miker/Compose-Files
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate

Browse Source
This commit is contained in:
Mike McFetridge
2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Backups/Miker/.trash/256 Color Codes Cheat-Sheet.md
+263
View File
@@ -0,0 +1,263 @@
---------------------------
Colors 0-15 are Xterm system colors.
| Xterm Number | Xterm Name | HEX | RGB | HSL |
| ------------ | ----------------- | --------- | ---------------- | ----------------- |
| 0 | Black (SYSTEM) | `#000000` | rgb(0,0,0) | hsl(0,0%,0%) |
| 1 | Maroon (SYSTEM) | `#800000` | rgb(128,0,0) | hsl(0,100%,25%) |
| 2 | Green (SYSTEM) | `#008000` | rgb(0,128,0) | hsl(120,100%,25%) |
| 3 | Olive (SYSTEM) | `#808000` | rgb(128,128,0) | hsl(60,100%,25%) |
| 4 | Navy (SYSTEM) | `#000080` | rgb(0,0,128) | hsl(240,100%,25%) |
| 5 | Purple (SYSTEM) | `#800080` | rgb(128,0,128) | hsl(300,100%,25%) |
| 6 | Teal (SYSTEM) | `#008080` | rgb(0,128,128) | hsl(180,100%,25%) |
| 7 | Silver (SYSTEM) | `#c0c0c0` | rgb(192,192,192) | hsl(0,0%,75%) |
| 8 | Grey (SYSTEM) | `#808080` | rgb(128,128,128) | hsl(0,0%,50%) |
| 9 | Red (SYSTEM) | `#ff0000` | rgb(255,0,0) | hsl(0,100%,50%) |
| 10 | Lime (SYSTEM) | `#00ff00` | rgb(0,255,0) | hsl(120,100%,50%) |
| 11 | Yellow (SYSTEM) | `#ffff00` | rgb(255,255,0) | hsl(60,100%,50%) |
| 12 | Blue (SYSTEM) | `#0000ff` | rgb(0,0,255) | hsl(240,100%,50%) |
| 13 | Fuchsia (SYSTEM) | `#ff00ff` | rgb(255,0,255) | hsl(300,100%,50%) |
| 14 | Aqua (SYSTEM) | `#00ffff` | rgb(0,255,255) | hsl(180,100%,50%) |
| 15 | White (SYSTEM) | `#ffffff` | rgb(255,255,255) | hsl(0,0%,100%) |
| 16 | Grey0 | `#000000` | rgb(0,0,0) | hsl(0,0%,0%) |
| 17 | NavyBlue | `#00005f` | rgb(0,0,95) | hsl(240,100%,18%) |
| 18 | DarkBlue | `#000087` | rgb(0,0,135) | hsl(240,100%,26%) |
| 19 | Blue3 | `#0000af` | rgb(0,0,175) | hsl(240,100%,34%) |
| 20 | Blue3 | `#0000d7` | rgb(0,0,215) | hsl(240,100%,42%) |
| 21 | Blue1 | `#0000ff` | rgb(0,0,255) | hsl(240,100%,50%) |
| 22 | DarkGreen | `#005f00` | rgb(0,95,0) | hsl(120,100%,18%) |
| 23 | DeepSkyBlue4 | `#005f5f` | rgb(0,95,95) | hsl(180,100%,18%) |
| 24 | DeepSkyBlue4 | `#005f87` | rgb(0,95,135) | hsl(97,100%,26%) |
| 25 | DeepSkyBlue4 | `#005faf` | rgb(0,95,175) | hsl(07,100%,34%) |
| 26 | DodgerBlue3 | `#005fd7` | rgb(0,95,215) | hsl(13,100%,42%) |
| 27 | DodgerBlue2 | `#005fff` | rgb(0,95,255) | hsl(17,100%,50%) |
| 28 | Green4 | `#008700` | rgb(0,135,0) | hsl(120,100%,26%) |
| 29 | SpringGreen4 | `#00875f` | rgb(0,135,95) | hsl(62,100%,26%) |
| 30 | Turquoise4 | `#008787` | rgb(0,135,135) | hsl(180,100%,26%) |
| 31 | DeepSkyBlue3 | `#0087af` | rgb(0,135,175) | hsl(93,100%,34%) |
| 32 | DeepSkyBlue3 | `#0087d7` | rgb(0,135,215) | hsl(02,100%,42%) |
| 33 | DodgerBlue1 | `#0087ff` | rgb(0,135,255) | hsl(08,100%,50%) |
| 34 | Green3 | `#00af00` | rgb(0,175,0) | hsl(120,100%,34%) |
| 35 | SpringGreen3 | `#00af5f` | rgb(0,175,95) | hsl(52,100%,34%) |
| 36 | DarkCyan | `#00af87` | rgb(0,175,135) | hsl(66,100%,34%) |
| 37 | LightSeaGreen | `#00afaf` | rgb(0,175,175) | hsl(180,100%,34%) |
| 38 | DeepSkyBlue2 | `#00afd7` | rgb(0,175,215) | hsl(91,100%,42%) |
| 39 | DeepSkyBlue1 | `#00afff` | rgb(0,175,255) | hsl(98,100%,50%) |
| 40 | Green3 | `#00d700` | rgb(0,215,0) | hsl(120,100%,42%) |
| 41 | SpringGreen3 | `#00d75f` | rgb(0,215,95) | hsl(46,100%,42%) |
| 42 | SpringGreen2 | `#00d787` | rgb(0,215,135) | hsl(57,100%,42%) |
| 43 | Cyan3 | `#00d7af` | rgb(0,215,175) | hsl(68,100%,42%) |
| 44 | DarkTurquoise | `#00d7d7` | rgb(0,215,215) | hsl(180,100%,42%) |
| 45 | Turquoise2 | `#00d7ff` | rgb(0,215,255) | hsl(89,100%,50%) |
| 46 | Green1 | `#00ff00` | rgb(0,255,0) | hsl(120,100%,50%) |
| 47 | SpringGreen2 | `#00ff5f` | rgb(0,255,95) | hsl(42,100%,50%) |
| 48 | SpringGreen1 | `#00ff87` | rgb(0,255,135) | hsl(51,100%,50%) |
| 49 | MediumSpringGreen | `#00ffaf` | rgb(0,255,175) | hsl(61,100%,50%) |
| 50 | Cyan2 | `#00ffd7` | rgb(0,255,215) | hsl(70,100%,50%) |
| 51 | Cyan1 | `#00ffff` | rgb(0,255,255) | hsl(180,100%,50%) |
| 52 | DarkRed | `#5f0000` | rgb(95,0,0) | hsl(0,100%,18%) |
| 53 | DeepPink4 | `#5f005f` | rgb(95,0,95) | hsl(300,100%,18%) |
| 54 | Purple4 | `#5f0087` | rgb(95,0,135) | hsl(82,100%,26%) |
| 55 | Purple4 | `#5f00af` | rgb(95,0,175) | hsl(72,100%,34%) |
| 56 | Purple3 | `#5f00d7` | rgb(95,0,215) | hsl(66,100%,42%) |
| 57 | BlueViolet | `#5f00ff` | rgb(95,0,255) | hsl(62,100%,50%) |
| 58 | Orange4 | `#5f5f00` | rgb(95,95,0) | hsl(60,100%,18%) |
| 59 | Grey37 | `#5f5f5f` | rgb(95,95,95) | hsl(0,0%,37%) |
| 60 | MediumPurple4 | `#5f5f87` | rgb(95,95,135) | hsl(240,17%,45%) |
| 61 | SlateBlue3 | `#5f5faf` | rgb(95,95,175) | hsl(240,33%,52%) |
| 62 | SlateBlue3 | `#5f5fd7` | rgb(95,95,215) | hsl(240,60%,60%) |
| 63 | RoyalBlue1 | `#5f5fff` | rgb(95,95,255) | hsl(240,100%,68%) |
| 64 | Chartreuse4 | `#5f8700` | rgb(95,135,0) | hsl(7,100%,26%) |
| 65 | DarkSeaGreen4 | `#5f875f` | rgb(95,135,95) | hsl(120,17%,45%) |
| 66 | PaleTurquoise4 | `#5f8787` | rgb(95,135,135) | hsl(180,17%,45%) |
| 67 | SteelBlue | `#5f87af` | rgb(95,135,175) | hsl(210,33%,52%) |
| 68 | SteelBlue3 | `#5f87d7` | rgb(95,135,215) | hsl(220,60%,60%) |
| 69 | CornflowerBlue | `#5f87ff` | rgb(95,135,255) | hsl(225,100%,68%) |
| 70 | Chartreuse3 | `#5faf00` | rgb(95,175,0) | hsl(7,100%,34%) |
| 71 | DarkSeaGreen4 | `#5faf5f` | rgb(95,175,95) | hsl(120,33%,52%) |
| 72 | CadetBlue | `#5faf87` | rgb(95,175,135) | hsl(150,33%,52%) |
| 73 | CadetBlue | `#5fafaf` | rgb(95,175,175) | hsl(180,33%,52%) |
| 74 | SkyBlue3 | `#5fafd7` | rgb(95,175,215) | hsl(200,60%,60%) |
| 75 | SteelBlue1 | `#5fafff` | rgb(95,175,255) | hsl(210,100%,68%) |
| 76 | Chartreuse3 | `#5fd700` | rgb(95,215,0) | hsl(3,100%,42%) |
| 77 | PaleGreen3 | `#5fd75f` | rgb(95,215,95) | hsl(120,60%,60%) |
| 78 | SeaGreen3 | `#5fd787` | rgb(95,215,135) | hsl(140,60%,60%) |
| 79 | Aquamarine3 | `#5fd7af` | rgb(95,215,175) | hsl(160,60%,60%) |
| 80 | MediumTurquoise | `#5fd7d7` | rgb(95,215,215) | hsl(180,60%,60%) |
| 81 | SteelBlue1 | `#5fd7ff` | rgb(95,215,255) | hsl(195,100%,68%) |
| 82 | Chartreuse2 | `#5fff00` | rgb(95,255,0) | hsl(7,100%,50%) |
| 83 | SeaGreen2 | `#5fff5f` | rgb(95,255,95) | hsl(120,100%,68%) |
| 84 | SeaGreen1 | `#5fff87` | rgb(95,255,135) | hsl(135,100%,68%) |
| 85 | SeaGreen1 | `#5fffaf` | rgb(95,255,175) | hsl(150,100%,68%) |
| 86 | Aquamarine1 | `#5fffd7` | rgb(95,255,215) | hsl(165,100%,68%) |
| 87 | DarkSlateGray2 | `#5fffff` | rgb(95,255,255) | hsl(180,100%,68%) |
| 88 | DarkRed | `#870000` | rgb(135,0,0) | hsl(0,100%,26%) |
| 89 | DeepPink4 | `#87005f` | rgb(135,0,95) | hsl(17,100%,26%) |
| 90 | DarkMagenta | `#870087` | rgb(135,0,135) | hsl(300,100%,26%) |
| 91 | DarkMagenta | `#8700af` | rgb(135,0,175) | hsl(86,100%,34%) |
| 92 | DarkViolet | `#8700d7` | rgb(135,0,215) | hsl(77,100%,42%) |
| 93 | Purple | `#8700ff` | rgb(135,0,255) | hsl(71,100%,50%) |
| 94 | Orange4 | `#875f00` | rgb(135,95,0) | hsl(2,100%,26%) |
| 95 | LightPink4 | `#875f5f` | rgb(135,95,95) | hsl(0,17%,45%) |
| 96 | Plum4 | `#875f87` | rgb(135,95,135) | hsl(300,17%,45%) |
| 97 | MediumPurple3 | `#875faf` | rgb(135,95,175) | hsl(270,33%,52%) |
| 98 | MediumPurple3 | `#875fd7` | rgb(135,95,215) | hsl(260,60%,60%) |
| 99 | SlateBlue1 | `#875fff` | rgb(135,95,255) | hsl(255,100%,68%) |
| 100 | Yellow4 | `#878700` | rgb(135,135,0) | hsl(60,100%,26%) |
| 101 | Wheat4 | `#87875f` | rgb(135,135,95) | hsl(60,17%,45%) |
| 102 | Grey53 | `#878787` | rgb(135,135,135) | hsl(0,0%,52%) |
| 103 | LightSlateGrey | `#8787af` | rgb(135,135,175) | hsl(240,20%,60%) |
| 104 | MediumPurple | `#8787d7` | rgb(135,135,215) | hsl(240,50%,68%) |
| 105 | LightSlateBlue | `#8787ff` | rgb(135,135,255) | hsl(240,100%,76%) |
| 106 | Yellow4 | `#87af00` | rgb(135,175,0) | hsl(3,100%,34%) |
| 107 | DarkOliveGreen3 | `#87af5f` | rgb(135,175,95) | hsl(90,33%,52%) |
| 108 | DarkSeaGreen | `#87af87` | rgb(135,175,135) | hsl(120,20%,60%) |
| 109 | LightSkyBlue3 | `#87afaf` | rgb(135,175,175) | hsl(180,20%,60%) |
| 110 | LightSkyBlue3 | `#87afd7` | rgb(135,175,215) | hsl(210,50%,68%) |
| 111 | SkyBlue2 | `#87afff` | rgb(135,175,255) | hsl(220,100%,76%) |
| 112 | Chartreuse2 | `#87d700` | rgb(135,215,0) | hsl(2,100%,42%) |
| 113 | DarkOliveGreen3 | `#87d75f` | rgb(135,215,95) | hsl(100,60%,60%) |
| 114 | PaleGreen3 | `#87d787` | rgb(135,215,135) | hsl(120,50%,68%) |
| 115 | DarkSeaGreen3 | `#87d7af` | rgb(135,215,175) | hsl(150,50%,68%) |
| 116 | DarkSlateGray3 | `#87d7d7` | rgb(135,215,215) | hsl(180,50%,68%) |
| 117 | SkyBlue1 | `#87d7ff` | rgb(135,215,255) | hsl(200,100%,76%) |
| 118 | Chartreuse1 | `#87ff00` | rgb(135,255,0) | hsl(8,100%,50%) |
| 119 | LightGreen | `#87ff5f` | rgb(135,255,95) | hsl(105,100%,68%) |
| 120 | LightGreen | `#87ff87` | rgb(135,255,135) | hsl(120,100%,76%) |
| 121 | PaleGreen1 | `#87ffaf` | rgb(135,255,175) | hsl(140,100%,76%) |
| 122 | Aquamarine1 | `#87ffd7` | rgb(135,255,215) | hsl(160,100%,76%) |
| 123 | DarkSlateGray1 | `#87ffff` | rgb(135,255,255) | hsl(180,100%,76%) |
| 124 | Red3 | `#af0000` | rgb(175,0,0) | hsl(0,100%,34%) |
| 125 | DeepPink4 | `#af005f` | rgb(175,0,95) | hsl(27,100%,34%) |
| 126 | MediumVioletRed | `#af0087` | rgb(175,0,135) | hsl(13,100%,34%) |
| 127 | Magenta3 | `#af00af` | rgb(175,0,175) | hsl(300,100%,34%) |
| 128 | DarkViolet | `#af00d7` | rgb(175,0,215) | hsl(88,100%,42%) |
| 129 | Purple | `#af00ff` | rgb(175,0,255) | hsl(81,100%,50%) |
| 130 | DarkOrange3 | `#af5f00` | rgb(175,95,0) | hsl(2,100%,34%) |
| 131 | IndianRed | `#af5f5f` | rgb(175,95,95) | hsl(0,33%,52%) |
| 132 | HotPink3 | `#af5f87` | rgb(175,95,135) | hsl(330,33%,52%) |
| 133 | MediumOrchid3 | `#af5faf` | rgb(175,95,175) | hsl(300,33%,52%) |
| 134 | MediumOrchid | `#af5fd7` | rgb(175,95,215) | hsl(280,60%,60%) |
| 135 | MediumPurple2 | `#af5fff` | rgb(175,95,255) | hsl(270,100%,68%) |
| 136 | DarkGoldenrod | `#af8700` | rgb(175,135,0) | hsl(6,100%,34%) |
| 137 | LightSalmon3 | `#af875f` | rgb(175,135,95) | hsl(30,33%,52%) |
| 138 | RosyBrown | `#af8787` | rgb(175,135,135) | hsl(0,20%,60%) |
| 139 | Grey63 | `#af87af` | rgb(175,135,175) | hsl(300,20%,60%) |
| 140 | MediumPurple2 | `#af87d7` | rgb(175,135,215) | hsl(270,50%,68%) |
| 141 | MediumPurple1 | `#af87ff` | rgb(175,135,255) | hsl(260,100%,76%) |
| 142 | Gold3 | `#afaf00` | rgb(175,175,0) | hsl(60,100%,34%) |
| 143 | DarkKhaki | `#afaf5f` | rgb(175,175,95) | hsl(60,33%,52%) |
| 144 | NavajoWhite3 | `#afaf87` | rgb(175,175,135) | hsl(60,20%,60%) |
| 145 | Grey69 | `#afafaf` | rgb(175,175,175) | hsl(0,0%,68%) |
| 146 | LightSteelBlue3 | `#afafd7` | rgb(175,175,215) | hsl(240,33%,76%) |
| 147 | LightSteelBlue | `#afafff` | rgb(175,175,255) | hsl(240,100%,84%) |
| 148 | Yellow3 | `#afd700` | rgb(175,215,0) | hsl(1,100%,42%) |
| 149 | DarkOliveGreen3 | `#afd75f` | rgb(175,215,95) | hsl(80,60%,60%) |
| 150 | DarkSeaGreen3 | `#afd787` | rgb(175,215,135) | hsl(90,50%,68%) |
| 151 | DarkSeaGreen2 | `#afd7af` | rgb(175,215,175) | hsl(120,33%,76%) |
| 152 | LightCyan3 | `#afd7d7` | rgb(175,215,215) | hsl(180,33%,76%) |
| 153 | LightSkyBlue1 | `#afd7ff` | rgb(175,215,255) | hsl(210,100%,84%) |
| 154 | GreenYellow | `#afff00` | rgb(175,255,0) | hsl(8,100%,50%) |
| 155 | DarkOliveGreen2 | `#afff5f` | rgb(175,255,95) | hsl(90,100%,68%) |
| 156 | PaleGreen1 | `#afff87` | rgb(175,255,135) | hsl(100,100%,76%) |
| 157 | DarkSeaGreen2 | `#afffaf` | rgb(175,255,175) | hsl(120,100%,84%) |
| 158 | DarkSeaGreen1 | `#afffd7` | rgb(175,255,215) | hsl(150,100%,84%) |
| 159 | PaleTurquoise1 | `#afffff` | rgb(175,255,255) | hsl(180,100%,84%) |
| 160 | Red3 | `#d70000` | rgb(215,0,0) | hsl(0,100%,42%) |
| 161 | DeepPink3 | `#d7005f` | rgb(215,0,95) | hsl(33,100%,42%) |
| 162 | DeepPink3 | `#d70087` | rgb(215,0,135) | hsl(22,100%,42%) |
| 163 | Magenta3 | `#d700af` | rgb(215,0,175) | hsl(11,100%,42%) |
| 164 | Magenta3 | `#d700d7` | rgb(215,0,215) | hsl(300,100%,42%) |
| 165 | Magenta2 | `#d700ff` | rgb(215,0,255) | hsl(90,100%,50%) |
| 166 | DarkOrange3 | `#d75f00` | rgb(215,95,0) | hsl(6,100%,42%) |
| 167 | IndianRed | `#d75f5f` | rgb(215,95,95) | hsl(0,60%,60%) |
| 168 | HotPink3 | `#d75f87` | rgb(215,95,135) | hsl(340,60%,60%) |
| 169 | HotPink2 | `#d75faf` | rgb(215,95,175) | hsl(320,60%,60%) |
| 170 | Orchid | `#d75fd7` | rgb(215,95,215) | hsl(300,60%,60%) |
| 171 | MediumOrchid1 | `#d75fff` | rgb(215,95,255) | hsl(285,100%,68%) |
| 172 | Orange3 | `#d78700` | rgb(215,135,0) | hsl(7,100%,42%) |
| 173 | LightSalmon3 | `#d7875f` | rgb(215,135,95) | hsl(20,60%,60%) |
| 174 | LightPink3 | `#d78787` | rgb(215,135,135) | hsl(0,50%,68%) |
| 175 | Pink3 | `#d787af` | rgb(215,135,175) | hsl(330,50%,68%) |
| 176 | Plum3 | `#d787d7` | rgb(215,135,215) | hsl(300,50%,68%) |
| 177 | Violet | `#d787ff` | rgb(215,135,255) | hsl(280,100%,76%) |
| 178 | Gold3 | `#d7af00` | rgb(215,175,0) | hsl(8,100%,42%) |
| 179 | LightGoldenrod3 | `#d7af5f` | rgb(215,175,95) | hsl(40,60%,60%) |
| 180 | Tan | `#d7af87` | rgb(215,175,135) | hsl(30,50%,68%) |
| 181 | MistyRose3 | `#d7afaf` | rgb(215,175,175) | hsl(0,33%,76%) |
| 182 | Thistle3 | `#d7afd7` | rgb(215,175,215) | hsl(300,33%,76%) |
| 183 | Plum2 | `#d7afff` | rgb(215,175,255) | hsl(270,100%,84%) |
| 184 | Yellow3 | `#d7d700` | rgb(215,215,0) | hsl(60,100%,42%) |
| 185 | Khaki3 | `#d7d75f` | rgb(215,215,95) | hsl(60,60%,60%) |
| 186 | LightGoldenrod2 | `#d7d787` | rgb(215,215,135) | hsl(60,50%,68%) |
| 187 | LightYellow3 | `#d7d7af` | rgb(215,215,175) | hsl(60,33%,76%) |
| 188 | Grey84 | `#d7d7d7` | rgb(215,215,215) | hsl(0,0%,84%) |
| 189 | LightSteelBlue1 | `#d7d7ff` | rgb(215,215,255) | hsl(240,100%,92%) |
| 190 | Yellow2 | `#d7ff00` | rgb(215,255,0) | hsl(9,100%,50%) |
| 191 | DarkOliveGreen1 | `#d7ff5f` | rgb(215,255,95) | hsl(75,100%,68%) |
| 192 | DarkOliveGreen1 | `#d7ff87` | rgb(215,255,135) | hsl(80,100%,76%) |
| 193 | DarkSeaGreen1 | `#d7ffaf` | rgb(215,255,175) | hsl(90,100%,84%) |
| 194 | Honeydew2 | `#d7ffd7` | rgb(215,255,215) | hsl(120,100%,92%) |
| 195 | LightCyan1 | `#d7ffff` | rgb(215,255,255) | hsl(180,100%,92%) |
| 196 | Red1 | `#ff0000` | rgb(255,0,0) | hsl(0,100%,50%) |
| 197 | DeepPink2 | `#ff005f` | rgb(255,0,95) | hsl(37,100%,50%) |
| 198 | DeepPink1 | `#ff0087` | rgb(255,0,135) | hsl(28,100%,50%) |
| 199 | DeepPink1 | `#ff00af` | rgb(255,0,175) | hsl(18,100%,50%) |
| 200 | Magenta2 | `#ff00d7` | rgb(255,0,215) | hsl(09,100%,50%) |
| 201 | Magenta1 | `#ff00ff` | rgb(255,0,255) | hsl(300,100%,50%) |
| 202 | OrangeRed1 | `#ff5f00` | rgb(255,95,0) | hsl(2,100%,50%) |
| 203 | IndianRed1 | `#ff5f5f` | rgb(255,95,95) | hsl(0,100%,68%) |
| 204 | IndianRed1 | `#ff5f87` | rgb(255,95,135) | hsl(345,100%,68%) |
| 205 | HotPink | `#ff5faf` | rgb(255,95,175) | hsl(330,100%,68%) |
| 206 | HotPink | `#ff5fd7` | rgb(255,95,215) | hsl(315,100%,68%) |
| 207 | MediumOrchid1 | `#ff5fff` | rgb(255,95,255) | hsl(300,100%,68%) |
| 208 | DarkOrange | `#ff8700` | rgb(255,135,0) | hsl(1,100%,50%) |
| 209 | Salmon1 | `#ff875f` | rgb(255,135,95) | hsl(15,100%,68%) |
| 210 | LightCoral | `#ff8787` | rgb(255,135,135) | hsl(0,100%,76%) |
| 211 | PaleVioletRed1 | `#ff87af` | rgb(255,135,175) | hsl(340,100%,76%) |
| 212 | Orchid2 | `#ff87d7` | rgb(255,135,215) | hsl(320,100%,76%) |
| 213 | Orchid1 | `#ff87ff` | rgb(255,135,255) | hsl(300,100%,76%) |
| 214 | Orange1 | `#ffaf00` | rgb(255,175,0) | hsl(1,100%,50%) |
| 215 | SandyBrown | `#ffaf5f` | rgb(255,175,95) | hsl(30,100%,68%) |
| 216 | LightSalmon1 | `#ffaf87` | rgb(255,175,135) | hsl(20,100%,76%) |
| 217 | LightPink1 | `#ffafaf` | rgb(255,175,175) | hsl(0,100%,84%) |
| 218 | Pink1 | `#ffafd7` | rgb(255,175,215) | hsl(330,100%,84%) |
| 219 | Plum1 | `#ffafff` | rgb(255,175,255) | hsl(300,100%,84%) |
| 220 | Gold1 | `#ffd700` | rgb(255,215,0) | hsl(0,100%,50%) |
| 221 | LightGoldenrod2 | `#ffd75f` | rgb(255,215,95) | hsl(45,100%,68%) |
| 222 | LightGoldenrod2 | `#ffd787` | rgb(255,215,135) | hsl(40,100%,76%) |
| 223 | NavajoWhite1 | `#ffd7af` | rgb(255,215,175) | hsl(30,100%,84%) |
| 224 | MistyRose1 | `#ffd7d7` | rgb(255,215,215) | hsl(0,100%,92%) |
| 225 | Thistle1 | `#ffd7ff` | rgb(255,215,255) | hsl(300,100%,92%) |
| 226 | Yellow1 | `#ffff00` | rgb(255,255,0) | hsl(60,100%,50%) |
| 227 | LightGoldenrod1 | `#ffff5f` | rgb(255,255,95) | hsl(60,100%,68%) |
| 228 | Khaki1 | `#ffff87` | rgb(255,255,135) | hsl(60,100%,76%) |
| 229 | Wheat1 | `#ffffaf` | rgb(255,255,175) | hsl(60,100%,84%) |
| 230 | Cornsilk1 | `#ffffd7` | rgb(255,255,215) | hsl(60,100%,92%) |
| 231 | Grey100 | `#ffffff` | rgb(255,255,255) | hsl(0,0%,100%) |
| 232 | Grey3 | `#080808` | rgb(8,8,8) | hsl(0,0%,3%) |
| 233 | Grey7 | `#121212` | rgb(18,18,18) | hsl(0,0%,7%) |
| 234 | Grey11 | `#1c1c1c` | rgb(28,28,28) | hsl(0,0%,10%) |
| 235 | Grey15 | `#262626` | rgb(38,38,38) | hsl(0,0%,14%) |
| 236 | Grey19 | `#303030` | rgb(48,48,48) | hsl(0,0%,18%) |
| 237 | Grey23 | `#3a3a3a` | rgb(58,58,58) | hsl(0,0%,22%) |
