mail my manager when I submit a ticket" follows through. Task is triggered on 4740 event, script retrieves last 4740, strips out details, builds a message and sends.

In case anyone comes across something similar in the future or finds this looking for similar... When a DHCP discover packet is sent it is neither aware of IP OR SubNet The process takes place over broadcast of 255.255.255.255 meaning anything in my broadcast domain (Which can be used interchangeably for the most part with VLAN, or absence of one as default VLAN) Think about it, you get your IP/Subnet *from* DHCP. So you have DORA (Discover, Offer, Request, Acknowledge) Discover - "Anyone out there to give me an IP?" Offer - "Sure would you like this one." Request "Either 'I'll take that one.' or 'I would really like this one instead.'" Acknowledge - "Alright, I have you marked as having that one proceed.' With that exchange comes an IP AND subnet, and if any host lives in the broadcast domain on a higher subnet, you just made orphans... Subnets overlapping is almost always a bad idea because it can lead to this and other confusions, thus unpredictable behaviors. If you are sub-netting for a reason, it is assumed to be logical isolation, and you should be routing between them. Otherwise, you have IPs that can send to other IP endpoints that have no way to respond, for which I can think of no valid reason.

IF you have not solved this by now, and or similar is still happening, I am curious what you have your DHCP lease time set to? And do you have any IP addresses listed in your DHCP as bad address?

This sort of thing can also happen when someone maps a resource to a sever, using alternate credentials and chooses to save them. Or when scheduled tasks are set up as credentialed. I have tasks set up to monitor EVT: Security for 4740, and each time a computer locks out it generates a help desk ticket with the event details who was locked out and from what computer. Once, helpdesk contacts user to see if they need assistance, and escalates if user is none the wiser as to how. Twice, escalated automatically. Three+ times escalated to admin.

Assuming the drive is in raid, and you have a hotspare, this *should* not cause data loss/failure while it rebuilds, if not raid... corrupt drives can cause any number of issues, so all bets are off there. If it persists after a raid rebuild (Or future windows update anomalies) use Get-WindowsUpdateLog, it will consolidate the logs relating to window update function, and put them in a easy to parse format in a file on your desktop. It is very helpful for digging into the ambiguous errors windows update often gives.

I just recently started roaming through several new forums, and I am here if anyone has any questions, I am not sales and do not do pricing, but I will help anyone with anything Action1 or otherwise. Been in IT for decades, if I can assist anyone just let me know. I do want to point out though that original quote price is annual, so 4500/500 = 9 per endpoint per year, that / 12 = 0.75 per endpoint per month.

https://www.linkedin.com/posts/action1corp_in-the-ma-game-rumors-are-currency-we-activity-7232420887487004672-FKtV/