Davit2005

Personally I'd get rid of the BT hub and use something like a DrayTek or Cisco vDSL router and then pass the Public IP address to the firewall (i.e. modem mode) if they have a static IP. If they are not using a static IP you could prob jus connect the FW to the DrayTek and use a RFC 1918 subnet that is unused internally between the FW and the vDSL router. Depends what setup you have at the moment.

This should work i.e. ## Output Version number Write-Host "Version $version" -ForegroundColor Green I got a habit of always putting comments in shell script too :-)

I don't think is another way to put it than to have least priviledge role to perform the tasks needed and this does not only go for the Global Admin role either. The PIM looks interesting though. I would also suggest not using a regular user account either and maybe creating a user that is in Azure only and not a published or easily guesses email address.

Add an additional RAID group for the 2 HDDs. They should then shown up.

The principal of least privilege jus the same as you would use on other systems. https://en.wikipedia.org/wiki/Principle_of_least_privilege#:~:text=The%20principle%20means%20giving%20any,backup%20and%20backup%2Drelated%20applications. Keep a Global Admin account credential in the safe in a sealed envelope only to be used when absolutely necessary. Once the seal is broken change the password. Create specific accounts for services use rather than using the Global Admin account with the least privilege required.

Nearly always need to add the drive controller driver to sort this out. What version of Windows is it? I've normally found this more of a problem with HP servers than anything else. Should not need to add the driver for the disk itself.

Jus be wary of scams on either. Personally I stick to eBay for the security yep the fees can be horrendous sometimes.

Tis a bit risky doing a router update remotely. Yep it should be OK but if you knock it out could require a quick dash. But above in mind, have you not got access if you connect to the VPN and maybe access a wired client and access the router from that? You can setup the DrayTeks to allow remote management connections from fixed IPs but I certainly would not open management to the DrayTek from anywhere on the internet. If you have passed through the public IP address to another device you would need to use the IP address that the other device is using for it's gateway if you understand what I mean from that, lol. So say public IP address is passed through the DrayTek to a Smoothwall. The smoothwall will have the DrayTek as a next hop IP address and it is that address which you will likely need to access the DrayTek from. Or previous tech could of setup an additional vlan/IP on DrayTek jus for management.

Handy to have local admin groups setup for one if you have a contractor in who needs to install software jus need to add them to the group. Plus if you have other software that needs admin rights you can isolate to specific areas.

On Sunday I had an automated message about a job opportunity. Basically said press 1 to register the phone number on WhatsApp. Needless to say I did not press 1 but did hang up. Reported number.

100% On the draytek you should be able to pass the public IP address or even subnet through to Internal devices. I have that setup at home, DrayTek passes the public subnet I have with my ISP to the FW and the FW deals with the NAT and so you are not double NAT'ing. The days of me opening any ports are numbered as I use a lot of Cloudflare Zero trust now and that deals with MFA :-) Docker CloudFlare container in DMZ, docker container has additional internal network on the docker host that talks to the service that I host.

Check the server, is print stuck in queue?

Prusa Slicer might be another choice. I've installed OctoPrint on a Pi at home which connects via USB to the 3D printer. Can upload files to the printer as well as timelapse and a whole load of other stuff. Then you only need a USB connection to do updates and even those can sometimes be done via a SD card. I've not had a direct connection from my PC to my Prusa since I purchased it 4 years back.

Personally I'd say to only allow DNS servers to talk to external DNS servers and that is it. Your general user is not going to know what DNS does and will leave it to DHCP.

Syslog would be the obvious choice somehow, what filtering do you use? Any chance it can spit out logs to a syslog server? etc? At a previous org we had a logon script that logged the users logging into to PC/Laptops and put in a central location text file. You could create a folder per PC/Laptop or a folder per day with each PC name. This was over 12 years ago so I can't remember the exact mechanics of how it worked. Then import that data into excel to get the usage however you want to display.

I would not get anything that is not a Synology plus personally. I think the slim version also uses 2.5" disks which may limit you especially if using for backups where storage capacity will be more priority than speed.

Stick ProxMox on them if the VMs are not mission critical and you are going to run a Linux VM i.e. Unifi Controller. And if you have a few servers spare setup a ProxMox cluster. 3 is best for Quorum but the 3rd device could simply be a Raspberry pi with the quorom software installed.

Unless you are using the captive portal part of Unifi I don't think it matters if the VM is only running when you need to make changes. So in that case put it on a VM and forget about it. However if you are using Unifi Protect I think they still need a Unifi NVR? TBH I don't think much of the CK2, I have a CK2 Plus at home and not only did I have the bulging battery issue the PoE failed too. It still works OK with the original disk which is surprising as it is a good few years old but jus powered by a USB cable rather than PoE. Jus backup the VM or at minimum automate config backups and store them elsewhere. 802.1x is still the preferred way for wifi. MPSK not bad but has it's cons, but the same pre-shared key for all devices is jus too risky.

Still using velcro for drives in servers at home, lol.

That is a great idea. I've managed to lose my drive trays for my old HP MicroServer N36L. The only issue being that the sata/power needs to be in a specific location. The server still gets used even though the VGA port is mullered but stuck a pcie x1 graphics card in to leave room for a 10Gb NIC :-) Time to get creative so I can fix that and make some trays :-)

Security should be above convenience when it comes to accessing sensitive services. So before you remove any in place security think of the implications. You only need to look at some high profile cases where access has been compromised even to dev environments containing sensitive production data. These were not hacked by some techno wizkid in many instances but by social engineering or other infiltration, etc.

There are some good legitimate reasons to separate services. Personally I'd always have no 3rd party software on Domain Controllers. And if any 3rd party software needed (really needed) to be installed on a DC I'd consider a building a RODC. Whatever you do use 2FA and don't open RDP directly.

Reminds me of my first job in Edu. We had a request from a 'teacher' (teachers were the only ones that could request websites unblocking on our filter) . Though the site looked a bit suspect and found it was a proxy avoidance site, lol. The teacher turned round and said those cheeky kids. There were numerous issues when whole file structures were renamed to childish names, again only possible under staff logins.

I think you can specify DNS on individual reservations? It's not a bad way of dealing with it (if you need desktops on specified addresses) and a lot easier than dealing with static addresses, lol. MAC addresses can be forged or cloned so not fool proof as security goes :-)

I'd consider a L3 switch for intervlan routing over a firewall (aka router on a stick solution) with 1000 devices. Leave the firewall to deal with the traffic you do not trust as much. My one suggestion would be to use a firewall for Guest WiFi networks and IoT networks, etc. as dealing with firewall rules is a lot easier than ACLs on a switch.