| 238 | Grey27 | `#444444` | rgb(68,68,68) | hsl(0,0%,26%) |
| 239 | Grey30 | `#4e4e4e` | rgb(78,78,78) | hsl(0,0%,30%) |
| 240 | Grey35 | `#585858` | rgb(88,88,88) | hsl(0,0%,34%) |
| 241 | Grey39 | `#626262` | rgb(98,98,98) | hsl(0,0%,37%) |
| 242 | Grey42 | `#6c6c6c` | rgb(108,108,108) | hsl(0,0%,40%) |
| 243 | Grey46 | `#767676` | rgb(118,118,118) | hsl(0,0%,46%) |
| 244 | Grey50 | `#808080` | rgb(128,128,128) | hsl(0,0%,50%) |
| 245 | Grey54 | `#8a8a8a` | rgb(138,138,138) | hsl(0,0%,54%) |
| 246 | Grey58 | `#949494` | rgb(148,148,148) | hsl(0,0%,58%) |
| 247 | Grey62 | `#9e9e9e` | rgb(158,158,158) | hsl(0,0%,61%) |
| 248 | Grey66 | `#a8a8a8` | rgb(168,168,168) | hsl(0,0%,65%) |
| 249 | Grey70 | `#b2b2b2` | rgb(178,178,178) | hsl(0,0%,69%) |
| 250 | Grey74 | `#bcbcbc` | rgb(188,188,188) | hsl(0,0%,73%) |
| 251 | Grey78 | `#c6c6c6` | rgb(198,198,198) | hsl(0,0%,77%) |
| 252 | Grey82 | `#d0d0d0` | rgb(208,208,208) | hsl(0,0%,81%) |
| 253 | Grey85 | `#dadada` | rgb(218,218,218) | hsl(0,0%,85%) |
| 254 | Grey89 | `#e4e4e4` | rgb(228,228,228) | hsl(0,0%,89%) |
| 255 | Grey93 | `#eeeeee` | rgb(238,238,238) | hsl(0,0%,93%) |
Backups/Miker/.trash/AD-REORG create new AD site OUs 2.md
+4
View File
@@ -0,0 +1,4 @@
**Requirements:** The CBPAD PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPAD folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
You will need to have a copy of the same module on a domain controller as well to delete the OUs. Then the module will need to be copied to your -0 profile but the same location as above.
The CBPADREORG PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPADREORG folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
Backups/Miker/.trash/AD-REORG create new AD site OUs.md
+4
View File
@@ -0,0 +1,4 @@
**Requirements:** The CBPAD PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPAD folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
You will need to have a copy of the same module on a domain controller as well to delete the OUs. Then the module will need to be copied to your -0 profile but the same location as above.
The CBPADREORG PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPADREORG folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
Backups/Miker/.trash/AD-Reorg removing old legacy site OUs 2.md
+41
View File
@@ -0,0 +1,41 @@
**Requirements:** The CBPAD PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPAD folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
You will need to have a copy of the same module on a domain controller as well to delete the OUs. Then the module will need to be copied to your -0 profile but the same location as above.
**How To:**
**Do the following on your jump server**
1. **Get the list of site codes that have already been migrated.**
1. You will need the distinguished name (DN) of the new area OU that the sites have been migrated to.
2. Open a elevated PowerShell console on your jump server and import the CBPAD module
3. Then run "get-cbptransitionedsites -dn \<DN\>
1. Ex: get-cbptransitionedsites -dn "OU=NorthCalPacific,OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov"
2. ![Exported image](Exported%20image%2020250808201943-0.png)
4. This will create a text file name "Transitioned-site-codes.txt" located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory). This will be the default text file that will be used for the rest of this procedure.
2. **Remove all legacy site admin security groups.**
1. From the same elevated Powershell console you can run "remove-siteadmingroups". This will use the text file created to remove all legacy site admin groups from the old site OUs.
1. ![Exported image](Exported%20image%2020250808201943-1.png)
2. If there were any errors it will tell you an "error log" was created and open the error log.
1. ![Exported image](Exported%20image%2020250808201944-2.png)
2. Typically the errors would be that the "\<site OU\> admin" doesn't exist and that it can be ignored. However you may want to review the log to make sure there isn't anything else out of the ordinary.
3. **Run a report to see if any objects are left in the legacy site OUs that need to be moved before the site OU is deleted.**
1. From the same elevated Powershell console you can run "find-cbpemptyous".
1. ![Exported image](Exported%20image%2020250808201945-3.png)
2. This will create a CSV file "transitioned-sites-ad-object-count-\<date\>.csv" located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory\Logs).
3. Open the CSV file and do a filter on Column B which is the "ObjectCount" Column. If there is anything but a 0 or a blank filter for those numbers.
1. ![Exported image](Exported%20image%2020250808201945-4.png)
4. Then find out what objects are there and where to move them to. Then move them.
5. After you move them you can repeat this process again to see if any objects are still there. Repeat this process until you are satisfied that all objects have been moved and you can safely delete the site OUs.
4. **Delete legacy site OUs.**
1. Copy the ""Transitioned-site-codes.txt" from [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory) to the C:\files directory on the domain controller.
2. This will need to be done with your -0 account from a domain controller.
3. Log on to a DC and open an elevated PowerShell console and import module CBPAD.
4. Run "Remove-legacysiteous".
Backups/Miker/.trash/AD-Reorg removing old legacy site OUs.md
+41
View File
@@ -0,0 +1,41 @@
**Requirements:** The CBPAD PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPAD folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
You will need to have a copy of the same module on a domain controller as well to delete the OUs. Then the module will need to be copied to your -0 profile but the same location as above.
**How To:**
**Do the following on your jump server**
1. **Get the list of site codes that have already been migrated.**
1. You will need the distinguished name (DN) of the new area OU that the sites have been migrated to.
2. Open a elevated PowerShell console on your jump server and import the CBPAD module
3. Then run "get-cbptransitionedsites -dn \<DN\>
1. Ex: get-cbptransitionedsites -dn "OU=NorthCalPacific,OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov"
2. ![Exported image](Exported%20image%2020250808202015-0.png)
4. This will create a text file name "Transitioned-site-codes.txt" located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory). This will be the default text file that will be used for the rest of this procedure.
2. **Remove all legacy site admin security groups.**
1. From the same elevated Powershell console you can run "remove-siteadmingroups". This will use the text file created to remove all legacy site admin groups from the old site OUs.
1. ![Exported image](Exported%20image%2020250808202016-1.png)
2. If there were any errors it will tell you an "error log" was created and open the error log.
1. ![Exported image](Exported%20image%2020250808202019-2.png)
2. Typically the errors would be that the "\<site OU\> admin" doesn't exist and that it can be ignored. However you may want to review the log to make sure there isn't anything else out of the ordinary.
3. **Run a report to see if any objects are left in the legacy site OUs that need to be moved before the site OU is deleted.**
1. From the same elevated Powershell console you can run "find-cbpemptyous".
1. ![Exported image](Exported%20image%2020250808202020-3.png)
2. This will create a CSV file "transitioned-sites-ad-object-count-\<date\>.csv" located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory\Logs).
3. Open the CSV file and do a filter on Column B which is the "ObjectCount" Column. If there is anything but a 0 or a blank filter for those numbers.
1. ![Exported image](Exported%20image%2020250808202021-4.png)
4. Then find out what objects are there and where to move them to. Then move them.
5. After you move them you can repeat this process again to see if any objects are still there. Repeat this process until you are satisfied that all objects have been moved and you can safely delete the site OUs.
4. **Delete legacy site OUs.**
1. Copy the ""Transitioned-site-codes.txt" from [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory) to the C:\files directory on the domain controller.
2. This will need to be done with your -0 account from a domain controller.
3. Log on to a DC and open an elevated PowerShell console and import module CBPAD.
4. Run "Remove-legacysiteous".
Backups/Miker/.trash/APPLICATION_INSTALLATION_NOTES_BEST_PRACTICES_INDEX.md
+33
View File
@@ -0,0 +1,33 @@
# 🧩 Application Installation & Service Blueprints Index (Best Practices)
**Purpose:** This document serves as the mandatory, centralized quality gate reference for all standalone service guides within this directory cluster. It captures standardized best practices necessary for deploying any piece of infrastructure documented here (e.g., Monitoring Systems, Identity Providers, Networking Clients).
## 🌟 Golden Rules for "Application Install Notes"
All operational deployment steps must adhere to the following architectural mandates:
### 1. Deployment Methodology Mandate
Any system that requires state management or service orchestration **MUST** be designed using a declarative approach:
* **Mandatory Preference:** Use Kubernetes YAML manifests, dedicated Docker Compose files (`version: '3.8'`), or established Infrastructure-as-Code (IaC) tools (Terraform/Ansible).
* **Deprecated Method:** Manual setup scripts are only acceptable for one-time, non-persistent configuration steps (e.g., initial key generation, client registration). If the step is repeatable, it must be containerized or scripted in Ansible.
### 2. Security and Identity Management (IAM)
This category *always* requires heightened scrutiny:
* **Secret Handling:** Credentials (passwords, API keys) must be injected at runtime from a Secret Manager (Vault, KMS), never stored directly in configuration files (`README`, `.env`).
* **Authentication Flow:** Always prioritize the implementation of **Multi-Factor Authentication (MFA)** and secure protocols like OAuth2/OIDC. Simple username/password authentication is only acceptable for non-critical, local administrative backends.
### 3. Networking & Connectivity Services
For VPNs, DNS management (Pi-hole), or network proxies:
* **Service Segmentation:** Utilize strong Docker networking (custom networks) to isolate services that handle sensitive traffic from those that are public-facing.
* **TLS Enforcement:** A dedicated Reverse Proxy must terminate all external TLS connections and manage certificate lifecycle for *every* service exposed over the internet.
## 🛠️ Service Blueprints Status Key
*(Review this section before creating any new configuration)*
| Blueprint Type | Current Best Practice Focus | Primary Toolchain | High-Risk Area Warning |
| :--- | :--- | :--- | :--- |
| **Identity (Auth)** | Centralized IdP via OAuth2, Conditional Access. | Authentik / Keycloak / AD Federation | Failure to enforce MFA and use external IDPs. |
| **Monitoring/Logging** | Observability through dedicated agents communicating logs via robust queueing systems. | Prometheus/Grafana stack; Watchtower (for updates). | Relying on ad-hoc log scraping instead of structured logging (JSON). |
| **Storage Sync** | Versioning, Encryption at rest and in transit, Audit trails are mandatory. | rclone / Dedicate cloud provider syncing. | Failure to implement pre/post-sync validation checks. |
> [!NOTE] Future Improvement: Automation Integration
The next major effort for this directory should be to build a dedicated CI/CD pipeline that automatically tests and validates the deployment steps outlined in these guides, ensuring that manual updates never compromise the desired state.
Backups/Miker/.trash/APT - Update and Upgrade.md
+27
View File
@@ -0,0 +1,27 @@
```
#!/bin/bash
# Ensure the script is run as root
if [[ $EUID -ne 0 ]]; then
echo "This script must be run as root. Please use sudo."
exit 1
fi
echo "--- Updating package lists ---"
apt update
echo "--- Upgrading installed packages ---"
DEBIAN_FRONTEND=noninteractive apt upgrade -y
echo "--- Performing distribution upgrade (if available) ---"
DEBIAN_FRONTEND=noninteractive apt full-upgrade -y
echo "--- Cleaning up unnecessary packages ---"
apt autoremove -y
echo "--- Cleaning up cached package files ---"
apt clean
echo "--- Linux system update and cleanup complete! ---"
```
Backups/Miker/.trash/ARP in Linux.md
+22
View File
@@ -0,0 +1,22 @@
| Command | Description |
| ----------------------------------------------------------- | ----------------------------------------------------------- |
| `arp` | View the ARP table |
| `arp -a` | View the ARP table |
| `arp -n` | View the ARP table (don't resolve names) |
| `arp -d <ip>` | Delete an entry from the ARP table |
| `arp -s <ip> <mac_address>` | Add an entry to the ARP table |
| `arp -i <interface> -s <ip> <mac_address>` | Add an entry to the ARP table for a specific interface |
| `arp -i <interface> -d <ip>` | Delete an entry from the ARP table for a specific interface |
| `arp -i <interface> -n` | View the ARP table for a specific interface |
| `arp -i <interface> -a` | View the ARP table for a specific interface |
| `ip neigh show` | View the ARP table |
| `ip neigh show <ip>` | View the ARP table for a specific IP address |
| `ip neigh add <ip> lladdr <mac_address> dev <interface>` | Add an entry to the ARP table |
| `ip neigh change <ip> lladdr <mac_address> dev <interface>` | Change an entry in the ARP table |
| `ip neigh del <ip> dev <interface>` | Delete an entry from the ARP table |
| `ip neigh flush dev <interface>` | Flush the ARP table for a specific interface |
| `ip neigh flush all` | Flush the ARP table |
| `ip -s neigh show` | Show ARP statistics |
| `ip -s neigh flush all` | Flush the ARP cache |
Backups/Miker/.trash/AWK Cheat-Sheet.md
+28
View File
@@ -0,0 +1,28 @@
| Command | Description |
| --- | --- |
| `awk '/pattern/ {print $1}'` | standard Unix shells |
| `awk '/pattern/ {print "$1"}'` | compiled with DJGPP, Cygwin |
| `awk "/pattern/ {print \"$1\"}"` | GnuWin32, UnxUtils, Mingw |
| `awk '1;{print ""}'` | double space a file |
| `awk 'BEGIN{ORS="\n\n"};1'` | double space a file |
| `awk 'NF{print $0 "\n"}'` | double space a file which already has blank lines |
| `awk '1;{print "\n"}'` | triple space a file |
| `awk '{print FNR "\t" $0}' files*` | precede each line by its line number |
| `awk '{print NR "\t" $0}' files*` | precede each line by its line number for all files together |
| `awk '{printf("%5d : %s\n", NR,$0)}'` | number each line of a file |
| `awk 'NF{$0=++a " :" $0};1'` | number each line of a file, but only print numbers if line is not blank |
| `awk 'END{print NR}'` | count lines (emulates "wc -l") |
| `awk '{s=0; for (i=1; i<=NF; i++) s=s+$i; print s}'` | print the sums of the fields of every line |
| `awk '{for (i=1; i<=NF; i++) s=s+$i}; END{print s}'` | add all fields in all lines and print the sum |
| `awk '{for (i=1; i<=NF; i++) if ($i < 0) $i = -$i; print }'` | print every line after replacing each field with its absolute value |
| `awk '{for (i=1; i<=NF; i++) $i = ($i < 0) ? -$i : $i; print }'` | print every line after replacing each field with its absolute value |
| `awk '{ total = total + NF }; END {print total}' file` | print the total number of fields ("words") in all lines |
| `awk '/Beth/{n++}; END {print n+0}' file` | print the total number of lines that contain "Beth" |
| `awk '$1 > max {max=$1; maxline=$0}; END{ print max, maxline}'` | print the largest first field and the line that contains it |
| `awk '{ print NF ":" $0 }'` | print the number of fields in each line, followed by the line |
| `awk '{ print $NF }'` | print the last field of each line |
| `awk '{ field = $NF }; END{ print field }'` | print the last field of the last line |
| `awk 'NF > 4'` | print every line with more than 4 fields |
| `awk '$NF > 4'` | print every line where the value of the last field is > 4 |
Backups/Miker/.trash/Add static IP address.md
+18
View File
@@ -0,0 +1,18 @@
Open the conf file under netplan directory
Sample config
network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
      - 192.168.0.200/24
      routes:
          - to: default
            via: 192.168.0.1
      nameservers:
        addresses:
         - 192.168.0.200
         - 9.9.9.9
         search: \[home.mikemcfetridge.com\]
Backups/Miker/.trash/Ansible - Install and Make a Playbook.md
+301
View File
@@ -0,0 +1,301 @@
With our continuing efforts in building an MSP on open source it's important to realize we will need tools to help us automate many of the day to day operations we'll be performing for our clients as well as on our own systems. This brings us to Ansible.
