HPlum78

And on that i could code a solution that could cache a few calls and make it so the random long lat dont use those for x amount of time.

@David44 that is a fair point and can be handled in code mind, if its a cloud service then it should all be cloud and if on prem it should be on prem only. But that limits our ability to find natty solutions in some cases.

We should all bag a country/ an identifiable place... I will do Bishop rock, would not like to be one who ends up with an ocean!

How long is it going to take the entire Edugeek community to click on the 57 trillion 3m3 tiles to find and list the funny combinations? If you get the long/ lats we can exclude those in the script...

///clog.bottom.juices from my random clicking on the map

Some people have too much time on their hands @ICTDirect_Dave

Thats perfect just perfect...

My interest was sparked so i did a little digging in to what 3 words and by all accounts there are ~170,000 words in the Oxford English Dictionary by the time they had removed the words that could not be used they where left with ~40,000 words to use for the required 57 trillion unique 3 word combinations! So even if i scraped all of the combinations using a script and we added no other randomisation the task of finding an account and matching it to a what 3 word generated combination is no small task in its self... But mixing it up with other randomisations stops an attack based solely on those 57 trillion combinations.

TBH it would not take much to get all the combinations using powershell and the API. Thats why i say you need to add your own randomisation to the output from what 3 words.

You would hope that they have thought about the combinations and when they put it together you can bet that they had a whole list of banned words.

Have been playing around with using PowerShell and what 3 words for password generation, thought it might be useful to share as some of you may use it. $long = get-random -Minimum -90.00000 -Maximum 90.00000 $lat = get-random -Minimum -180.00000 -Maximum 180.00000 $long = [math]::round($long,5) $lat = [math]::round($lat,5) $Words = Invoke-WebRequest -Method Get "https://api.what3words.com/v3/convert-to-3wa?key=Your_API_KEY_HERE&coordinates=$long, $lat&language=en&format=json" $words = $words | ConvertFrom-Json $words.words | ConvertTo-SecureString -AsPlainText -Force -OutVariable pwd $pwd You will need to register for a free dev account on the What 3 words site (this gives you a 1000 free calls a month) and edit the line $Words = Invoke-WebRequest -Method Get "https://api.what3words.com/v3/convert-to-3wa?key=Your_API_KEY_HERE&coordinates=$long, $long&language=en&format=json" and replace the "Your_API_KEY_HERE" with your actual API key. Clearly there is stuff you can do with the words like change the . to other chars and add a random number to the start/ end and such likes but its a starter for ten.

If you know that you are going to be without DCs for a while there are a few things that you can do to help you and your clients. You should probably move the FSMO roles to the remaining DC and there are a few reg keys that you can use to change the weights of certain aspects of DC priority and such likes. We have a procedure to follow when a DC is going to be out of service for a period of time. I will share the details if it would be useful.

Good work glad you have sorted it, yeah someone needs a tactical boot in the onions!

So NLA errors seem about right for a domain that cannot be authed against. On the DC in the child domain that is not working has the DC actually started servicing the domain? Are there any 4013 events, there may also 2087/ 2088 events (from memory) my initial thoughts are DNS not being initialised, but happy to be wrong.

Yeah I too would go with option 1, minimum change as possible here initially. Once the remaining DC has all the roles and you have cleaned up the meta data look at introducing a new DC on the most recent OS and then get replication working between those (There may well be some intermediate steps involved in getting this working, depending on your current configuration) then migrate the FSMO roles to that new DC and remove the 2008 x DC and rebuild a new one on the same OS. You have learned the hard way round when restoring a DC here, if you have a functional DC then you should try not to restore a bust DC, "'Treat your servers like cattle not pets." to quote Jeffery Snover.

One approach could be to use Jobs, the following may help you get to grips with this initially. https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_remote_jobs?view=powershell-7.1

Is this in one tenant?

Oh and while on picking up a cheap car LR have been having issues with balancer shafts on the Ingenium engines (they have a handle on it now) but you can pick up cars with this issue that have only done 500 miles for virtually no money at all, as long as you are prepared for doing a body off they can be repaired and the latest release (as there has now been a few) do actually fix the issue.

Can you tell me what vehicle you ordered? I know a thing or two about LR, I owen a Defender and Disco @ the min but have owned almost all of them throughout my time.... My guess is that you ordered a Disco Sport?

infantry

Punishment

Life...

Lyme..

Yeah leave the default domain and domain controller policies alone, because if you ever raise an MS prem support call chances are you will be putting those back to their defaults... You can setup the GPO'S as required and use security filtering to limit the scope of the policy. So for instance you probably dont want to have the same WSUS/ update policy applied to every server in your estate so having GPO's configured for Wednesday 02:00/ Wednesday 03:00.... And groups called/ identified the same way you can drop your servers in the appropriate group and the corresponding GPO will be applied. You can also leverage this methodology for testing that the settings applied are going to have the desired results on a limited number of test machines before the BIG BANG go live. Also look at using AGPM to manage your GPO's.

Apologies