Ansible is an incredibly powerful and robust tool made specifically for automating workflows and actions. It works on Linux, MacOS, and Windows, and can help reduce your task load by thousands, or even tens of thousands of individual actions. We will be rolling out Ansible during our series on building an MSP as a tool to help us deal with a growing business where we are supporting our clients and their multitudes of devices. We will employ Ansible's power to push out updates, agents for the various software services we'll employ, and so much more.
This is just an introduction to ansible, and will get you started with it, but it is highly recommended that you also check out other series on ansible. I'll link to one below that will take you a bit deeper. You should, of course start getting comfortable with the ansible documentation. This is one of the most well documented tools in the open source world. The answers are there for you, just waiting to be read and put to use.
### What You'll Need
* A machine to use as an Ansible controller (the server that you run Ansible commands from).
* An SSH Public / Private key pair
* SSH Access to any target machine (client machine)
* About thirty minutes of your time
### SSH Key Pair Setup
For this series, I'll be installing Ansible itself on a Ubuntu 22.04 LTS Incus (LXD) container. This is a dedicated virtual machine I'm creating for the sole purpose of running Ansible. You can do the same, or use your main laptop or desktop machine. Keep in mind, that as we grow our use of Ansible, we will want to start scheduling certain tasks to run, so we'll want a machine that is always on and ready.
To setup an SSH key pair, we can run the following command:
`ssh-keygen -t ed25519 -C "ansible"`
The command above tells ssh to generate a key pair using the ed25519 encryption. This encryption is similar in strength to RSA 256, but is a much shorter key, and uses less computer power to generate.
When you submit the command, you'll be prompted on where to store the command, and what to call it. This is up to you, but I highly recommend, you keep the key pair in
`/home/<your user>/.ssh/`
as this is where OpenSSH looks for the keys automatically. As for the name, name it something that makes sense for it's purpose. In my case I will name it 'ansible'. So my entier path and name will look like
`/home/<your user>/.ssh/ansible`
Next, you'll be prompted for a passphrase for this key. We want to leave this blank so that we won't be prompted each time for our passphrase as ansible goes to login to the machines it's taking action on.
Just press Enter to keep the passphrase blank. Next, confirm that you want it blank (empy) by simply pressing Enter again.
SSH will now generate a secure public and private key pair for you. If you do an `ls` on this folder ( /home/<your user>/.ssh ) you'll see that two new files haave been added. They'll be called `ansible` and `ansible.pub`. The file ending in .pub is your public key file and can be shared out to all of the machines you want to access with ansible. the other file is your private key file and should never be shared with anyone, nor sent to public machines. The `ansible` file is your key to access any host with the `ansible.pub` file on it.
### Send Our New Key to Target Machines
In order for ansible to run, we need to share our new key to target machines. We can do this wil the command
`ssh-copy-id`
This command allows us to specify which key to share, and to which host and for which user we share it.
I'll be adding 3 hosts to start, but it's not required. You can do just one if you prefer. My hosts will have the IPs
192.168.10.20, 192.168.10.21, and 192.168.10.22
Don't worry, your hosts don't have to have consecutive IP addresses.
Let's copy and SSH key over to the first host machine.
`ssh-copy-id -i /home/brian/.ssh/ansible` [`brian@192.168.10.20`](mailto:brian@192.168.10.20)
`-i` tells ssh that we are going to specify the file to send. We then tell it the path and key to send. You may notice I just put 'ansible' and not 'ansible.pub'. This is ok, as the `ssh-copy-id` command knows to send the public key, not the private key.
We press enter, then will be prompted for our password to access this machine via SSH. Enter the password, and you should get a message confirming that 1 key has been copied.
You can not attempt to access the machine using the new key with the ssh command as follows:
`ssh -i /home/brian/.ssh/ansible <a href="mailto:brian@192.168.10.20">brian@192.168.10.20</a>`
You should be logged onto the machine without being prompted for any password.
You have now copied your ssh key to another machine. Repeat the above process for however many machines you want to have ansible accessing.
### Install Ansible
Ansible is already packaged in most distribution repositories, but the Ubuntu 22.04 version lags behind a bit, so let's make sure we get the latest version possible. To do this, we'll add the ansible ppa repository instead.
`sudo add-apt-repository ppa:ansible/ansible`
When you submit the above command, you'll be prompted to press Enter, so press Enter, then you should see your system attempt to update the package cache. Let's runt he update one more time just to be sure.
`sudo apt update -y`
Now we can install the latest version of ansible with
`sudo apt install ansible -y`
### Creating an Ansible Inventory
Ansible uses an inventory file to know what machines you want it to access and perform actions on. This file can be yaml or plain text. We'll be starting with the plain text file for now, as I think it's a little bit easier to grasp initially. Feel free, however, to check out the documentation if you are a yaml expert.
Let's make our new file with
`nano inventory`
Note that Ansible can deal with machines collected into groups, and that a machine can be in more than one group, and that you can even group other groups as well.
We'll start with two groups for our example, but use whatever groups make sense for your needs. The organization for our inventory file will be like the following:
```
[group_name]
machine_alias_1 ansible_host=<machine_ip_1>
machine_alias_2 ansible_host=<machine_ip_2>
[group_name_2]
machine_alias_3 ansible_host=<machine_ip_3>
```
The items in square brackets are the group names we assign, and then below any group name we list the machines that are part of that gorup. We list the machines with an alias name, any name that describes what machine it is. This can be the machine hostname, or just an alias we want for the machine. After the alias, we put a space, then indicate the machines ip or fqdn for ansible to connect to the machine with. We identify it with the key `ansible_host=` then enter the ip or fqdn for the machine. Let's look at an actual example of our inventory file now.
```
[home_server]
dashy ansible_host=192.168.10.20
vaultwarden ansible_host=192.168.10.21
[home_desktops]
brian_studio ansible_host=192.168.10.22
```
Above, you'll see two groups home\_server, and home\_desktops. The home\_server group has two machines in it, and one machine is held under the home\_desktops group.
NOTE: Ansible doesn't allow spaces in group names or aliases, nor hyphens ( - ), so you need to use underscores ( \\\_ ) in names where you want to separate words.
We can save our 'inventory' file with CTRL + O, then press Enter to confirm, and exit the nano editor with CTRL + X.
### Create an Ansible Playbook
Playbooks, are pretty much exactly what they sound like. They are the instructions that you want ansible to execute on a target machine, or set of machines. You can target individual machines (by alias), or group(s) of machines, and even the entire inventory if you want.
Playbooks are written in yaml (yes, the space dependent, very picky file format), but it does make plays easier to read, and as you get more accustomed to yaml, easier to update and modify as needed.
While stiill in our ansible\_projects folder, we'll create a new file called update\_ubuntu\_servers.yml.
`nano update_ubuntu_server.yml`
This will hold the plays we need in order to update our servers and desktops that are running Ubuntu as a base operating system.
In the file, we'll start by stating which target machines from our inventory file we want to perform an update on.
```yaml
---
- hosts: all
```
In the above file, we start with three hyphens on the first line to indicate the beginning of our yaml file. below that we tell ansible that we want to run this on all hosts in our inventory file. Now, if you have machines with differing operating systems, you could group them by OS, but there are some smart checks we can do to make sure we don't try to do `apt updte` on an OpenSuse, Redhat, or other non-apt system as well.
To run the updates in apt, we need to be a sudo user. In ansible this uses the 'become' parameter, so let's add that to our file.
```yaml
---
- hosts: all
become: true
```
It's 'become' as in "become super user" or root.
Now that we've got the initial portion set, we can start creating 'tasks' for ansible to perform on these systems. The first task is to update the package cache, and the next task is to run the update on any packages that need it, although we list them in the reverse order in the yaml file.
```
---
- hosts: all
become: true
tasks:
- name: Update packages on Ubuntu systems
become: true
apt:
upgrade: dist
update_cache: yes
```
Given our additions above, we can see that we give the task a name, this helps us know what task is being performed. This can be any string really, so call the task whatever makes sense.
Next, we again tell it this needs to be done as a super user with `become: true`.
And finally, we add the 'apt' module, and give it two actions to complete. `upgrade`, and we define that we want it to do a distribution level upgrade with `upgrade: dist`. Next we tell it that it needs to update the cahce of packages with `update_cache: yes`.
We can save this file and run it as is, and presuming you've setup your target machines properly, it will indeed update the cache of packages, and then run the upgrade procedure.
But, what about kernel updates? This usually includes the need for a reboot as well. I think we should go ahead and include that as part of our instruction set. to do that we just add another `-name` block under our `tasks:` section.
First, let's have Ansible check to see if a reboot is required.
```
---
- hosts: all
become: true
tasks:
- name: Update packages on Ubuntu systems
become: true
apt:
upgrade: dist
update_cache: yes
 
- name: Check if a reboot is needed
become: true
stat:
path: /var/run/reboot-required
register: reboot_required
```
In our next task section, we give it a descriptive name so we'll know what we've asked ansible to do. Then, again, we tell it to do this task as a super user. Next, we call the `stat` module. This can pull status information for us. We tell the 'stat' module to look in `/var/run/reboot-required` with the `path:` line, and finally we save the information in a variable with `register: reboot_required`. The variable name is 'reboot\_required', and the stat command will check to see if that path exists or not.
Now that we know if a reboot is required, let's tell Ansible to perform the reboot if the variable 'reboot\_required' is set to 'true' or 'yes'. To do that, we add another `-name:` section under our `tasks:` in our yaml file.
```
---
- hosts: all
become: true
tasks:
- name: Update packages on Ubuntu systems
become: true
apt:
upgrade: dist
update_cache: yes
- name: Check if a reboot is needed
become: true
stat:
path: /var/run/reboot-required
register: reboot_required
- name: Rebooting Machine After Upgrade
become: true
ansible.builtin.reboot:
reboot_timeout: 120
when: reboot_required.stat.exists
```
Here, we name our task 'Rebooting Machine After Upgrade', then tell Ansible it must be run with super user privileges, and finally call on the built in Ansible module to reboot a machine, `ansible.builtin.reboot`.
Below that we add a short waiting time of 120 seconds (2 minutes). This just gives the upgrade time to fully complete before the reboot. Finally, we tell Ansible to only do this reboot when our 'reboot\_required' variable shows that the `reboot-required` path exists. The `when` in Ansible is a nice easy way to add some logic to a task.
For example, if your friend asked, "Can you feed my dog?" That's pretyy open ended, and you may not want to feed their dog forever. So it's better for your friend to say, "Can you feed my dog _when_ I go on vacation next month?". Now your friend has put a qualifier on when you should feed the dog.
This is the same as in Ansible. We are saying, "when /var/run/reboot-required exists, wait 2 minutes, then reboot the machine." Otherwise no reboot is necessary, so we leave the machine running.
Now we are ready to save our file, and exit the nano editor. We will run this with the `ansible-playbook` command. With the command we want to give Ansible instruction to use our 'ansible' private key, and tell it which host(s) to run the play on. Since we put the 'when' clause in our play, we can, of course just tell it 'all', but later on that may be a bit inefficient.
`ansible-playbook --key-file ~/.ssh/ansible_key -i inventory --ask-become-pass update_ubuntu_server.yml`
When you press Enter, you'll see Ansible ask you for your super user password, this is the password on the remote machines, and if entered incorrectly, will generate a list of failed task attempts. Next, Ansible will ensure it can reach each target machine, then it will begin running through each task in the playbook. At the end you'll get a summary of whether a play succeeded or failed, how many changes were made, how many tasks were skipped, and so on. What we are looking for is no tasks skipped, and no tasks failed.
Once we have that result, we have a play we can now use anytime we want in order to keep all of our servers up to date. We can even set this up to run as a cron job, but we need a secure way to feed Ansible our super user password for the tasks that require super user privileges.
### Avoiding Fails on Different OSes
We can avoid fails that occur from running plays on machines or operating systems that don't make sense. Such as running apt on a Fedora machine. Again, we can turn to the 'when' operator in Ansible playbooks. The step where Ansible "gathers facts" is an important one, as Ansible grabs a bunch of details about our various machines. We can then use this information to create conditions
`when: ansible_distribution == 'Ubuntu'`
and
`when: ansible_distribution == 'Fedora'`
We can add this to our existing playbook, and add a section to update Fedora as well.
```
---
- hosts: all
become: true
tasks:
- name: Update packages on Ubuntu systems
become: true
apt:
upgrade: dist
update_cache: yes
when: ansible_distribution == 'Ubuntu'
- name: Update packages on Fedora systems
become: true
dnf:
update_only: true
update_cache: true
when: ansible_distribution == 'Fedora'
- name: Check if a reboot is needed
become: true
stat:
path: /var/run/reboot-required
register: reboot_required
- name: Rebooting Machine After Upgrade
become: true
ansible.builtin.reboot:
reboot_timeout: 120
when: reboot_required.stat.exists
```
In the above, we've added a new task named 'Update packages on Fedora systems', and instead of 'apt', we use 'dnf' as this is the package manager for Fedora, CentOS, Red Hat, etc.
Finally, we added a 'when' clause to the Ubuntu update task, and one to the Fedora update task. This clause will ensure that these tasks only attempt to update systems where the distribution matches the package manager we are using.
You're now setup with a great base for using Ansible to get things built out for automated management of systems and packages. We'll be using this in future videos in this series, so dig in, start watching and reading, and get comfortable with Ansible.
Series for learning Ansible that I suggest:
### Support My Channel and Content
**Support my Channel and ongoing efforts through Patreon:**
[patreon.com/awesomeopensource](https://patreon.com/awesomeopensource "Awesome Open Source Patreon Page")
**Buy me a Beer / Coffee:**
[https://paypal.me/BrianMcGonagill](https://paypal.me/BrianMcGonagill)
Backups/Miker/.trash/Ashburn.md
+8
View File
@@ -0,0 +1,8 @@
All, if you plan on going to Ashburn for a meeting or for the day (not on a regular basis), please send an email to OIT PHYSICAL SECURITY [OITPHYSICALSECURITY@cbp.dhs.gov](mailto:OITPHYSICALSECURITY@cbp.dhs.gov) and provide them with the details
- Your full name
- Organization
- Dates for visit
 
Once they process your request, you will be able to park within the gated fence for that day, instead of parking at the metro and taking the shuttle.
Backups/Miker/.trash/Asusctl.md
+107
View File
@@ -0,0 +1,107 @@
https://wiki.archlinux.org/title/Asusctl#RGB/Keyboard_backlight
`asusctl`
is a command-line utility designed for controlling ASUS ROG and TUF laptops on Linux, providing features like RGB keyboard backlight control. 
**Controlling RGB with `asusctl`:**
- **Toggling LED Modes:** You can cycle through the available RGB lighting effects using the commands `asusctl aura -n` for the next mode and `asusctl aura -p` for the previous mode.
- **Setting a Specific Color (Potentially):** One Reddit user mentions using `asusctl rgb -c 4` to set the RGB color to a specific value, suggesting that `asusctl` might support assigning specific colors to RGB lighting.
**STEPS TO INSTALL ASUSCTL ON LINUX MINT 22**
- 1. Download source code zip file from [https://gitlab.com/asus-linux/asusctl/-/releases/6.0.12](https://gitlab.com/asus-linux/asusctl/-/releases/6.0.12)
2. Extract the zip file into the respective folder
3. Go to the unzipped folder
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
cd asusctl-6.0.12
```
4. Update repositories
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
sudo apt update
```
5. Upgrade packages if any
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
sudo apt upgrade
```
6. Install dependencies - can be installed via software manager and/or synaptic package manager
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
sudo apt install gcc pkg-config openssl libasound2-dev cmake build-essential python3 libfreetype6-dev libexpat1-dev libxcb-composite0-dev libssl-dev libx11-dev libfontconfig1-dev curl libclang-dev libudev-dev checkinstall libseat-dev libinput-dev libxkbcommon-dev libgbm-dev
```
7. Install npm - package manager for Node.js - can be installed via software manager or synaptic package manager
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
sudo apt install npm
```
8. Install the npm-run-all CLI tool, which allows you to run multiple npm scripts in sequential order while adding the third-party packages to the package's development dependencies
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
npm i npm-run-all --save-dev
```
9. Now install rust
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
```
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
source "$HOME/.cargo/env"
```
10. Now compile asusctl and install - compiling takes time
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
make
```
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
sudo make install
```
11. Start asusctl daemons or simply reboot
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
systemctl daemon-reload && systemctl restart asusd
```
12. Verify asusd service
Code: [Select all](https://forums.linuxmint.com/viewtopic.php?t=417178#)
```
systemctl status asusd.service
```
Backups/Miker/.trash/Authelia - Setup and Install.md
+459
View File
@@ -0,0 +1,459 @@
Self hosting amazing open source software is the best feeling in the world. Knowing you're not tied to someone else's servers, whims, or quirks. The ability to control how you use your own apps, and how and when you add more is what open source is all about. But what about security?
I self host a lot of apps, and many of them don't have any built-in authentication. While that makes it quite convenient to use them, it also makes me a bit fearful of what others may be able to do with _my_ applications and websites.
This is where Authelia comes in. Authelia provides a web application for authentication (make sure you are somone who should be using an application) and authorization (make sure you're permitted to use it) in front of your existing web applications.
As an example. I run the Homer Dashboard as a great way to link to all of my self hosted web applications. Homer itself does not (yet) have authentication. It just comes up, which is super useful and somewhat ideal, but I want to have access to my dashboard no matter where I am, so I've created a reverse proxy to it.
Yes, yes, there is always a VPN, or overlay network, or a dozen other ways to do it, but honestly, I just want to access my dashboard from anywhere, anytime. The reverse proxy is a great way to do that. To provide an authentication layer, though, makes me feel so much better about it. This is where something like Authelia comes into play. Now I can put Authelia in front of my Homer dash, and before the dash can be reached, a user must first authenticate.
!\[\](http://shownotes.opensourceisawesome.com/content/images/2021/09/authelia-on-homer.png)
Authelia Prompt in front of Homer Dash
This doesn't just have to be for web applications that don't have authentication built in. You could opt to use Authelia in front of an application with built in authentication as well. It just adds one more layer of security to your sites.
Today, we'll go through getting authelia setup and running.
What you'll need
----------------
* A server that you control
* Docker, Docker-Compose, and NGinX Proxy Manager Installed and Ready
* A Domain / Sub-domain you want to use for your Authelia install (e.g. auth.example.com)
* An A-record pointing to the Public IP address where your server is.
* About 1 hour of time.
### Installing Docker, Docker-Compose, and NGinX Proxy Manager
**NOTE**: if you already have docker, docker-compose, and NGinX Proxy Manager installed, you can skip down to the section that says "Create your Authelia Entry in NGinX Proxy Manager".
In order to make this as painless as possible, I have built a script to install Docker and Docker-Compose for Ubuntu 18.04, 20.04, Debian, and CentOS. You can find these out on github at [https://github.com/bmcgonag/docker\_installs](https://github.com/bmcgonag/docker_installs)
Additionally, I have modified the Ubuntu 20.04 script into a new script that will also install NGinX Proxy Manager, and get it running in Docker for you. You can get it direclty by going to [https://gitlab.com/bmcgonag/docker\_installs/-/raw/main/install\_docker\_nproxyman.sh](https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh)
To use the script above, just open a terminal, SSH to your server (if you aren't already on it), and create a new file called install-docker.sh
`nano install-docker.sh`
Copy and paste the script from the github site. CTRL + C after you highlight it. Then use CTRL + Shift + V to paste it into the terminal window in your file.
Save it with CTRL + O, then press Enter to confirm, and then exit the nano editor with CTRL + X.
Now, change the permissions on the script to make it executable with:
`chmod +x install-docker.sh`
Finally, you can run the script with:
`./install-docker.sh`
This will pull down Docker-CE (Community Edition), and install it, then install Docker-Compose, and finally pull down a default docker-compose.yml file to setup and make NGinX Proxy Manager run for you.
NOTE: The default values in the docker-compose file are straight from the NGinX Proxy Manager Quick Start, so I highly recommend, stopping the container, and changing the DB user and password values (making sure they match in both sections of the compose file), and then restarting it.
Login to NGinX Proxy Manager by going to [http://your-ip-or-domain:81](http://your-ip-or-domain:81) and use the default credentials of:
* username: [admin@example.com](mailto:admin@example.com)
* password: changeme
the first time you login, you'll be prompted to change the username email, and password to something stronger.
### Create your Authelia Entry in NGinX Proxy Manager
Now, you'll need to create an entry for the authelia front end in NGinX Proxy Manager. Somthing like `auth.your-domain.org`, of course replacing `your-domain.org` with your actual domain. Go ahead nad make sure it opens properly without SSL, then setup the LetsEncrypt SSL on your new auth domain.
Now, test it again, and make sure it comes up with SSL. Once that's working we'll edit it one more time, and need to add some specific text / configuration to the Advanced tab of our auth entry. For the most part this will be copy paste, with one modification.
```
location / {
set $upstream_authelia http://<authelia-server-ip-and:port>; # e.g. http://192.168.1.13:9091
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;
#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
# If behind reverse proxy, forwards the correct IP
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}
```
In the above text, make sure to change the part where it says `<authelia-server-ip-and:port>` to be your authelia server's IP and Port number, then Save.
Installing Authelia
-------------------
For Authelia, you'll need 3 files:
1. docker-compose.yml
2. configuration.yml
3. users\_database.yml
### Docker-Compose for Authelia
In your server, create a new folder called "authelia", and move into that folder:
`mkdir authelia`
`cd authelia`
Now, create two more folders called "config" and "redis"
`mkdir config`
`mkdir redis`
Finally, create a new file called "docker-compose.yml":
`nano docker-compose.yml`
And paste the following text into it:
```
version: '3.3'
services:
authelia:
image: authelia/authelia
volumes:
- ./config:/config
ports:
- 9091:9091
restart: unless-stopped
healthcheck:
disable: true
environment:
- TZ=America/Chicago
depends_on:
- redis
redis:
image: redis:alpine
volumes:
- ./redis:/data
expose:
- 6379
restart: unless-stopped
environment:
- TZ=America/Chicago
```
Once pasted, make sure to change the left side of the port mapping **if necessary** from 9091 to any free port you have on your server. If 9091 is free, then leave it as is. NOTE: if you change the port here, you must go back and change it in your NGinX Proxy Manager advanced tab, as well as the main tab for your "auth.your-dormain.org" entry.
Next, change the timezone ( TZ ) environment variable to your timezone.
Now save the file with CTRL + O, then press Enter to confirm, and use CTRL + X to exit.
We can't run the compose file just yet, as we have a couple of other files to create first.
### The Configuration File
Now we need to create our Authelia main configuration file. Change into the "config" directory:
`cd config`
and create a new file called "configuration.yml":
`nano configuration.yml`
In that file, paste the following: NOTE: This text has been updated since the original video and blog-post to reflect changes to the yaml for Authelia.
```
###############################################################
# Authelia configuration #
###############################################################
server:
host: 0.0.0.0
port: 9091
jwt_secret: a-super-long-strong-string-of-letters-numbers-characters
log:
level: debug
default_redirection_url: https://auth.routemehome.org
totp:
issuer: routemehome.org
period: 30
skew: 1
#duo_api: ## You can use this api if you want push notifications of auth attempts
# hostname: api-123456789.example.com
# integration_key: ABCDEF
# secret_key: yet-another-long-string-of-characters-and-numbers-and-symbols
authentication_backend:
disable_reset_password: false
file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 1
salt_length: 16
parallelism: 8
memory: 64
access_control:
default_policy: deny
rules:
# Rules applied to everyone
- domain:
- "noauth.domain.org"
- "another-no-auth.domain.org"
policy: bypass
- domain:
- "my1st1factor.domain.org"
- "my2nd1factor.domain.org"
- "domain.org"
policy: one_factor
# networks:
# - 192.168.1.0/24
- domain:
- "a2factor.domain.org"
policy: two_factor
# networks:
# - 192.168.1.0/24
session:
name: authelia_session
# This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
secret: a-really-L0ng_s7r0ng-secr3t-st1nggggg-shoul0-be-used
expiration: 3600 # 1 hour
inactivity: 7200 # 2 hours
domain: <your.domain-here.org> # Should match whatever your root protected domain is
redis:
host: authelia_redis_1
port: 6379
# This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
# password: authelia
regulation:
max_retries: 5
find_time: 2m
ban_time: 10m
theme: dark
storage:
encryption_key: a-very-long-strong-key-should-be-used-here
local:
path: /config/db.sqlite3
notifier:
# filesystem:
# filename: /config/notification.txt
smtp:
username: <your@email-here.com>
password: <your-smtp-password>
host: <your-smtp-server.url>
port: 25,465,or 587
sender: <sender@email-here.com>
subject: "[Authelia] {title}"
disable_require_tls: false
disable_html_emails: false
tls:
server_name: <your-smtp-server.url>
skip_verify: false
minimum_version: TLS1.2
```
In the above file, make sure to change any field with "<" and ">" symbols around the text. Make sure you have updated all values to meet your needs. For more information on what each of these options are, watch my video, or check the Authelia documentation.
Once you have pasted, and updated the file above, save it with CTRL + O, then Enter to confirm, and exit with CTRL + X.
### The Users Database file
Finally, we need to create a file for our users. This wile will be called "users\_database.yml".
While still in the "config" directory, create the new file:
`nano users_database.yml`
then paste the following into the file, and modify according to your needs.
```
users:
john:
displayname: "John Doe"
password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
email: john.doe@authelia.com
groups:
- admins
- dev
harry:
displayname: "Harry Potter"
password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
email: harry.potter@authelia.com
groups: []
```
In the example file above, we have two users. John and Harry. If you only need 1 user, you would simply remove the section for Harry, and modify the section for John.
The password for the user you create must be entered as a hashed password, and not in plain text. In order to get the hashed password, you'll use the following command:
`docker run authelia/authelia:latest authelia hash-password 'yourpassword'`
Replace 'yourpassword' in the above command with the actual plain text password you want for your user.
Press enter, and allow the command to run. If you've not already pulled down the authelia/authelia image, it will pull down at this point from dockerhub, so be patient the first time you run this command.
Once complete, copy the hashed password from the command line by highlighting it, and using a right-click >> copy, or CTRL + Shift + C to copy it, and then re-open your users\_database.yml file and paste the full hash between the double quotation marks.
Save the file again, and you're set.
Test Our Authelia Setup
-----------------------
We can finally test the authelia setup. We don't have any web applications protected by it just yet, but we can make sure that it's working, and that we can authenticate.
Move back out of the "config" directory one level with:
`cd ..`
and then run `docker-compose up`
This will pull down Redis, and startup Authelia and Redis. Watch the output for errors, but if everything is setup properly, you sould see a message that says Authelia is running at 0.0.0.0:9091.
Open your browser (or a new tab) and go to [https://auth.<your-domain.org](https://auth.<your-domain.org)\> <– of course using your actual domain.
You should be prompted with the login screen. You can now enter your username and password, and make sure you're able to login.
Setup our NGinX Proxy Manager sites for Authelia
------------------------------------------------
For each site you put in the Authelia configuration file, you need to add a proxy host entry in NGinX Proxy Manager. Make sure you've setup each site in NPM, then on the Advanced tab for each one you'll need to add the following JSON. This long text only needs a few changes, and once you do it for the first site, copy and paste it from one to the next, and you'll only need to make 1 or 2 changes each time.
\`\`\` location /authelia { internal; set $upstream\_authelia http:///api/verify; #ADD YOUR IP AND PORT OF AUTHELIA proxy\_pass\_request\_body off; proxy\_pass $upstream\_authelia; proxy\_set\_header Content-Length "";
```
# Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
client_body_buffer_size 128k;
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;
send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
```
}
```
location / {
set $upstream_<appname> http://<application-ip-and:port>; #ADD IP AND PORT OF SERVICE
proxy_pass $upstream_<appname>; #change name of the service
auth_request /authelia;
auth_request_set $target_url $scheme://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;
error_page 401 =302 https://auth.<example.com>/?rd=$target_url;
client_body_buffer_size 128k;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
# add your ip range here, and remove this comment!
set_real_ip_from 192.168.7.0/16;
set_real_ip_from 172.0.0.0/8;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}
```
```
<figcaption>JSON for Advanced Tab of each site in NGinX Proxy Manager you want behind Authelia</figcaption></figure>In the above file, you need to change the 5 portions with the "&lt;" and "&gt;" around them.
On part 1, enter the IP and Port of your authelia server (auth.your-domain.org).
`<your-authelia-server-ip-and:port>` --&gt; put your actual authelia ip and port number here. You only need to edit this the first time, then copy and paste the same config to each site you are setting up as this value will always be the same.
In part 2, you need to change the following:
`<appname>` --&gt; whatever simple name defines the app (e.g. homer, ntop, jitsi, npmui, etc). This will be different for each entry you make in NGinX Proxy Manager for different sites.
<a>`application-ip-and:port`</a> --&gt; The IP address and port number for the application you are placing behind Authelia. This will be different for each entry in NGinX Proxy Manager for different sites.
`auth.<example.com>` should be changed to the domain / subdomain for your authelia server. Change this the first time you make this file, then just use it over and over as this value will remain the same.
Finally, under the '*real ip*' section, you **may need to** add your local network IP range. For instance if your network is 10.21.0.0 based, then you'll want to add a line like:
`set_real_ip_from 10.21.0.0/16`
That's it. Save your configuration, and give it a try. NOTE: You may need to use CTRL + F5 to reresh your browser the fist time you open a page you've been to previously. Browsers tend to cache information, so making it refresh once can help.
Test your site, if all is setup correctly, you'll be taken to the Authelia sign in page. Depending on whether you set the site for one\_factor or two\_factor, you may also be asked to setup your TOTP app, and use your one time pin as well.
I hope this tutorial is helpful for you all, and look forward to using more Authelia going forward!
## Support My Channel and Content
<figure class="kg-card kg-bookmark-card" id="bkmrk-patreon-is-a-members"><div class="kg-bookmark-content"><div class="kg-bookmark-description">Patreon is a membership platform that makes it easy for artists and creators to get paid. Join over 200,000 creators earning salaries from over 6 million monthly patrons.</div></div></figure>
```
Backups/Miker/.trash/Authentik - Install and Setup 2.md
+390
View File
@@ -0,0 +1,390 @@
Introduction
------------
As the internet and services have become more and more the norm in our society protecting our services with authentication has become ever more important as well. This is where amazing projects like Authentik, and Authelia come in. These solutions give you the opportunity to setup a Single Sign On system for all of your services. That means you just need to have one very secure login, and you can access any of the services you use everyday.
### What You'll Need
* Docker and Docker Compose Installed on a Host that you can access from the Internet
* A domain or sub-domain that you own and can set an A or CNAME Record for.
* NGinX Proxy Manager (or other reverse proxy of your choice)
* an SMTP Email Server
* About 30 minutes of your time
### Installation
#### Install Docker, Docker Compose, and NGinX Proxy Manager via a Simple Script
You can easily install Docker-CE, Docker-Compose, Portainer-CE, and NGinX Proxy manager by using this quick install script I created and maintain on Github. Just use the command:
`wget <a href="https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh">https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh</a>`
To download the script to your desired host.
Change the permissions to make the script executable:
`chmod +x ./install_docker_nproxyman.sh`
and then run the script with the command:
`./install_docker_nproxyman.sh`
When run, the script will prompt you to select your host operating system, then will ask you which bits of software you want to install.
Simply enter 'y' for each thing you want to install.
At some point, you may be asked for your super user (sudo) password as well.
Allow the script to complete installation.
At this point, you might want to log out and back in, as this will allow you to use the `docker` and `docker-compose` commands without the need of `sudo` in front of them.
#### Configure and Install Authentik
Let's create our folder structure. First, we want to create a parent 'docker' folder, and inside that place any / all of our application folders we may want to run on this host. In this case our application folder will be 'authentik'.
`mkdir -p docker/authentik`
Next, we'll move into our new folder and create our docker-compose.yml file. This file defines our application containers, and helps put them all into a private network on our host so the various parts of the overall application can communicate securely.
`nano docker-compose.yml`
Copy the block of yaml code from below, and paste it into the document we just opened. You can paste in the linux terminal by right clicking, and selecting paste, or by using CTRL + Shift + V.
```text-plain
version: "3.4"
services:
postgresql:
image: docker.io/library/postgres:12-alpine
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
start_period: 20s
interval: 30s
retries: 5
timeout: 5s
volumes:
- ./database:/var/lib/postgresql/data
environment:
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
POSTGRES_USER: ${PG_USER:-authentik}
POSTGRES_DB: ${PG_DB:-authentik}
env_file:
- .env
redis:
image: docker.io/library/redis:alpine
command: --save 60 1 --loglevel warning
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
start_period: 20s
interval: 30s
retries: 5
timeout: 3s
volumes:
- ./redis:/data
server:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.8.3}
restart: unless-stopped
command: server
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
volumes:
- ./media:/media
- ./custom-templates:/templates
env_file:
- .env
ports:
- "${COMPOSE_PORT_HTTP:-9000}:9000"
- "${COMPOSE_PORT_HTTPS:-9443}:9443"
depends_on:
- postgresql
- redis
worker:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.8.3}
restart: unless-stopped
command: worker
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
# `user: root` and the docker socket volume are optional.
# See more for the docker socket integration here:
# https://goauthentik.io/docs/outposts/integrations/docker
# Removing `user: root` also prevents the worker from fixing the permissions
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
# (1000:1000 by default)
user: root
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./media:/media
- ./certs:/certs
- ./custom-templates:/templates
env_file:
- .env
depends_on:
- postgresql
- redis
volumes:
database:
driver: local
redis:
driver: local
```
Once you've pasted in the code, save the file with CTRL + O, then press Enter to confirm, and exit the nano editor with CTRL + X.
Next we need to create an environment variable file that the dockeer-compose.yml file will read. This file allows us to customize our variables for the container setup without having to repeatedly enter like values throughout the docker-compose file.
`nano .env`
Note: The period in front of the filename. In unix based systems a filename starting with a period is a hidden file, and will not be shown with commands like \`ls\` alone. Instead you must use the flag \`-a\` (all) to show everything in a folder including hidden files, like this \`ls -a\`.
Once open, copy the file contents below, and paste them into the .env file.
```text-plain
PG_USER=authentik
PG_PASS=aReallyLongStrongPasswordShouldBePutHere
AUTHENTIK_SECRET_KEY=someincrediblylongcomplexkeygoeshere
AUTHENTIK_ERROR_REPORTING__ENABLED=true
# SMTP Host Emails are sent to
AUTHENTIK_EMAIL__HOST=smtp.example.com
AUTHENTIK_EMAIL__PORT=587
# Optionally authenticate (don't add quotation marks to your password)
AUTHENTIK_EMAIL__USERNAME=auth@example.com
AUTHENTIK_EMAIL__PASSWORD=a-L0n6-Strong_password_should_go_here
# Use StartTLS
AUTHENTIK_EMAIL__USE_TLS=true
# Use SSL
AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__TIMEOUT=10
# Email address authentik will send from, should have a correct @domain
AUTHENTIK_EMAIL__FROM=auth@example.com
COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443
# Authentik Version to Pull
ATHENTIK_TAG=2023.8.3
```
I have intentionally added placeholders to most of the values. You'll want to go through and update these placeholders to be actual values for your installation. The values you must change at a minimum are:
PG\_PASS - This value can be any long, strong password you want.
AUTHENTIK\_SECRET\_KEY - This values should be a long string of numbers, letters (upper and lower case), and symbols at least 64 characters in length.
You should additionally setup the SMTP email options as this is a major part of user management and self-service in any authentication provider, such as when a user needs to reset his / her password, MFA device, register (if allowed). It's also how the Authentik install will send you information about events, updates, etc.
Finally, for the COMPOSE\_PORT\_HTTP and COMPOSE\_PORT\_HTTPS you may want to change these to be ports that aren't quite so common. If your host is also running NGINX Proxy Manager you should definitely change these to less common ports, as 80 and 443 are already in use by NPM.
Once you've updated the values appropriately, you can save and close the file with CTRL + O, then Enter to confirm, and then CTRL + X.
Now you are ready to bring up your Authentik application. Use the commands:
`docker compose up -d && docker compose logs -f`
The first part tells docker to get the necessary images and start the containers running in the background, and the second part tells docker once the containers are up, show us the logs.
You can discontinue the logs with CTRL + C.
Now navigate to the IP address of your host machine, and the port you set for the non SSL (HTTP) access in the .env file. You should see the Authentik login page. If so, then you are doing well. Next, setup the reverse proxy.
Reverse Proxy Setup
-------------------
Login to NGinX Proxy Manager (NPM) and click into the Proxy Hosts section. Select ‘Add Proxy Host’ from the upper right, and int he modal (pop-up) window that opens, we'll begin adding the information needed to get our domain name to resolve to our new server.
In the domain name field, enter your desired domain name. I used ‘authentik.routemehome.org’.
I own the domain ‘routemehome.org’, and have setup an A-record in DNS on the domain that will point the domain name to my public IP address.
Next, enter the private IP of your Authentik server. You can use ‘localhost’ if the Authentik server is running on the machine you are running NPM on. Next, enter the port number you entered in the .env file. If you didn't change it, it will be 80.
Enable the options for ‘Block Common Exploits’ and ‘Websocket Support’.
Now move to the SSL tab, and select “Request a New Certificate” from the drop-down box.
Enable the options for ‘Force SSL’, ‘HTTP/2 Support’, and both ‘HSTS’ options.
Enter your email address in the Email field, and enable the ‘Agree to Terms of Service’ option.
Click ‘Save’. If all is setup properly, the modal window will simply go away after a few seconds (maybe 30). Then you'll have a CA Certified LetsEncrypt certificate for your Authentik server.
You should now be able to get to your Authentik install using the FQDN (fully qualified domain name).
Configure
---------
To create your first (admin) user, you need to go to your domain at a special address.
[https://authentik.yourdomain.com/if/flow/initial-setup/](https://authentik.yourdomain.com/if/flow/initial-setup/)
Of course, use your actual domain name.
Enter your preferred email, and learn from my mistake and make sure it's correct before moving on. Next enter a long, strong password, then enter it again to confirm it. I cannot stress enough, you should absolutely use a password manager for keeping and helping you create long, strong passwords. I highly recommend Bitwarden, and Vaultwarden if you prefer to self host.
Click Create Account, and you should be logged in as an administrative user.
Proxy Login
-----------
Make sure you have an outpost setup, and setup properly. We can use the authentik embedded outpost in this case.
### Make Sure Outpost is set Correctly
Click on Outposts on the left side menu, then click the edit icon in the list of outposts. if this is a new install you likely only have one outpost at this point.
In the pop-up window that opens, verify that your ‘authentik\_host’ has the same URL as your Authentik site. If you are using [https://auth.my-great-domain.com](https://auth.my-great-domain.com) to reach your Authentik install, then you want this value to be the same.
You can now dismiss the pop-up if everything looks good. Additionally, in the outposts list, you should see a green check mark under health and version.
### Add a Provider
Next we need to add a provider for our setup.
Click on ‘Providers’ in the left side menu.
In this view, click on ‘Create’ at the top.
Again, when the pop-up window opens, select ‘Proxy Provider’, then click Next.
On the next page, enter a name that identifies the application you are creating a proxy authenticator for. The Proxy authentication is useful for applications and services you run that don't provide authentication in the app, but that you might like to expose to the internet. For instance, a dashboard, speedtest, etc.
Choose ‘Authorize Application’ from the Authentication Flow drop down.
Next, what you select will depend on how you are proxying your service traffic to your applications and service. If you are using a reverse proxy like NGinX Proxy Manager, Caddy, Traefik, etc, then you'll want to choose ‘Forward Auth (single application)’. If, however, you don't yet have a reverse proxy setup, then you'll potentially want to use the ‘Proxy’ option, which then turns Authentik into a reverse proxy for the site as well.
In our case we'll go with ‘Forward Auth (single application)’.
Now fill in your sites externally available FQDN (fully qualified domain name), for instance [https://mydash.example.com](https://mydash.example.com)
You can change Token Validity to any timeframe you wish, but leaving it at 24 hours should be fine.
Click ‘Finish’.
You should be returned to your ‘Provider’ list, and you should see the provider you just created. You'll likely have a warning in the list that the provider is not associated to any applications. No worries, we'll fix this right now.
### Add an Application Entry for the Provider
In the left side menu click on ‘Applications’.
On the ‘Applications’ page, click the ‘Create’ button at the top, and you'll be presented with a pop-up window (modal window) where you need to fill in your application information.
Give your application a name that helps you easily identify the application. If you are creating an authentication for your dashboard, then call it ‘Dashboard’ for instance. As you fill in the ‘Name’ field, you'll notice that the ‘slug’ field is automatically filled in. The slug should not be changed unless you have a reason to do so, and the slug should always be lowercase, and not have spaces in it.
Now move down to the ‘Provider’ field, and select the provider you just created.
When creating these types of authentication flows, you always want to create a new provider, and a matching application entry for that provider, then select the provider for that application.
Finally, click the ‘Create’ button at the bottom of the modal window.
### Ensure the Provider is now Satisfied with the Application Entry
Navigate back to your Providers list on the left, and notice that our provider no longer shows the warning about not being associated to an application.
### Set the Application in Outposts
We are almost there. Navigate back to ‘Outposts’, and click the edit icon next to our outpost. In the modal window, next to the ‘Applications’ label, you should now see your application listed. You will click on this line in the field to select the application.
Click the ‘Update’ button at the bottom of the modal window. You should now see the application name listed under the ‘Providers’ column for the outpost. As you add more applications and providers, you'll see them added for any outpost you add them to. In this case, you can use this same outpost for multiple applications and providers needing a simple Forward Auth setup.
### Get your Reverse Proxy Snippet
Finally, navigate back to ‘Providers’ on the left side menu, and click the Name of your provider. This will show the Provider details in a new page. Scroll down, and notice various reverse proxy options are shown as tabs. Select the reverse proxy you are using, and you'll see a snippet of code that you'll use to setup your reverse proxy entry so it will start using Authentik before the application will load.
In our case, we've used NGinX Proxy Manager, so I'll click that tab, and copy that bit of code.
I'll open NGinX Proxy Manager and select the 3-dot icon on the row for my application, then select ‘Edit’.
Move to the ‘Advanced’ tab in the modal window, and paste in the code snippet.
In the pasted snippet, scroll down to the line for ‘proxy\_pass’, and change the FQDN for your Authentik instance to its internal IP address and port number.
NOTE: This is only done if you are running NGinX Proxy Manager, Authentik, and your Application on the same local area network.
In my case I change authentik.routemehome.org to 192.168.10.42.
Click ‘Save’.
If you now try to load your application, you should be prompted to login with Authentik. Verify you can login using your credentials, and you'd now setup.
OIDC OAuth2
-----------
### Create an OIDC Provider
Creating an OIDC provider is really pretty straight forward. The more daunting task for me is figuring out what information each application may need for the OIDC connection. Even that is pretty easy though.
Again, for each application that you want to access, you need to create a provider, and an application entry that goes with the provider.
Let's tackle creating the Provider first.
1. Click Providers on the left side menu.
2. Click ‘Create’ at the top.
3. Select ‘OAuth2/OpenID Provider’
4. Click ‘Next’
5. Name your Provider with the name of the application you'll use it with (e.g. 'NextCloud OAuth')
6. Select the default Authentication Flow.
7. Select the default Authorization flow for explicit consent.
8. Leave Client Type as Confidential.
9. If you know you need a special redirect URI / Origin, fill it in, otherwise leave it blank and click ‘Finish’.
A couple of things to note. You may have noticed the fields with Client ID and Client Secret. You'll need these on pretty much every application with OAuth. You can always get back to these values in the Providers list, then click the ‘Edit’ icon to the right of the Provider you need them for.
#### Create the OIDC Application Entry
Next, we'll need to add an entry for our Application. Remember, each Provider must have an associated Application entry before it can be used for Authentication / Authorization.
1. In the left side menu, navigate to Applications, and click ‘Create’ at the top of the window.
2. Fill in a ‘Name’ for the application (e.g. “Headscale UI”). Notice the ‘Slug’ field will auto-fill. There's no need to change this field.
3. Select the Provider you just created from the drop list.
4. Set ‘Policy engine mode’ to ‘Any’ and click ‘Create’.
Note: If you'd like to have the application represented by it's Logo, then you can upload an image (I recommend png or svg for transparency) under the expandable ‘UI settings’ section before clicking ‘Create’, or anytime in the future by simply editing the Application entry.
If you now navigate back to your Providers list, you'll see that you Provider no longer shows a warning since you've now associated an Application entry to it.
### Adding Your OIDC Credentials to the actual Application
This step will greatly depend on the application you are setting up with OIDC. For Headscale WebUI it is very straight-forward. For Nextcloud you need to add a bit more information, but the Nextcloud documentation on doing this is very good.
Generally you'll need 3 or 4 of the values available from your Provider entry.
1. Client ID (sometimes listed as Client Key) - You get this by clicking the edit icon to the right of the provider entry.
2. Client Secret - You get this by clicking the edit icon to the right of the provider entry.
3. OpenID Configuration URL - You get this by clicking on the Provider Name link in the Providers list.
4. OpenID Configuration Issuer - You get this by clicking on the Provider Name link in the Providers list.
There are other URLs listed that may be required for some applications, so familiarize yourself with those labels,, and know they are there in case you need them.
Four our purpose in setting up OIDC for Headscale WebUI we need to use just the Client ID, Client Secret, and Configuration URL.
In your docker-compose.yml file for Headscale / Headscale WebUI, set the Web UI AUTH\_TYPE to “oidc”.
Comment out the entries for BASIC\_AUTH\_USER and BASIC\_AUTH\_PASS with a hashtag (#).
Uncomment the values for OIDC\_AUTH\_URL, OIDC\_CLIENT\_ID, and OIDC\_CLIENT\_SECRET.
Copy and paste the appropriate values from your Authentik provider, into the proper place next to your entries.
Keep in mind that yaml code is space dependent, so make sure you align everything properly using spaces as you go.
Save, and exit the docker-compose.yml file, and restart your docker-compose. I recommend doing a complete `docker-compose down` and then `docker compose up -d` to make sure the new changes take effect. You can check the compose logs to make sure no errors came up.
Now, navigate to your Headscale WebUI address, and you shud be directed to your Authentik site for login first.
Note: In Firefox, I occasionally get into a login loop. This is something to do with Firefox's caching system. You can usually get around this by logging in through a Private Browsing Window, or using another browser the first time. I have noticed that the loop does stop after completely closing firefox for a little bit.
Finally, you may need to go back into your Provider entry, and adjust the 'Redirect URI / origins" and make sure it has “https” in the address. Getting a Redirect URI error in your Authentik site is an indicator this may not be set properly. My production setup did this without issue, but my testing system put http only for some reason, and once I changed it everything worked perfectly.
### Support My Channel and Content
Support my Channel and ongoing efforts through Patreon:
[https://www.patreon.com/bePatron?u=234177](https://www.patreon.com/bePatron?u=234177)
Backups/Miker/.trash/Authentik - Install and Setup.md
+390
View File
@@ -0,0 +1,390 @@
Introduction
------------
As the internet and services have become more and more the norm in our society protecting our services with authentication has become ever more important as well. This is where amazing projects like Authentik, and Authelia come in. These solutions give you the opportunity to setup a Single Sign On system for all of your services. That means you just need to have one very secure login, and you can access any of the services you use everyday.
### What You'll Need
* Docker and Docker Compose Installed on a Host that you can access from the Internet
* A domain or sub-domain that you own and can set an A or CNAME Record for.
* NGinX Proxy Manager (or other reverse proxy of your choice)
* an SMTP Email Server
* About 30 minutes of your time
### Installation
#### Install Docker, Docker Compose, and NGinX Proxy Manager via a Simple Script
You can easily install Docker-CE, Docker-Compose, Portainer-CE, and NGinX Proxy manager by using this quick install script I created and maintain on Github. Just use the command:
`wget <a href="https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh">https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh</a>`
To download the script to your desired host.
Change the permissions to make the script executable:
`chmod +x ./install_docker_nproxyman.sh`
and then run the script with the command:
`./install_docker_nproxyman.sh`
When run, the script will prompt you to select your host operating system, then will ask you which bits of software you want to install.
Simply enter 'y' for each thing you want to install.
At some point, you may be asked for your super user (sudo) password as well.
Allow the script to complete installation.
At this point, you might want to log out and back in, as this will allow you to use the `docker` and `docker-compose` commands without the need of `sudo` in front of them.
#### Configure and Install Authentik
Let's create our folder structure. First, we want to create a parent 'docker' folder, and inside that place any / all of our application folders we may want to run on this host. In this case our application folder will be 'authentik'.
`mkdir -p docker/authentik`
Next, we'll move into our new folder and create our docker-compose.yml file. This file defines our application containers, and helps put them all into a private network on our host so the various parts of the overall application can communicate securely.
`nano docker-compose.yml`
Copy the block of yaml code from below, and paste it into the document we just opened. You can paste in the linux terminal by right clicking, and selecting paste, or by using CTRL + Shift + V.
```text-plain
version: "3.4"
services:
postgresql:
image: docker.io/library/postgres:12-alpine
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
start_period: 20s
interval: 30s
retries: 5
timeout: 5s
volumes:
- ./database:/var/lib/postgresql/data
environment:
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
POSTGRES_USER: ${PG_USER:-authentik}
POSTGRES_DB: ${PG_DB:-authentik}
env_file:
- .env
redis:
image: docker.io/library/redis:alpine
command: --save 60 1 --loglevel warning
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
start_period: 20s
interval: 30s
retries: 5
timeout: 3s
volumes:
- ./redis:/data
server:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.8.3}
restart: unless-stopped
command: server
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
volumes:
- ./media:/media
- ./custom-templates:/templates
env_file:
- .env
ports:
- "${COMPOSE_PORT_HTTP:-9000}:9000"
- "${COMPOSE_PORT_HTTPS:-9443}:9443"
depends_on:
- postgresql
- redis
worker:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.8.3}
restart: unless-stopped
command: worker
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
# `user: root` and the docker socket volume are optional.
# See more for the docker socket integration here:
# https://goauthentik.io/docs/outposts/integrations/docker
# Removing `user: root` also prevents the worker from fixing the permissions
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
# (1000:1000 by default)
user: root
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./media:/media
- ./certs:/certs
- ./custom-templates:/templates
env_file:
- .env
depends_on:
- postgresql
- redis
volumes:
database:
driver: local
redis:
driver: local
```
Once you've pasted in the code, save the file with CTRL + O, then press Enter to confirm, and exit the nano editor with CTRL + X.
Next we need to create an environment variable file that the dockeer-compose.yml file will read. This file allows us to customize our variables for the container setup without having to repeatedly enter like values throughout the docker-compose file.
`nano .env`
Note: The period in front of the filename. In unix based systems a filename starting with a period is a hidden file, and will not be shown with commands like \`ls\` alone. Instead you must use the flag \`-a\` (all) to show everything in a folder including hidden files, like this \`ls -a\`.
Once open, copy the file contents below, and paste them into the .env file.
```text-plain
PG_USER=authentik
PG_PASS=aReallyLongStrongPasswordShouldBePutHere
AUTHENTIK_SECRET_KEY=someincrediblylongcomplexkeygoeshere
AUTHENTIK_ERROR_REPORTING__ENABLED=true
# SMTP Host Emails are sent to
AUTHENTIK_EMAIL__HOST=smtp.example.com
AUTHENTIK_EMAIL__PORT=587
# Optionally authenticate (don't add quotation marks to your password)
AUTHENTIK_EMAIL__USERNAME=auth@example.com
AUTHENTIK_EMAIL__PASSWORD=a-L0n6-Strong_password_should_go_here
# Use StartTLS
AUTHENTIK_EMAIL__USE_TLS=true
# Use SSL
AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__TIMEOUT=10
# Email address authentik will send from, should have a correct @domain
AUTHENTIK_EMAIL__FROM=auth@example.com
COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443
# Authentik Version to Pull
ATHENTIK_TAG=2023.8.3
```
I have intentionally added placeholders to most of the values. You'll want to go through and update these placeholders to be actual values for your installation. The values you must change at a minimum are:
PG\_PASS - This value can be any long, strong password you want.
AUTHENTIK\_SECRET\_KEY - This values should be a long string of numbers, letters (upper and lower case), and symbols at least 64 characters in length.
You should additionally setup the SMTP email options as this is a major part of user management and self-service in any authentication provider, such as when a user needs to reset his / her password, MFA device, register (if allowed). It's also how the Authentik install will send you information about events, updates, etc.
Finally, for the COMPOSE\_PORT\_HTTP and COMPOSE\_PORT\_HTTPS you may want to change these to be ports that aren't quite so common. If your host is also running NGINX Proxy Manager you should definitely change these to less common ports, as 80 and 443 are already in use by NPM.
Once you've updated the values appropriately, you can save and close the file with CTRL + O, then Enter to confirm, and then CTRL + X.
Now you are ready to bring up your Authentik application. Use the commands:
`docker compose up -d && docker compose logs -f`
The first part tells docker to get the necessary images and start the containers running in the background, and the second part tells docker once the containers are up, show us the logs.
You can discontinue the logs with CTRL + C.
Now navigate to the IP address of your host machine, and the port you set for the non SSL (HTTP) access in the .env file. You should see the Authentik login page. If so, then you are doing well. Next, setup the reverse proxy.
Reverse Proxy Setup
-------------------
Login to NGinX Proxy Manager (NPM) and click into the Proxy Hosts section. Select ‘Add Proxy Host’ from the upper right, and int he modal (pop-up) window that opens, we'll begin adding the information needed to get our domain name to resolve to our new server.
In the domain name field, enter your desired domain name. I used ‘authentik.routemehome.org’.
I own the domain ‘routemehome.org’, and have setup an A-record in DNS on the domain that will point the domain name to my public IP address.
Next, enter the private IP of your Authentik server. You can use ‘localhost’ if the Authentik server is running on the machine you are running NPM on. Next, enter the port number you entered in the .env file. If you didn't change it, it will be 80.
Enable the options for ‘Block Common Exploits’ and ‘Websocket Support’.
Now move to the SSL tab, and select “Request a New Certificate” from the drop-down box.
Enable the options for ‘Force SSL’, ‘HTTP/2 Support’, and both ‘HSTS’ options.
Enter your email address in the Email field, and enable the ‘Agree to Terms of Service’ option.
Click ‘Save’. If all is setup properly, the modal window will simply go away after a few seconds (maybe 30). Then you'll have a CA Certified LetsEncrypt certificate for your Authentik server.
You should now be able to get to your Authentik install using the FQDN (fully qualified domain name).
Configure
---------
To create your first (admin) user, you need to go to your domain at a special address.
[https://authentik.yourdomain.com/if/flow/initial-setup/](https://authentik.yourdomain.com/if/flow/initial-setup/)
Of course, use your actual domain name.
Enter your preferred email, and learn from my mistake and make sure it's correct before moving on. Next enter a long, strong password, then enter it again to confirm it. I cannot stress enough, you should absolutely use a password manager for keeping and helping you create long, strong passwords. I highly recommend Bitwarden, and Vaultwarden if you prefer to self host.
Click Create Account, and you should be logged in as an administrative user.
Proxy Login
-----------
Make sure you have an outpost setup, and setup properly. We can use the authentik embedded outpost in this case.
### Make Sure Outpost is set Correctly
Click on Outposts on the left side menu, then click the edit icon in the list of outposts. if this is a new install you likely only have one outpost at this point.
In the pop-up window that opens, verify that your ‘authentik\_host’ has the same URL as your Authentik site. If you are using [https://auth.my-great-domain.com](https://auth.my-great-domain.com) to reach your Authentik install, then you want this value to be the same.
You can now dismiss the pop-up if everything looks good. Additionally, in the outposts list, you should see a green check mark under health and version.
### Add a Provider
Next we need to add a provider for our setup.
Click on ‘Providers’ in the left side menu.
In this view, click on ‘Create’ at the top.
Again, when the pop-up window opens, select ‘Proxy Provider’, then click Next.
On the next page, enter a name that identifies the application you are creating a proxy authenticator for. The Proxy authentication is useful for applications and services you run that don't provide authentication in the app, but that you might like to expose to the internet. For instance, a dashboard, speedtest, etc.
Choose ‘Authorize Application’ from the Authentication Flow drop down.
Next, what you select will depend on how you are proxying your service traffic to your applications and service. If you are using a reverse proxy like NGinX Proxy Manager, Caddy, Traefik, etc, then you'll want to choose ‘Forward Auth (single application)’. If, however, you don't yet have a reverse proxy setup, then you'll potentially want to use the ‘Proxy’ option, which then turns Authentik into a reverse proxy for the site as well.
In our case we'll go with ‘Forward Auth (single application)’.
Now fill in your sites externally available FQDN (fully qualified domain name), for instance [https://mydash.example.com](https://mydash.example.com)
You can change Token Validity to any timeframe you wish, but leaving it at 24 hours should be fine.
Click ‘Finish’.
You should be returned to your ‘Provider’ list, and you should see the provider you just created. You'll likely have a warning in the list that the provider is not associated to any applications. No worries, we'll fix this right now.
### Add an Application Entry for the Provider
In the left side menu click on ‘Applications’.
On the ‘Applications’ page, click the ‘Create’ button at the top, and you'll be presented with a pop-up window (modal window) where you need to fill in your application information.
Give your application a name that helps you easily identify the application. If you are creating an authentication for your dashboard, then call it ‘Dashboard’ for instance. As you fill in the ‘Name’ field, you'll notice that the ‘slug’ field is automatically filled in. The slug should not be changed unless you have a reason to do so, and the slug should always be lowercase, and not have spaces in it.
Now move down to the ‘Provider’ field, and select the provider you just created.
When creating these types of authentication flows, you always want to create a new provider, and a matching application entry for that provider, then select the provider for that application.
Finally, click the ‘Create’ button at the bottom of the modal window.
### Ensure the Provider is now Satisfied with the Application Entry
Navigate back to your Providers list on the left, and notice that our provider no longer shows the warning about not being associated to an application.
### Set the Application in Outposts
We are almost there. Navigate back to ‘Outposts’, and click the edit icon next to our outpost. In the modal window, next to the ‘Applications’ label, you should now see your application listed. You will click on this line in the field to select the application.
Click the ‘Update’ button at the bottom of the modal window. You should now see the application name listed under the ‘Providers’ column for the outpost. As you add more applications and providers, you'll see them added for any outpost you add them to. In this case, you can use this same outpost for multiple applications and providers needing a simple Forward Auth setup.
### Get your Reverse Proxy Snippet
Finally, navigate back to ‘Providers’ on the left side menu, and click the Name of your provider. This will show the Provider details in a new page. Scroll down, and notice various reverse proxy options are shown as tabs. Select the reverse proxy you are using, and you'll see a snippet of code that you'll use to setup your reverse proxy entry so it will start using Authentik before the application will load.
In our case, we've used NGinX Proxy Manager, so I'll click that tab, and copy that bit of code.
I'll open NGinX Proxy Manager and select the 3-dot icon on the row for my application, then select ‘Edit’.
Move to the ‘Advanced’ tab in the modal window, and paste in the code snippet.
In the pasted snippet, scroll down to the line for ‘proxy\_pass’, and change the FQDN for your Authentik instance to its internal IP address and port number.
NOTE: This is only done if you are running NGinX Proxy Manager, Authentik, and your Application on the same local area network.
In my case I change authentik.routemehome.org to 192.168.10.42.
Click ‘Save’.
If you now try to load your application, you should be prompted to login with Authentik. Verify you can login using your credentials, and you'd now setup.
OIDC OAuth2
-----------
### Create an OIDC Provider
Creating an OIDC provider is really pretty straight forward. The more daunting task for me is figuring out what information each application may need for the OIDC connection. Even that is pretty easy though.
Again, for each application that you want to access, you need to create a provider, and an application entry that goes with the provider.
Let's tackle creating the Provider first.
1. Click Providers on the left side menu.
2. Click ‘Create’ at the top.
3. Select ‘OAuth2/OpenID Provider’
4. Click ‘Next’
5. Name your Provider with the name of the application you'll use it with (e.g. 'NextCloud OAuth')
6. Select the default Authentication Flow.
7. Select the default Authorization flow for explicit consent.
8. Leave Client Type as Confidential.
9. If you know you need a special redirect URI / Origin, fill it in, otherwise leave it blank and click ‘Finish’.
A couple of things to note. You may have noticed the fields with Client ID and Client Secret. You'll need these on pretty much every application with OAuth. You can always get back to these values in the Providers list, then click the ‘Edit’ icon to the right of the Provider you need them for.
#### Create the OIDC Application Entry
Next, we'll need to add an entry for our Application. Remember, each Provider must have an associated Application entry before it can be used for Authentication / Authorization.
1. In the left side menu, navigate to Applications, and click ‘Create’ at the top of the window.
2. Fill in a ‘Name’ for the application (e.g. “Headscale UI”). Notice the ‘Slug’ field will auto-fill. There's no need to change this field.
3. Select the Provider you just created from the drop list.
4. Set ‘Policy engine mode’ to ‘Any’ and click ‘Create’.
Note: If you'd like to have the application represented by it's Logo, then you can upload an image (I recommend png or svg for transparency) under the expandable ‘UI settings’ section before clicking ‘Create’, or anytime in the future by simply editing the Application entry.
If you now navigate back to your Providers list, you'll see that you Provider no longer shows a warning since you've now associated an Application entry to it.
### Adding Your OIDC Credentials to the actual Application
This step will greatly depend on the application you are setting up with OIDC. For Headscale WebUI it is very straight-forward. For Nextcloud you need to add a bit more information, but the Nextcloud documentation on doing this is very good.
Generally you'll need 3 or 4 of the values available from your Provider entry.
1. Client ID (sometimes listed as Client Key) - You get this by clicking the edit icon to the right of the provider entry.
2. Client Secret - You get this by clicking the edit icon to the right of the provider entry.
3. OpenID Configuration URL - You get this by clicking on the Provider Name link in the Providers list.
4. OpenID Configuration Issuer - You get this by clicking on the Provider Name link in the Providers list.
There are other URLs listed that may be required for some applications, so familiarize yourself with those labels,, and know they are there in case you need them.
Four our purpose in setting up OIDC for Headscale WebUI we need to use just the Client ID, Client Secret, and Configuration URL.
In your docker-compose.yml file for Headscale / Headscale WebUI, set the Web UI AUTH\_TYPE to “oidc”.
Comment out the entries for BASIC\_AUTH\_USER and BASIC\_AUTH\_PASS with a hashtag (#).
Uncomment the values for OIDC\_AUTH\_URL, OIDC\_CLIENT\_ID, and OIDC\_CLIENT\_SECRET.
Copy and paste the appropriate values from your Authentik provider, into the proper place next to your entries.
Keep in mind that yaml code is space dependent, so make sure you align everything properly using spaces as you go.
Save, and exit the docker-compose.yml file, and restart your docker-compose. I recommend doing a complete `docker-compose down` and then `docker compose up -d` to make sure the new changes take effect. You can check the compose logs to make sure no errors came up.
Now, navigate to your Headscale WebUI address, and you shud be directed to your Authentik site for login first.
Note: In Firefox, I occasionally get into a login loop. This is something to do with Firefox's caching system. You can usually get around this by logging in through a Private Browsing Window, or using another browser the first time. I have noticed that the loop does stop after completely closing firefox for a little bit.
Finally, you may need to go back into your Provider entry, and adjust the 'Redirect URI / origins" and make sure it has “https” in the address. Getting a Redirect URI error in your Authentik site is an indicator this may not be set properly. My production setup did this without issue, but my testing system put http only for some reason, and once I changed it everything worked perfectly.
### Support My Channel and Content
Support my Channel and ongoing efforts through Patreon:
[https://www.patreon.com/bePatron?u=234177](https://www.patreon.com/bePatron?u=234177)
Backups/Miker/.trash/BEMS BigPipe.md
+12
View File
@@ -0,0 +1,12 @@
**Christopher Kang**
Contractor
BigPipe System Engineer
Unisys
Supporting the Border Enforcement and Management Systems Division
Office of Information and Technology
U.S. Customs & Border Protection
571-468-6692 (o), 571-244-0982 (m)
 
SONG, YUN (CTR) \<YUN.SONG@cbp.dhs.gov\>
KIM, YONG (CTR) \<yong.kim@cbp.dhs.gov\>
Backups/Miker/.trash/BEMS SharePoint.md
+10
View File
@@ -0,0 +1,10 @@
Shine Achuthan
Contractor
Technical Architect
Unisys
Supporting the Border Enforcement and Management Systems Division
Office of Information and Technology
U.S. Customs & Border Protection
571-468-6205(Office)
571-239-1006(Cell)
[Shine.k.achuthan@cbp.dhs.gov](mailto:Shine.k.achuthan@cbp.dhs.gov)
Backups/Miker/.trash/Backup and Restore Procedures for Proxmox VE.md
+117
View File
@@ -0,0 +1,117 @@
# Backup and Restore Procedures for Proxmox VE
As someone who values resilience and efficiency in managing virtualized environments, I’ve found Proxmox VE to be a fantastic tool for ensuring data integrity and quick recovery. Its backup and restore system is comprehensive, offering features that meet both personal and professional needs. Whether you're managing a home lab (like mine!) or an enterprise setup, Proxmox has you covered.
---
## **Backup Overview**
Proxmox’s backup system is designed with flexibility and efficiency in mind, allowing you to create both **full** and **incremental backups** for virtual machines (VMs) and containers. Here’s what makes it so powerful:
### **Backup Types**
1. **Full Backup**:
- Captures an entire snapshot of a VM or container, including all its configuration and disk data.
- Ideal for the first backup or periodic full backups to maintain a complete data baseline.
- I use full backups when I’m making significant changes to my Proxmox setup or upgrading software on critical VMs.
2. **Incremental Backup**:
- Only stores the differences (changes) since the last backup.
- Saves time and storage space, making it great for frequent backups of dynamic systems.
- I rely on incremental backups for my Plex server and other services that experience frequent but minor updates.
### **Backup Storage Options**
Proxmox supports multiple storage backends, so you can tailor backups to your environment:
- **Local Storage**:
- Convenient for small setups or non-critical data.
- For example, I use a dedicated disk on my Dell PowerEdge server for quick local backups.
- **Network Storage (NAS)**:
- Perfect for storing backups off the main server.
- I utilize my Synology NAS with RAID 5 for storing backups securely while ensuring redundancy.
- **Proxmox Backup Server (PBS)**:
- This is a game-changer! It offers deduplication, encryption, and efficient backup storage.
- I integrated PBS into my lab to centralize all my backups and reduce storage usage with deduplication.
### **Compression and Encryption**
1. **Compression**:
- Proxmox supports several compression options:
- **Zstandard (zstd)**: My go-to for balancing speed and compression efficiency.
- **Gzip**: Slower but highly compressed files.
- **LZO**: Faster but less compression.
- I prefer zstd because it’s quick and doesn’t eat up CPU resources on my PowerEdge.
2. **Encryption**:
- Essential when storing backups remotely or on shared storage.
- With PBS, I can encrypt backups, giving me peace of mind that my data is secure.
### **Backup Scheduling**
One of my favorite Proxmox features is its integrated task scheduler:
- **Set It and Forget It**: Automate backups daily, weekly, or monthly.
- For example, I schedule daily incremental backups for my critical VMs (like Pi-hole and Nextcloud) and weekly full backups for larger systems, ensuring I’m always protected.
---
## **Restore Functionality**
Proxmox’s restore system is designed for quick and easy recovery, minimizing downtime in the event of a failure.
### **Restore Options**
1. **Full VM/Container Restore**:
- Quickly recover the entire VM or container to its last backed-up state.
- I tested this extensively when experimenting with GPU passthrough on my Proxmox setup. Restoring from a backup saved me after a configuration mishap.
2. **Selective Restore (with PBS)**:
- Allows restoring specific files or data from a backup.
- For example, if I mess up a config file on my web server, I can restore just that file instead of the entire VM.
3. **Snapshot Integration**:
- If you're using ZFS or Ceph storage, Proxmox can leverage snapshots for fast, consistent backups and restores.
- I’ve set up ZFS pools in my environment, and snapshots make rollback super efficient.
---
## **Why Backups Are Critical**
I’ve learned through trial and error that backups are essential, even in a home lab. From unexpected hardware failures to botched configurations, having reliable backups ensures I can recover quickly without losing progress.
---
## **Best Practices**
Here are some tips I’ve implemented in my setup to ensure my backups are always reliable:
1. **Develop a Strategy**:
- Mix full and incremental backups to balance storage use and recovery times.
- I follow the **3-2-1 rule**: 3 copies of my data, 2 different storage locations, and 1 offsite backup.
2. **Test Your Restores**:
- Don’t assume backups work—test them!
- I schedule quarterly tests by restoring random VMs to verify data integrity.
3. **Use Proxmox Backup Server**:
- If you’re serious about backups, PBS is worth it. Deduplication has saved me tons of storage space.
4. **Offsite Backup**:
- For disaster recovery, I replicate critical backups to a cloud service or external NAS. This adds another layer of protection.
5. **Document Your Setup**:
- I maintain a detailed document of my backup schedule, locations, and restore procedures. This helps me troubleshoot or onboard others to my setup if needed.
---
## **Real-World Example: My Experience**
A few months ago, I made some network changes to my Proxmox server while reconfiguring VLANs. I accidentally locked myself out of a VM that hosted a crucial web service. Thanks to Proxmox’s restore functionality, I was able to roll back to a working state in under 10 minutes. That moment reinforced the importance of regular backups and why I’ve gone all-in with Proxmox’s system.
Backups/Miker/.trash/COSS printing.md
+8
View File
@@ -0,0 +1,8 @@
CUPS Printing
**Efren  P. Brigola**
_Contractor, COSS Re-Host Team_
_Unisys_
_Supporting Border Enforcement & Management Systems Division_
_Office of Information Technology | U.S. Customs & Border Protection_
_O-571.468.6203;  M-571-888-0777_
_WFH:  Mondays_
Backups/Miker/.trash/CSD.md
+36
View File
@@ -0,0 +1,36 @@
Phillip Boedges
Branch Chief, Sustainment and Splunk Engineering Services (SSES)
Security Services Division (SSD) Cyber Security Directorate (CSD)
Office of Information and Technology (OIT)
U.S. Customs and Border Protection (CBP)
571.468.8499 (desk)
202.360.1708 (iPhone)
**Patrick A. Calloway**
Branch Chief
Security Engineering
Cybersecurity Engineering (CSE)
Cyber Security Directorate (CSD)
Office of Information and Technology (OIT)
U.S. Customs and Border Protection (CBP)
Mobile: 202-480-1275
[Patrick.a.calloway@cbp.dhs.gov](mailto:Patrick.a.calloway@cbp.dhs.gov)
Adam S Underwood
Cyber Security Engineer, Leidos
Sustaintment and Splunk Engineering Services (SSES)
Security Services Division (SSD)
Cyber Security Directorate (CSD)
Office of Information and Technology (OIT)
U.S. Customs and Border Protection (CBP)
Desk: (571) 468-8300 Cellular: (201) 551-0021
Robert S. Amos
Sr. Cyber Security Engineer, XOR Security
Security Sustainment and Engineering Services (SSES)
Security Operations Division (SOD)
Cybersecurity Directorate (CSD)
Office of Information and Technology (OIT)
Enterprise Services (ES)
U.S. Customs and Border Protection (CBP)
Desk: (571) 468-8371
Backups/Miker/.trash/Certificate Highlights Architecture Disaster Mitigation.md
+85
View File
@@ -0,0 +1,85 @@
\> [!caution] This page contained a drawing which was not converted.
CA will be Windows 2019
Servers, hosted on
existing virtual infrastructure
Version:
ESXi 6.7U3
 
All VMs are on Dell XC6320-6 hardware.
**Root CA CBP-NPE-CA1**
**TNWG01A-V1650**
**Data Center: NDC**
**NPE cert Specs:**
**Key lengths: RSA 2048**
**Signatures: RSA, SHA256**
**Encryption: AES256**
**Crypto Module**
**Validation: FIPS 140-2**
**Web CRL services**
**CBP-EDME-NPE-WES /TNWG01A-V1652**
**CBP-EDME-NPE-WES2 /TNWG01A-V3454**
**ldap:///CN=CBP-EDME-NPE-CA[1-9],CN= TNWG01A-V????,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov**
CBP-EDME-NPE-CA[2-9]
Sub CA's Location NDC
**(8) subordinate Ca's**
- **Issue certs to NPEs for device network Authentication**
- **Certificate Database from Sub CA's will be backed up to server in NDC**
- **CA will host and publish CRL's**
- **CA will provide auto-renewal and auto-enrollment where possible**
(1) Online Enterprise Root CA
- Issues Self-Signed Root Certificate - No DHS/FPKI Trust Anchor
- Issues Subordinate CA Certs for (8) Subordinate CA's
- Defines certificate issuance policy for Subordinate CA's
- Member of AD,CBP.DHS.GOV domain, limiting administrative access
**Two Tier Hierarchy:**
Root CA
Subordinate CA
Web CRL Service
![CBP Internal NPE CA Architecture](Exported%20image%2020250808202551-0.png) ![CBP Internal NPE CA FaultDisaster Mitigation](Exported%20image%2020250808202551-1.png)
Scenario1:
CA and CRL loses connectivity
(Power Failure, Natural Disaster
Hardware Failure
Scenario2:
Corruption of CA database
Scenario3:
O/S Software Update or
Other OS level fault
- Site could be down for up to CRL validity period without negative
effect on network authentication
- Request for new certs will be answered by CA. This is a feature of auto-enrollment
- Evert sub CA database is backed up to a server at NDC
- New VN can be created and CA database restored
- If unavailable CRL request will be handled by LDAP or 2 Web CRL servers
- VM snap shot will be taken prior to installing updates. If any issues are
Detected the server can be restored to its original state
- If corruption of CA server occurs, the server can be rebuilt and the
CA can be restore from backups
Backups/Miker/.trash/Certificate Network Diagram.md
+32
View File
@@ -0,0 +1,32 @@
\> [!caution] This page contained a drawing which was not converted.
![CBP Workstation 1Net WAN IPSECOMVPN Service Provid...](Exported%20image%2020250808202553-0.png)
Web CRL Service - Web site to retrieve certificate revocation lists (CRL's)
TNWG01A-V1652.AD.CBP.DHS.GOV - CBP-EDME-NPE-WES.CBP.DHS.GOV
TNWG01A-V3454.AD.CBP.DHS.GOV - CBP-EDME-NPE-WES2.CBP.DHS.GOV
Server 2022
Web CRL Service - Public Web site to retrieve certificate revocation lists (CRL's)
TGCP01A-V0005.dmz.CBP.DHS.GOV - CBP-EDME-NPE-WES.CBP.DHS.GOV
TGCP01A-V0006.dmz.CBP.DHS.GOV - CBP-EDME-NPE-WES2.CBP.DHS.GOV
OCSP Responder - The OCSP Client is a component that generates OCSP requests based on information stored in the AIA extension of the certificate it is validating.
TNWG01A-V1652.AD.CBP.DHS.GOV - CBP-EDME-NPE-WES.CBP.DHS.GOV
TNWG01A-V3454.AD.CBP.DHS.GOV - CBP-EDME-NPE-WES2.CBP.DHS.GOV
SubCA: Online internal NPE Subordinate Issuing CA / network authentication
TNWG01A-V1651.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA2.CBP.DHS.GOV
TNWG01A-V3455.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA3.CBP.DHS.GOV
TNWG01A-V3456.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA4.CBP.DHS.GOV
TNWG01A-V3457.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA5.CBP.DHS.GOV
TNWG01A-V3453.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA6.CBP.DHS.GOV
TNWG01A-V3452.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA7.CBP.DHS.GOV
TNWG01A-V3567.AD.CBP.DHS.GOV - CBP-EDME-NPE-CA8.CBP.DHS.GOV
Most Servers are running Windows Server 2019
TNWG01A-V1650.AD.CBP.DHS.GOV
CBP-NPE-CA1.CBP.DHS.GOV Online Root internal NPE CA
Issues Root Certificate to self
Issues SubCA to CBP-NPE-EDME-[ CA2 - CA8]
Backups/Miker/.trash/Certutil.md
+16
View File
@@ -0,0 +1,16 @@
| Command | Description |
| --- | --- |
| `certutil -store MY` | List personal certificates |
| `certutil -store ROOT` | List root certificates |
| `certutil -store CA` | List intermediate certificates |
| `certutil -addstore -f "ROOT" new-root-certificate.crt` | Add a root certificate |
| `certutil -delstore "ROOT" serial-number-hex` | Remove a root certificate |
| `certutil -addstore -f "CA" new-intermediate-certificate.crt` | Add an intermediate certificate |
| `certutil -delstore "CA" serial-number-hex` | Remove an intermediate certificate |
| `certutil -addstore -f "MY" new-personal-certificate.pfx` | Add a personal certificate |
| `certutil -delstore "MY" serial-number-hex` | Remove a personal certificate |
| `certutil -dump certificate.crt` | Display certificate information |
| `certutil -encode certificate.crt encoded-certificate.txt` | Encode a certificate |
| `certutil -decode encoded-certificate.txt decoded-certificate.crt` | Decode a certificate |
| `certutil -hashfile file.txt SHA256` | Calculate the SHA256 hash of a file |
Backups/Miker/.trash/Cheat Sheet.md
+46
View File
@@ -0,0 +1,46 @@
# User Management
| | |
|---|---|
|Command|Description|
|sudo adduser \<user\>|Create a new user|
|sudo userdel \<user\>|Delete a user|
|sudo usermod -aG \<group\> \<user\>|Add a user to group|
|sudo deluser \<user\> \<group\>|Remove a user from a group|
# CRON
| | | |
|---|---|---|
|Field|Allowed Values|Description|
|Second|0 - 59|Trigger every SECOND second(s)|
|Minute|0 - 59|Trigger every MINUTE minute(s)|
|Hour|0 -23|Trigger every HOUR hour(s)|
|Day|1 - 31|Trigger every DAY day(s) of month|
|Month|1 - 12|Trigger every MONTH month(s)|
|Doay of Week|0 - 6|MON-SUN Trigger on specific DAY OF WEEK|
# Special Characters
| | |
|---|---|
|Special Character|Description|
|*|Trigger on tick of every time unit|
|,|List separator|
|-|Specifies a range|
|/|Defines an increment|
# Examples
| | |
|---|---|
|Cron Expression|Description|
|0 * * * *|Executes every minute|
|0 0 * * * *|Executes every hour|
|0 0 0 * * *|Executes every day|
|0 0 0 0 * *|Executes every month|
|0 0 0 1 1 *|Executes on first day of Jan each year|
|30 20 * * SAT|Executes at 08:30pm every Saturday|
|30 20 * * 6|Executes at 08:30pm every Saturday|
|0 */5 * * * *|Executes every five minutes|
|0 0 8-10/1 * * *|Executes every hour between 8am and 10am|
Backups/Miker/.trash/CheckMK - Open Source Network, Server, and Machine Monitoring.md
+195
View File
@@ -0,0 +1,195 @@
CheckMK is a network and systems monitoring solution that can span from a small home user's needs into the enterprise with ease. There are many of these solutions out there, and all of them have their pros and cons, but for many of them, the con is that they are complicated to setup, maintain, and keep running.
Thus far, this is where CheckMK seems to be a little different. The setup is pretty straight forward, their documentation is outstanding, and the maintenance of the system seems to be quite easy.
If you've been looking for a monitoring solution for your various devices and networks, then this may just be the solution for you. As always, CheckMK is open source, and available in a free (community / raw) version, but the open source software is supported by the option to have more functionality / capability with their professional and enterprise level offerings as well. So, if you like CheckMK, and think it would be a good fit for your buisness, consider contributin to open source by giving them some business with their paid tiers as well.
What You'll Need
----------------
* Either a Server (I Used and LXC Container on ProxMox) or Docker and Docker-Compose
* If you want to use this across the cloud, then you'll also want a VPN between your various networks, or a domain name that points to the public IP of the network where you'll run CheckMK, and a reverse proxy like NGinX-Proxy-Manager.
* About 20 minutes of your time to get started.
Installation
------------
In order to install CheckMK on Docker, jump down to the "Instlaling On Docker" section below. If you are installing on a regular Linux based server, then keep reading.
There are a pretty basic set of steps to get this installed actually. I used Ubuntu, but if you are using a different base distro, like Fedora, Cnetos, etc, then you can check [their instructions here](https://docs.checkmk.com/latest/en/install_packages.html).
#### Installing on Ubuntu
Make sure you're logged in with a non-root user that has sudo privileges. If you don't know what this means, essentially, make a new user who's not root, then give that user sudo privileges by adding them to the sudo group.
`adduser < your user name >`
Enter the password, and re-type it when prompted.
After completing the `adduser` portion, add the user to the "sudo" group with:
`usermod -aG sudo < your user name >`
Now logout from the root account, and login with your new user account.
If you need to run something with elevated privileges, just put `sudo` in front of the command. You'll be prompted for your user's password occasionally in order to run anything as "sudo".
To find the version for your distro and release (mine is Ubuntu 20.04 LTS), gotto [https://checkmk.com/de/download](https://checkmk.com/de/download) and select through the options down the page to filter down to your needs.
!\[\](http://shownotes.opensourceisawesome.com/content/images/2022/07/image.png)
Below that, you'll find a "wget" command, which is perfect for downloading a package to your server directly when logged in via SSH.
In my case the command is:
`wget https://download.checkmk.com/checkmk/2.1.0p8/check-mk-raw-2.1.0p8_0.focal_amd64.deb`
Once downloaded, we'll install it using the command:
`sudo apt install ./check-mk-raw-2.1.0p8_0.focal_amd64.deb`
Let the installer run, and you should get some output toward the end showing that the system is installed. Afterward, check that it's installed by running:
`omd version`
You should get a version number for the CheckMK you just installed.
Next, you need to create a "Monitoring" site. You can name the site anything, but we'll stick with what their documentation says, and call it "monitoring":
`omd create monitoring`
Note, you may need `sudo` for this step.
Once the monitoring site is created, you'll get a default user of `cmkadmin`, and a password that is autogenerated. Make sure to copy the password somewher so you don't lose it. You can change it via the web ui later.
Now, we need to start our site into a running state.
`omd start monitoring`
Again, you may need to use `sudo` in front of that command.
You should see output similar to this:
```
Starting mkeventd...OK
Starting liveproxyd...OK
Starting mknotifyd...OK
Starting rrdcached...OK
Starting cmc...OK
Starting apache...OK
Starting dcd...OK
Starting redis...OK
Initializing Crontab...OK
```
You should now be able to access your CheckMK server via your favorite modern web browser at the IP address of your host system, and the location /cmk:
`http://192.168.10.42/cmk` was the address I used.
### Installing on Docker
If you are like me, and you prefer to containerize anything and everything due to the simplicity of upkeep, updates, and maintenance, then you'll be more interested in running CheckMK in docker. I went through their instructions, and took a bit from here and there, and decied I wanted to create a nice docker-compose file instead of using their docker run, so that'what we'll be using. Before that, a quick section on installing Docker and Docker-Compose if you don't already have it. If you do, then skip down to the 'Installing CheckMK in Docker' secton below.
### Installing Docker-CE and Docker-Compose
If you already have Docker and Docker-Compose installed, feel free to skip down to the next section.
You may want to install some pre-requisite softwre as well:
Debian / Ubuntu
`sudo apt install git curl wget`
Fedora / Redhat
`dnf install git curl wget`
Arch
`sudo pacman -Sy git curl wget`
You can easily install Docker-CE, Docker-Compose, Portainer-CE, and NGinX Proxy manager by using this quick install script I created and maintain on Github. Just use the command:
`wget <a href="https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh">https://gitlab.com/bmcgonag/docker_installs/-/raw/main/install_docker_nproxyman.sh</a>`
To download the script to your desired host.
Change the permissios to make the script executable:
`chmod +x ./install_docker_nproxyman.sh`
and then run the script with the command:
`./install_docker_nproxyman.sh`
When run, the script will prompt you to select your host operating system, then will ask you which bits of software you want to install.
Simply enter 'y' for each thing you want to install.
For instance, you may want to answer 'y' to NGinX Proxy Manager, and Portainer-CE if you don't already use these in your system.
At some point, you'll be asked for your super user (sudo) password as well.
Allow the script to complete installation.
At this point, you might want to log out and back in, as this will allow you to use the `docker` and `docker-compose` commands without the need of `sudo` in front of them.
### Installing CheckMK on Docker
I like to keep all of my docker containers in a certain folder structure. Make a "docker" folder, then inside that make a new "checkmk" folder.
`mkdir -p docker/checkmk`
Next, move into the checkmk folder we just created, and make a new file called "docker-compose.yml"
`cd docker/checkmk`
`nano docker-compose.yml`
Now paste the contents of the code-block below into that file:
```
version: '3.3'
services:
check-mk-raw:
ports:
- '8080:5000'
tmpfs: '/opt/omd/sites/cmk/tmp:uid=1000,gid=1000'
volumes:
- './monitoring:/omd/sites'
- '/etc/localtime:/etc/localtime:ro'
container_name: monitoring
restart: always
image: 'checkmk/check-mk-raw:2.0.0-latest'
```
You may want to change the left side of the port mapping in the file from 8080 to another port if 8080 is already in use on your host machine. Remember to only change the left side, leave the 5000 alone.
When done, save the file with CTRL + O, press Enter to confirm, and then exit the nano text editor with CTRL + X.
Now, we'll pull down CheckMK and start the container with the command:
`docker-compose up -d && docker-compose logs -f`
This command starts the container running first, then shows us log outpu as the container is started. We can watch for any startup errors.
Additionally, by watching the logs, we can see the admin username `cmkadmin` and the default password create for our admin user in the logging. We'll need this to login for the first time.
As long as htere are no errors you can get out of the logs view with CTRL + C.
Now, go to your host machine's IP and port 8080 (unless you changed it in the docker-compose file above, then use the port you set).
I used `http://192.168.10.112:8080`.
Now log in, and get ready to setup your Folders and host machines.
For more on how to setup a host machine (client) and the folder structure see the CheckMK docs as well as the video linked at this top of this post.
Support my Channel and Content
------------------------------
Support my Channel and ongoing efforts through Patreon:
[https://www.patreon.com/bePatron?u=234177](https://www.patreon.com/bePatron?u=234177)
Backups/Miker/.trash/Chezmoi.md
+31
View File
@@ -0,0 +1,31 @@
Now, just remember to always edit your dotfiles templates. Chezmoi give you some helpers:
   chezmoi cd # will cd you to the dotfiles repo directory to edit files, or use;
   chezmoi edit ~/.zshrc # will open the template in your editor
Whenever you change the template or the data file, just update everything:
   chezmoi update
push the changes to your repo:
   chezmoi cd
   git add .
   git commit -m "Update dotfiles"
   git push
If you create new dotfiles, let's say you started to use Fish, then don't forget to add it to Chezmoi like this:
   chezmoi add --autotemplate ~/.fishrc
You can use the convenience script to install the dotfiles on any machine with a single command. Simply run the following command in your terminal:
   export GITHUB\_USERNAME=mmcfetridge1969
   sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply $GITHUB\_USERNAME
Apply will install all the dependencies and add files to your $HOME.
   chezmoi apply
Update - From time to time, start the update simply with:
   chezmoi diff
   chezmoi update
Backups/Miker/.trash/Chocolatey.md
+16
View File
@@ -0,0 +1,16 @@
Package Management
------------------
| Command | Description |
| --- | --- |
| `choco install <package>` | Install a package |
| `choco uninstall <package>` | Uninstall a package |
| `choco upgrade <package>` | Upgrade a package |
| `choco list -lo` | List installed packages |
| `choco search <string>` | Search for a package |
| `choco outdated` | List outdated packages |
| `choco upgrade all` | Upgrade all packages |
| `choco pin <package>` | Pin a package to prevent upgrades |
| `choco outdated --local-only` | List outdated packages installed locally |
| `choco upgrade all --local-only` | Upgrade all packages installed locally |
Backups/Miker/.trash/Cisco Any Connect.md
+7
View File
@@ -0,0 +1,7 @@
**Daniel Deguefu**
Network Engineer
Network Operations Division
DHS  |  CBP  |  ES  |  OIT  |  ENTSD
Work: [703-921-6012](tel:703-921-6012)
Mobile: [703-409-5094](tel:703-409-5094)
[daniel.d.deguefu@cbp.dhs.gov](mailto:daniel.d.deguefu@cbp.dhs.gov)
Backups/Miker/.trash/Civo.md
+41
View File
@@ -0,0 +1,41 @@
Instances
---------
| Command | Description |
| --- | --- |
| `civo instance ls` | List instances |
| `civo instance show <instance>` | Show instance details |
| `civo instance create <hostname>` | Create a new instance |
| `civo instance firewall <hostname> <firewall>` | Set firewall for instance |
| `civo instance password` | Show instance's default password |
| `civo instance public-ip` | Enable/disable controls if instance should have a public IP |
| `civo instance reboot <hostname>` | Hard reboot an instance |
| `civo instance remove <hostname>` | Remove/delete instance |
| `civo instance size` | List instances size |
| `civo instance soft-reboot` | Soft reboot an instance |
| `civo instance start` | Start an instance |
| `civo instance stop` | Stop an instance |
| `civo instance tag` | Change the instance's tags |
| `civo instance update` | Change the instance |
| `civo instance upgrade` | Upgrade an instance |
### Instance Creation Flags
| Flag | Description |
| --- | --- |
| `--size`, `-i` | Size of the instance |
| `--diskimage`, `-t` | Disk image to use |
| `--public-ip`, `-p` | Enable a public IP |
| `--firewall`, `-l` | Firewall to apply |
| `--region` | Region to create the instance in |
| `--ssh-key`, `-k` | SSH key to add to the instance |
| `--wait`, `-w` | Wait for the instance to be created |
### Query Disk Images Sizes
| Command | Description |
| ------------------------------ | ------------------------ |
| `civo diskimage ls` | List disk images |
| `civo diskimage find <string>` | Find disk images by name |
| `civo size ls` | List sizes |
Backups/Miker/.trash/Configuration AD GPO SCRIPTS.md
+243
View File
@@ -0,0 +1,243 @@
STARTUP SCRIPTS
_Admin_log_setup_v10.exe_
1. Location: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\AdminLog](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\AdminLog)”
2. GPO:
1.  “CBP DOMAIN POLICY”
3.  Links:
1. Root of Domain.
4.  Function:
1. This startup script checks a registry setting to see if the “Admin_Log_Vx.exe” script is the right version. It sets a registry setting in “HKLM\Software\Microsoft\Windows\CurrentVersion\Run ‘logging’”  to match the correct version of “Admin_Log_Vx.exe”. This way the script “Admin_Log_Vx.exe” runs when the user logs on to the workstation.
 
_BESClient_V2.EXE_
1. A. Location:  “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\BigFix\Nsis](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\BigFix\Nsis)”
2. B.  GPO:
1. a. "CBP DOMAIN POLICY"
3. C. Links:
1. a. Root of Domain
4. D. Function:
1. a. To install the Big Fix Client on XP workstations.
_Cbp-Default_S2_4.exe_
A.      Location:  “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Startup\](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Startup\)”
B.      GPO:
a.       “CBP DOMAIN POLICY”
C.      Links:
a.       Root of Domain
D.      Function:
a.       Slow Link fix for GPO by changing a registry setting.
b.      Removes “WININIT.INI” file if larger than 1K
 
 
 
**AdminRefresh_Vx.x.exe**
A.      Location: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\ServerScripts\AdminRefresh\NSIS](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\ServerScripts\AdminRefresh\NSIS)”
B.      GPO: 
a.       “Auto Updates & Rights”
b.   "Field Program Applications"
 
C.      LINKS:
a.       “Server Farm”  OU
b.      “Exchange Servers” OU
c.   Field Program Applications OU
D.      Function:
a.       To change and enforce the password for the local administrator account on the servers.
b.    Populates the local Admin group with the WSG security group SG-SERVER-ADMIN
c.    Deletes the x86ad local account
 
**PreProdAdminRefresh_V1.0.exe**
A.      Location:“\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\ServerScripts\AdminRefresh\NSIS”
B.      GPO:  “PREPRODUCTION OU BASE”
C.      LINKS:  “PreProduction”  OU
D.      Function: Populates the local Admin group with the following AD security groups SG-SERVER-ADMIN, SG-ST&E-ADMINS, SG-WPET-ADMINS
 
**Pride_Admin.exe**
A.      Location:   “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Pride](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Pride)”
B.      GPO:
a.       “PRIDE ADMIN”
C.      LINKS:
a.       “TASPO PRIDE” OU.
D.      Function:
a.       Adds “ad\sg-server-admin” group to the local administrators group of PRIDE Servers.
b.      Adds “ad\sg-Pride-admin” group to the local administrators group of PRIDE Servers.
**WSG_Server_Contacts_V2.exe**
A.      Location:  [\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\](file:///\\ad.cbp.dhs.gov\wsg\WSG%20SCRIPT%20REPOSITORY\Active%20Directory\)startup”
B.      GPO:
a.        Auto Update - StageOnly DCO WSUS
b.      Auto Update - AutoReboot DCO WSUS
c.       Auto Update- AutoReboot CBP WSUS
d.      Auto Update - StageOnly CBP WSUS
C.      Links:
a.       Domain Controller Staging
b.      Domain Controllers
c.       Sites
d.      VLC
e.      ECP Servers
f.        ICAD
g.       Exchange Servers
h.      Production
i.         DCMETRO Servers
j.        PreProduction
D.      Function:
a.       This script populates the registry with WSG contact and Server Info to help SCOM dynamically add to groups.        
b.      This will be removed/replaced when we are able to have SCOM run this script twice a day.
 
**Admin_Log_Setup_V10.exe**
A.      Location:  [\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\](file:///\\ad.cbp.dhs.gov\wsg\WSG%20SCRIPT%20REPOSITORY\Active%20Directory\)AdminLog”
B.      GPO:
a.        Admin Log
C.      Links:
a.       XP-Mockup
D.      Function:
a.       Check and install Admin_Log.exe
 
**Sessmgr.exe**
A.      Location:  File is part of the GPO
B.      GPO:
a.        BigFix Remote Access
C.      Links:
a.       Ad.cbp.dhs.gov
b.      Windows 7
c.       XP-Mockup
D.      Function:
a.       To help resolve an issue with Remote Assistance running for workstations.
 
**AuditDomainPolicy.cmd**
A.      Location:  “[\\ad.cbp.dhs.gov\Netlogon](file:///\\ad.cbp.dhs.gov\Netlogon)”
B.      GPO:
a.        Domain Controller Policy V1.0
C.      Links:
a.       Domain Controllers
D.      Function:
a.       To  apply a more granular audit settings to the Windows 2008 Domain Controllers.
b.      This script copy’s a cmd called ApplyDomainAuditPolicy.cmd to the server and schedules a task that copy’s a txt file called DomainServer.txt (all in the same location as above). Then runs auditpol.exe against the DomainServer.txt file.
SHUTDOWN SCRIPTS
 
**491SP5_V16.EXE**
A.      LOCATION: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\) Novell\Novell Client Update”
B.      GPO:
a.       “NOVELL 4912P5 UPDATE”
C.      LINKS:
a.        “All Region OU’s”
D.      FUNCTION:
a.       Check the version of Novell Client on workstations. If current it cleans up and exits. If not current, it copies the zip package over, unzips the package and installs the new Novell Client.
 
**ProfileClean10Day.exe**
A.      LOCATION: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Profile Cleanup\](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Profile Cleanup\)”
B.      GPO:
a.       “PROFILE CLEANUP 10 DAYS”
C.      LINKS:
a.       “WLN005A WORKSTATIONS” OU.
b.      “YMA016A WORKSTAIONS” OU.
D.      FUNCTION:
a.       Deletes user profiles on the local workstation that are older than 10 days.
 
**SCREENSAVE_V19.EXE**
A.      LOCATION: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\CBP-Default\](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\CBP-Default\)”
B.      GPO:
a.       “SCREEN SAVER POLICY”
C.      LINKS:
a.       “DOMAIN LEVEL”
b.      “LOS007N” OU
c.       “ALL BLOCKED OU’S”
D.      FUNCTION:
a.       To enable and control screen saver execution time out on workstations. To allow for exceptions and to be able to change the time of timeout settings for certain workstations.
b.   Checks in with TNWG01A466\ADEX DBO.CBP_SCREEN_SAVER
 
 
**UPHClean.exe**
A.      Location: “  [\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\](file:///\\ad.cbp.dhs.gov\wsg\WSG%20SCRIPT%20REPOSITORY\Active%20Directory\)
B.      GPO:
a.        UPHClean
C.      Links:
a.       AD.CBP.DHS.GOV
b.      WSG Workstations
D.      Function:
a.       This GPO and shutdown script is used to clean the user profile from known items that cause delays loading and unloading the user hive.  Runs on shutdown.
 
LOGON SCRIPTS
 
**CBP-Default_L2_19.exe**
A.      LOCATION:  “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\)”
B.      GPO:
a.        CBP DOMAIN POLICY
C.      LINKS:
a.       “ROOT OF DOMAIN”
D.      FUNCTION:
a.       To record/log workstation settings for Office, Outlook, Outlook Archive, Screen Saver settings, Novell Client Version.
 
**Outlook-GC-V1.0.exe**
A.      Location: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\Outlook](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\Outlook)”
B.      GPO:
a.        CBP Domain Policy
b.      CBP-Outlook-Closest-GC
C.      Links:
a.       Ad.cbp.dhs.gov
b.      XP-Mockup
D.      Function:
a.       To set a registry setting on all workstations to set it to point to their closest Global Catalog as part of the Exchange Provider.
 
**CBP-Zone-V1.5.exe**
A.      Location: “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\CBP-Zone](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\CBP-Zone)”
B.      GPO:
a.        CBP-Zone-For XP Users
C.      Links:
a.       Ad.cbp.dhs.gov
b.      GPO Block
c.       XP-IE8
d.      XP-Mockup
D.      Function:
a.       To set IE zone map settings to users running non-vista workstations.
b.        WriteRegStr HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\*.cbp" "Default" ""
c.            WriteRegDWORD HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\*.cbp" "http" 0x00000002
d.           WriteRegDWORD HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\*.cbp" "https" 0x00000002
e.           WriteRegDWORD HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\cbpnetsecure.cbp" "https" 0x00000001
 
**CBP-Zone-V2.0.exe**
A.      Location:  “[\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\CBP-Zone](file:///\\ad.cbp.dhs.gov\wsg\WSG SCRIPT REPOSITORY\Active Directory\Logon\CBP-Zone)”
B.      GPO:
a.        CBP-Zone-For IE 8 Users
C.      Links:
a.       Ad.cbp.dhs.gov
D.      Function:
a.       To set IE zone map settings to users running IE 8:
b.      WriteRegStr HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov" "Default" ""
c.       WriteRegStr HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\*.cbp" "Default" ""
d.      WriteRegDWORD HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\*.cbp" "http" 0x00000001
e.      WriteRegDWORD HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\*.cbp" "https" 0x00000001
f.        WriteRegDWORD HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dhs.gov\cbpnetsecure.cbp" "https" 0x00000001
TestNet_V6.exe  -  This is a diagnostic script to determine if users have correct permission to net.exe command. Only reports data. (WFP requested this information to assist in migration effort)
 
ListNetDrives_V1.exe -  This is a script that documents users network drives. Only reports data.  (WFP requested this information to assist in migration effort)
SIMILAR SCRIPTS USED FOR TESTING IN THE FDCC TEST OU
 
1. GPO: “TEST-FDCC CBP STARTUP SCRIPTS”
2. LINKS: “XP-IE7”
3. SCRIPTS:
1. ADMIN_LOG_SETUPB.EXE (Startup)
2. CBP-DEFAULT_S1_5.EXE (Startup)
3. SG-SERVER-ADMIN_V01.EXE (Startup)
4. ADMINREFRESH_V1.1.EXE (Startup)
5. CBP-DEFAULT_L1_10.EXE (Logon)
SCRIPTS THAT ARE NOT BEING USED
 
1.       AdminRefresh_V1.2.exe (AUTO UPDATES 1, NO LINKS)
2.       AdminRefresh_V1.2.exe (AUTO UPDATES 2, NO LINKS)
3.       ADMINREFRESH_V1.3.EXE (WSG-TEST-ADMIN-REFRESH,  NO LINKS)
4.       PACKAGE_WRKST_MESS_V1_1.EXE (WORKSTATION_NAME_MISMATCH,  NO LINKS)
5.       ADMINREFRESH_V1.3.EXE (WSG-TEST-ADMIN-REFRESH,  NO LINKS)
6.       PRINTERS.BAT (WSG TEST PRINTER DRIVER)
7.       CBP-CIPHER-DISABLE-BACKUP.EXE (RDP (BACK OUT),  SERVER FARM)
 
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/AD%20GPO%20SCRIPTS.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/AD%20GPO%20SCRIPTS.aspx)\>
Backups/Miker/.trash/Configuration AD Trust with DSA.DHS.md
+24
View File
@@ -0,0 +1,24 @@
The CBP AD domain has a 2 way external trust setup with the DSA.DHS domain (Appauth domain).
The trust relies on communication with the following AD domain controllers. If the PDC FSMO roll has to be moved it can only be moved at this time to one of the domain controllers listed below.
 
DOMAIN CONTROLLERS
DC name                              IP Address
TCKV05A-P0014                10.239.168.209
TCKV05A-P0015                10.239.168.210
TCKV05A-P0016                10.239.168.211
TCKV05A-P0017                10.239.168.212
TCKV05A-P0018                10.239.168.213
TCKV05A-P0019                10.239.168.214
TNWG01A-P0121             10.5.113.100
TNWG01A-P0124             10.5.113.103
TNWG01A-P0126             10.5.113.105
TNWG01A-P0127             10.5.113.106
TSSC05A-V0013                 10.16.71.42
TSSC05A-V0014                 10.16.71.43
TSSC05A-V0015                 10.16.71.44
TSSC05A-V0016                 10.16.71.45
TSSC05A-V0017                 10.16.71.46
TSSC05A-V0018                 10.16.71.47
**CONTACT INFORMATION FOR DSA.DHS**
Whenever you plan on updating/modifying the listed DCs please send an email to our distro group AppAuth_Distro@hq.dhs.gov so everyone on the AppAuth team sees the request. Contact for this information was Abbrahim Beg.
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/AD%20Trust%20with%20DSA.DHS.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/AD%20Trust%20with%20DSA.DHS.aspx)\>
Backups/Miker/.trash/Configuration Access.md
+16
View File
@@ -0,0 +1,16 @@
Please request access through Sailpoint
[SailPoint IdentityIQ - Home (dhs.gov)](https://cbpidentity.cbp.dhs.gov/identityiq/home.jsf)
 
**Requesting Access**
 
Click on the EDME WSG Application Tile (you can search WSG to find the tile instead of scrolling)
Select the Role ”**SG-WSG ADEX DB READONLY”,**
Next
Provided Business need for that access in the required Comments
Click submit
 
The request will go through the Approval process, and access will be granted when completed
You will receive email notifications of the approval process
 
![Exported image](Exported%20image%2020250808202405-0.jpeg)
Backups/Miker/.trash/Configuration Add SAT user 2.md
+48
View File
@@ -0,0 +1,48 @@
**SAT User Provisioning and Server Access**
**STOP: SAT Accounts should not be manually created**
SAT user accounts should be provisioned through the ADEX Tool [HERE](https://adex.cbp.dhs.gov/WSG-Forms/SAT/SAT_Account_Provisioning.cfm)
SAT Server access is granted to user accounts through Security Groups and enforced by Group Policy
IT IS NOT granted by adding users to the Local Admin groups of servers. If added directly to These Local groups, the accounts will get removed during the next GPO processing.
 
SAT Provisioning tool
You Use this tool to Both Create and ADD users to Security groups
1. Enter the HASH ID of the USER
2. Click "Lookup User Info" This gathers User Info in AD 
3. Select a Program Office from the drop down. This is the location the account(s) will go into
4. Place a check in the Accounts to be created . Regular account always created, you need to place check in the Admin (default is blank). If the Accounts already exist, creation options will not be presented
5. Click "LookUp Security Groups"
- Based on the Program Office chosen, a listing of available Security groups will be presented
- SAT\SG-*****-Server-AdminsSAT\SG-*****-Server-Users
6. Place a check mark in the groups to be added
- "What Groups do I add them too".. See below in "Security Groups and GPOs"
7. Click "Process" Allow 5 Minutes to take affect
![SPT2jpg](Exported%20image%2020250808202138-0.jpeg)
 
Security Groups and GPOs
When adding a user to security groups, you first need to know what servers the Security Groups grant access to. A future version of the App tool may enumerate those servers, but for now, the process is two-fold
1. Look up the Server object in the SAT Domain in ADUC, identify its OU location
2. Open Group Policy manager, look at that OU, and inspect the GPO that is being used for Server Access, and that will show you the Security groups.
![GPOexampljpg](Exported%20image%2020250808202142-1.jpeg)
 
The Security groups are created in the "Program Office" sub OU under "AccessControl\Groups Security\"
These are the Groups that are presented during the use of the SAT Provisioning tool, by the program office selected.
![SGsjpg](Exported%20image%2020250808202143-2.jpeg)
**My server isn't inheriting a "Server Access :****" GPO**
Security groups will need to be created in the Correct program Office OU location and named following the naming standards
SAT\SG-*****-Server-Admins
SAT\SG-*****-Server-Users
A GPO must be Created and linked to the OU the server resides in 
**STOP..** GPO's are inherited by all member Servers in that OU
If you are not 100% confident on the proper way to create a GPO or understand its effect on the servers that will inherit, contact a senior member of the WSG Staff to instruct or assist.
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx)\>
Backups/Miker/.trash/Configuration Add SAT user.md
+48
View File
@@ -0,0 +1,48 @@
**SAT User Provisioning and Server Access**
**STOP: SAT Accounts should not be manually created**
SAT user accounts should be provisioned through the ADEX Tool [HERE](https://adex.cbp.dhs.gov/WSG-Forms/SAT/SAT_Account_Provisioning.cfm)
SAT Server access is granted to user accounts through Security Groups and enforced by Group Policy
IT IS NOT granted by adding users to the Local Admin groups of servers. If added directly to These Local groups, the accounts will get removed during the next GPO processing.
 
SAT Provisioning tool
You Use this tool to Both Create and ADD users to Security groups
1. Enter the HASH ID of the USER
2. Click "Lookup User Info" This gathers User Info in AD 
3. Select a Program Office from the drop down. This is the location the account(s) will go into
4. Place a check in the Accounts to be created . Regular account always created, you need to place check in the Admin (default is blank). If the Accounts already exist, creation options will not be presented
5. Click "LookUp Security Groups"
- Based on the Program Office chosen, a listing of available Security groups will be presented
- SAT\SG-*****-Server-AdminsSAT\SG-*****-Server-Users
6. Place a check mark in the groups to be added
- "What Groups do I add them too".. See below in "Security Groups and GPOs"
7. Click "Process" Allow 5 Minutes to take affect
![SPT2jpg](Exported%20image%2020250808202223-0.jpeg)
 
Security Groups and GPOs
When adding a user to security groups, you first need to know what servers the Security Groups grant access to. A future version of the App tool may enumerate those servers, but for now, the process is two-fold
1. Look up the Server object in the SAT Domain in ADUC, identify its OU location
2. Open Group Policy manager, look at that OU, and inspect the GPO that is being used for Server Access, and that will show you the Security groups.
![GPOexampljpg](Exported%20image%2020250808202224-1.jpeg)
 
The Security groups are created in the "Program Office" sub OU under "AccessControl\Groups Security\"
These are the Groups that are presented during the use of the SAT Provisioning tool, by the program office selected.
![SGsjpg](Exported%20image%2020250808202224-2.jpeg)
**My server isn't inheriting a "Server Access :****" GPO**
Security groups will need to be created in the Correct program Office OU location and named following the naming standards
SAT\SG-*****-Server-Admins
SAT\SG-*****-Server-Users
A GPO must be Created and linked to the OU the server resides in 
**STOP..** GPO's are inherited by all member Servers in that OU
If you are not 100% confident on the proper way to create a GPO or understand its effect on the servers that will inherit, contact a senior member of the WSG Staff to instruct or assist.
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx)\>
Backups/Miker/.trash/Configuration CDS Privileged access Process (WSG) 2.md
+52
View File
@@ -0,0 +1,52 @@
**CDS Privileged access**
 
New Privileged User provisioning process
-M accounts are provisioned by the TSD following the Privileged User Account request
               The Account provisioning does not grant Privileged access, just creates the account
               Privilege Access to CDS Roles are below
 
-0 Accounts are provisioned as\if needed by WSG via a Windows Privileged Access Request in Service Now
                              Approved by Gov Lead (Mike Mcfetridge)
                              Approved by CDS ISSO
 
**Tier-0 CDS Privileged Access**
               **Domain Admin**
                              Restricted to Tier-0 independent Accounts (hashid-0)
                                             Only WSG members have Tier-0 Accounts
                              Persistent 5 members Allowed-Restricted to 5 WSG Senior Staff
                              WSG staff are added\removed on a weekly basis for 24/7 On Call support
                             
                              Persistent membership is obtained through a ServiceNow Privileged access request
                              Approved by Gov Lead (Mike Mcfetridge)
                              Approved by CDS ISSO
 
 
               **Enterprise Admin**
                              No persistent members- Only Tier-0 Accounts permitted
                              Tier-0 Accounts added\removed as needed to perform Tasks on business need
                              Only the 5 WSG Senior Staff members in Domain Admins have the ability to add\remove
                                                           
               **Schema Admin**
                              No persistent members- Only Tier-0 Accounts permitted
                              Tier-0 Accounts added\removed as needed to perform tasks on business need
                              Only the 5 WSG Senior Staff members in Domain Admins have the ability to add\remove
 
**Tier-1 CDS Privileged Access**
               **SG-DomainCtrl-ReadOnly**
                              Restricted to Windows Service Group Employees
               **SG-WSG-ADMIN** 
                              Restricted to Windows Service Group Members)
              
               Requested via Sailpoint [https://cbpidentity.cbp.dhs.gov/](https://cbpidentity.cbp.dhs.gov/)
               Approval process is done via Email through sailpoint notifications
                              User Supervisor Approves
                              CDS Tier-O Approvers in EDMED_WSG_PROD_APP-APPROVER (5 WSG Senior Staff)
 
**Terminations**
            Off Boarding and Termination of Access is done by the CSD\IDM Team via Sailpoint Separation process
               Upon Separation, Sailpoint disables Active Directory User Objects and have all Group roles removed from the account privileged account
               See CSD\IDM for more information
 
 
**Account deletions**
               Active Directory has an automated process that deletes accounts after 90 days of inactivity
Backups/Miker/.trash/Configuration CDS Privileged access Process (WSG).md
+52
View File
@@ -0,0 +1,52 @@
**CDS Privileged access**
 
New Privileged User provisioning process
-M accounts are provisioned by the TSD following the Privileged User Account request
               The Account provisioning does not grant Privileged access, just creates the account
               Privilege Access to CDS Roles are below
 
-0 Accounts are provisioned as\if needed by WSG via a Windows Privileged Access Request in Service Now
                              Approved by Gov Lead (Mike Mcfetridge)
                              Approved by CDS ISSO
 
**Tier-0 CDS Privileged Access**
               **Domain Admin**
                              Restricted to Tier-0 independent Accounts (hashid-0)
                                             Only WSG members have Tier-0 Accounts
                              Persistent 5 members Allowed-Restricted to 5 WSG Senior Staff
                              WSG staff are added\removed on a weekly basis for 24/7 On Call support
                             
                              Persistent membership is obtained through a ServiceNow Privileged access request
                              Approved by Gov Lead (Mike Mcfetridge)
                              Approved by CDS ISSO
 
 
               **Enterprise Admin**
                              No persistent members- Only Tier-0 Accounts permitted
                              Tier-0 Accounts added\removed as needed to perform Tasks on business need
                              Only the 5 WSG Senior Staff members in Domain Admins have the ability to add\remove
                                                           
               **Schema Admin**
                              No persistent members- Only Tier-0 Accounts permitted
                              Tier-0 Accounts added\removed as needed to perform tasks on business need
                              Only the 5 WSG Senior Staff members in Domain Admins have the ability to add\remove
 
**Tier-1 CDS Privileged Access**
               **SG-DomainCtrl-ReadOnly**
                              Restricted to Windows Service Group Employees
               **SG-WSG-ADMIN** 
                              Restricted to Windows Service Group Members)
              
               Requested via Sailpoint [https://cbpidentity.cbp.dhs.gov/](https://cbpidentity.cbp.dhs.gov/)
               Approval process is done via Email through sailpoint notifications
                              User Supervisor Approves
                              CDS Tier-O Approvers in EDMED_WSG_PROD_APP-APPROVER (5 WSG Senior Staff)
 
**Terminations**
            Off Boarding and Termination of Access is done by the CSD\IDM Team via Sailpoint Separation process
               Upon Separation, Sailpoint disables Active Directory User Objects and have all Group roles removed from the account privileged account
               See CSD\IDM for more information
 
 
**Account deletions**
               Active Directory has an automated process that deletes accounts after 90 days of inactivity
Backups/Miker/.trash/Configuration ColdFusion 2018 Installation and Setup.md
+248
View File
File diff suppressed because one or more lines are too long
Backups/Miker/.trash/Configuration ColdFusion 2023.md
+97
View File
@@ -0,0 +1,97 @@
![Exported image](Exported%20image%2020250808202410-0.png) ![Exported image](Exported%20image%2020250808202414-1.png) ![Exported image](Exported%20image%2020250808202414-2.png) ![Exported image](Exported%20image%2020250808202415-3.png) ![Exported image](Exported%20image%2020250808202416-4.png) ![Exported image](Exported%20image%2020250808202416-5.png) ![Exported image](Exported%20image%2020250808202417-6.png) ![Exported image](Exported%20image%2020250808202418-7.png) ![Exported image](Exported%20image%2020250808202421-8.png) ![Exported image](Exported%20image%2020250808202422-9.png)
**tasb30a-v0048.ad.cbp.dhs.gov \WSG1,64078 - NEW ADEX in EQUINIX**
**Setup IIS**
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebServerRole
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebServer
Enable-WindowsOptionalFeature -Online -FeatureName IIS-CommonHttpFeatures
Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpErrors
Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpRedirect
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ApplicationDevelopment
Enable-WindowsOptionalFeature -online -FeatureName NetFx4Extended-ASPNET45
Enable-WindowsOptionalFeature -Online -FeatureName IIS-NetFxExtensibility45
Enable-WindowsOptionalFeature -Online -FeatureName IIS-HealthAndDiagnostics
Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpLogging
Enable-WindowsOptionalFeature -Online -FeatureName IIS-LoggingLibraries
Enable-WindowsOptionalFeature -Online -FeatureName IIS-RequestMonitor
Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpTracing
Enable-WindowsOptionalFeature -Online -FeatureName IIS-Security
Enable-WindowsOptionalFeature -Online -FeatureName IIS-RequestFiltering
Enable-WindowsOptionalFeature -Online -FeatureName IIS-Performance
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebServerManagementTools
Enable-WindowsOptionalFeature -Online -FeatureName IIS-IIS6ManagementCompatibility
Enable-WindowsOptionalFeature -Online -FeatureName IIS-Metabase
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ManagementConsole
Enable-WindowsOptionalFeature -Online -FeatureName IIS-BasicAuthentication
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WindowsAuthentication
Enable-WindowsOptionalFeature -Online -FeatureName IIS-StaticContent
Enable-WindowsOptionalFeature -Online -FeatureName IIS-DefaultDocument
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebSockets
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ApplicationInit
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ISAPIExtensions
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ISAPIFilter
Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpCompressionStatic
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ASPNET45
![Exported image](Exported%20image%2020250808202423-10.png)
![Exported image](Exported%20image%2020250808202424-11.png)
**Copy ADEX web files to d:\data\ADEX**
**Create Data source**
- ==Edit the DSN and select== _Show Advanced Settings_ ==\>== _Connection String_==. Then enter== ==AuthenticationMethod=Type2== ==and save.==
- ==Leave the== ==username== ==and== ==password== ==fields blank== \> From \<[https://stackoverflow.com/questions/43612373/how-do-i-setup-a-coldfusion-datasource-properly-for-a-sql-server-database-throug](https://stackoverflow.com/questions/43612373/how-do-i-setup-a-coldfusion-datasource-properly-for-a-sql-server-database-throug)\>
Data & Services \> Datasource
| | | | | | | |
|---|---|---|---|---|---|---|
|Type|CF Data Source Name|Database|Server|Port|User Name|Password|
|**Microsoft SQL Server :**|ADEX_DSN|ADEX|tasb30a-v0048\wsg1||||
|**Microsoft SQL Server :**|ADEX_Web|ADEX|tnwg01a-p0657\wsg1||||
|**Microsoft SQL Server :**|DMZ_Provisioning|ADEX|TNWG01A-V1983.DMZ.CBP.DHS.GOV|64088|DMZ\SVC-ADEX-Provision||
|**Microsoft SQL Server :**|OperationsManager|OperationsManager|tnwg01a-p0664\wsg1||||
|**Microsoft SQL Server :**|OperationsManagerDW|OperationsManagerDW|tnwg01a-p0665\wsg1||||
|**Microsoft SQL Server :**|PowerShell|Master|tnwg01a-p0657\wsg1||||
|**Microsoft SQL Server :**|PS|Master|tnwg01a-p0657\wsg1||||
|**Microsoft SQL Server :**|SAT_Provisioning|Orchestrator|tnwg01a-v1322.sat.cbp.dhs.gov\wsg1||SVC-ADEX-Provisioning||
|**Microsoft SQL Server :**|SCCM-CAS|CM_WSG|TNWG01A-V0980\WSG1||||
|**Microsoft SQL Server :**|SCCM-P01-SUSDB|SUSDB|tnwg01a-v0980\wsg1||||
|**Microsoft SQL Server :**|**DMGCONFIGMGR**|CM_SM2|TNWG01A-P0869\DMGCONFIGMGR||||
![Exported image](Exported%20image%2020250808202424-12.png)
![[tasb30a-v0048serversettings.pdf]]
![[tasb30a-v0048serversettings 1.pdf]]
SQL Scheduled Jobs
Process WSG SCOM Config Version 1/29/2021
Owner: AD\SVC-ColdFusion-App
D:\Data\ProcessSCOMconfig\ProcessCBP_Custom_Configuration-ODBC-V01-29-2021.exe
![Exported image](Exported%20image%2020250808202429-15.png)
![Exported image](Exported%20image%2020250808202430-16.png)
D:\Data\ProcessSCOMconfig\ProcessAlerts-ODBC_V01-29-2021.exe
![Exported image](Exported%20image%2020250808202431-17.png)
![Exported image](Exported%20image%2020250808202431-18.png)
![Exported image](Exported%20image%2020250808202432-19.png)
![Exported image](Exported%20image%2020250808202433-20.png)
![Exported image](Exported%20image%2020250808202433-21.png)
![Exported image](Exported%20image%2020250808202426-14.png)
\> From \<[https://stackoverflow.com/questions/43612373/how-do-i-setup-a-coldfusion-datasource-properly-for-a-sql-server-database-throug](https://stackoverflow.com/questions/43612373/how-do-i-setup-a-coldfusion-datasource-properly-for-a-sql-server-database-throug)\>
Run Web Server Configuration Tool ==(creates Virtual Directories in Yellow)==
| | | |
|---|---|---|
|WSG|D:\Data\ADEX\Utilities|Pass-through|
|MyLogs|[\\tnwg01a-v3824\logs](file:///\\tnwg01a-v3824\logs)|ad\SVC-ADEXLogs|
|==cf_scripts==|==D:\ColdFusion2018\cfusion\wwwroot\cf_scripts==|==Pass-through==|
|==Jakarta==|==D:\ColdFusion2018\config\wsconfig\1==|==Pass-through==|
**Add Virtual Directories**
![Exported image](Exported%20image%2020250808202425-13.png)
**Connection String: AuthenticationMethod=Type2**
Backups/Miker/.trash/Configuration Java CAPI Update.md
+85
View File
@@ -0,0 +1,85 @@
**Oracle Java SE Multiple Vulnerabilities**
==Backup directory defined here: (Settings -\>Java and JVM -\> Java virtual machine path).==
==Install Java over top of this location.==
==Use Microsoft CAPI for certificates (verify setting )==
JVM Arguments: (added at end of file)
-Dcom.sun.jndi.ldap.connect.pool.debug=all -Djavax.net.ssl.trustStore=NUL
-Djavax.net.ssl.trustStoreType=Windows-ROOT
[Installing and troubleshooting Java updates in ColdFusion - ColdFusion (adobe.com)](https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/)
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3)
Select the installers and other tools for a ColdFusion version.
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#additionalThirdPartyInstallers)
We're running Coldfusion 2018 at the latest patch level, and have been notified by our security folks that we're using a vulnerable version of the JRE (1.11.0_01).  I'm new to administering Coldfusion and wanted to know what the best practices are for performing JRE updates.  Should we be expecting updates to be included in the Coldfusion updates (I assume not, given how behind we are)?  If not, should we only be applying versions available here ( [https://www.adobe.com/support/coldfusion/downloads.html](https://www.adobe.com/support/coldfusion/downloads.html))?  Is this a good reference on how to apply the updates? ([https://www.petefreitag.com/item/860.cfm)](https://www.petefreitag.com/item/860.cfm)
**1 Correct answer**
![Charlie Arehart](Exported%20image%2020250808202314-0.png)
 
**Charlie Arehart** • _Community Expert_ , _Jan 10, 2022_
To answer your questions, no, yes, yes. [Edit: initially I said "no" as the last answer, but that was clearly a mis-typing, as supported by what I said below about Pete's helpful post.]
 
And if you show running 11.0.1, you can see that's clearly NOT "the latest", even as offered on that Adobe page, specifically [the section on Java downloads](https://www.adobe.com/support/coldfusion/downloads.html#additionalThirdPartyInstallers) (though good news is that the page DOES show the current latest, which is 11.0.13 at the moment. )
 
And to be clear, that's the latest update to Java 11, n
\> From \<[https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783](https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783)\>
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#additionalThirdPartyInstallers) ==at bottom of page………………………………………………..==
33. ==Download the latest version of Java from==  ==http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html====. Please make sure that you download 64-bit Java for 64-bit ColdFusion and 32-bit Java for 32 bit ColdFusion.==
[Download ColdFusion updates, add-ons, and developer tools (adobe.com)](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#additionalThirdPartyInstallers)
36. ==Stop ColdFusion Services==
37. ==Run the installer to install Java.==
38. ==Take a backup of jvm.config(located at== D:\ColdFusion2023\cfusion\bin\jvm.config==)==
39. ==To change from ColdFusion’s default Java, modify the Java home url in either jvm.config or in ColdFusion administrator (Settings -\>Java and JVM -\> Java virtual machine path).==
40. ==Backup D==:\ColdFusion2023\jre folder (use this as the install path.)
41. Install new JDK version. 43. ==Restart ColdFusion after making the changes.==
44. ==To verify the update, log in to ColdFusion Administrator and see verify the newer Java version .==
Note: Any SSL certificates added to the previous JDK will also need to be re-added to the new JDK (cacerts) file.
You can use Java keytool tool located in Javajre1.8.0_XXbin to import the certificate.  You can use the below command:
keytool -import -alias name -keystore Javajre1.8.0_XXlibsecuritycacerts -file mycert.cer
 
**Java upgrade issues and troubleshooting**
46. ==If you are== **unable to start ColdFusion** ==after the Java update:==
- ==Check the location of Java home in jvm.config.==
- ==The J==**ava auto-update** ==modifies the Java install directory location, which causes failure to ColdFusion start. Disable the java auto upgrade.==
- ==Try starting ColdFusion from command line to see specific errors. If the error is "Error loading: C:Program FilesJavajdk1.X.Xjrebinserverjvm.dll", then copy the== **msvcr100.dll** ==file to \<cf_install_root\>/cfusion/bin from {JDK8_Home}/bin (for Windows OS).==
47. ==After importing certificates, if you have issues related to SSL, then you need to enable debugging for SSL. Take a backup of jvm.config at ColdFusioncfusionbin and add== **-Djavax.net.debug=all** ==under the “Arguments to VM” in jvm.config. This would require a CF service restart. The argument would append the debugging info to the coldfusion-out.log at ColdFusioncfusionlogs.== \> From \<[https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/](https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/)\>
\> From \<[https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783](https://community.adobe.com/t5/coldfusion-discussions/best-practices-for-jre-updates-in-coldfusion/td-p/12646783)\> \> From \<[https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/](https://coldfusion.adobe.com/2016/10/installing-and-troubleshooting-java-updates-in-coldfusion/)\>
Java installers
[https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3)
Download jdk…x64_bin.exe
Stop ColdFusion 2023 Application Server service
**Remove previous backup copies**
**Backup D:\ColdFusion2023\jre** **(Right click drag copy here)**
**Backup D:\ColdFusion2023\cfusion\bin** **(Right click drag copy here)**
Run as administrator jdk…x64_bin.exe
![Exported image](Exported%20image%2020250808202314-1.png)
![Exported image](Exported%20image%2020250808202315-2.png)
**Change** **point to D:\ColdFusion2023\jre**
![Exported image](Exported%20image%2020250808202316-3.png)
![Exported image](Exported%20image%2020250808202316-4.png)
![Exported image](Exported%20image%2020250808202320-5.png)
![Exported image](Exported%20image%2020250808202321-6.png)
**Start ColdFusion services**
Login to Admin console and verify update [ColdFusion Administrator](http://127.0.0.1:8500/CFIDE/administrator/index.cfm?target=/CFIDE/administrator/settings/server_settings.cfm)
![Exported image](Exported%20image%2020250808202322-7.png)
[New updates released for Java 8, 11, and 17, as of Jan 2022 - Charlie Arehart - Server Troubleshooting (carehart.org)](https://www.carehart.org/blog/client/index.cfm/2022/1/24/java_updates_Jan_2021)
Backups/Miker/.trash/Configuration Mappings.md
+1
View File
@@ -0,0 +1 @@
![Machine generated alternative text Server Settings...](Exported%20image%2020250808202359-0.png)
Backups/Miker/.trash/Configure AIA and CDP.md
+46
View File
@@ -0,0 +1,46 @@
**************************************************************************************************************
**Configure AIA**
certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://cbp-edme-npe-wes.cbp.dhs.gov/PKI/%1_%3%4.crt\n2:http://cbp-edme-npe-wes2.cbp.dhs.gov/PKI/%1_%3%4.crt"
**Configure AIA with OCSP**
certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://cbp-edme-npe-wes.cbp.dhs.gov/PKI/%1_%3%4.crt\n2:http://cbp-edme-npe-wes2.cbp.dhs.gov/PKI/%1_%3%4.crt\n32:http://cbp-edme-npe-wes.cbp.dhs.gov/ocsp\n32:http://cbp-edme-npe-wes2.cbp.dhs.gov/ocsp"
**Updated 6/18/2024**
~~certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://~~~~cbp-npe.cbp.dhs.gov~~~~/PKI/%1_%3%4.crt\n32:http://~~~~cbp-npe.cbp.dhs.gov~~~~/ocsp"~~
**Updated 7/02/2024**
==certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://==cbp-npe.cbp.dhs.gov==/PKI/%1_%3%4.crt\n32:http://==cbp-npe.cbp.dhs.gov==/ocsp"==
**Review Settings**
Confirm settings: certutil -getreg CA\CACertPublicationURLs
**Configure CDP**
Certutil -setreg CA\CRLPublicationURLs "65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n6:http://cbp-edme-npe-wes.cbp.dhs.gov/PKI/%3%8%9.crl\n6:http://cbp-edme-npe-wes2.cbp.dhs.gov/PKI/%3%8%9.crl\n65:file://\\cbp-edme-npe-wes.cbp.dhs.gov\PKI\%3%8%9.crl\n65:file://\\cbp-edme-npe-wes2.cbp.dhs.gov\PKI\%3%8%9.crl"
Replace ==highlighted in Blue== with correct value
Certutil -setreg CA\CRLPublicationURLs "65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n65:ldap:///CN===CBP-EDME-NPE-CA2==,CN===TNWG01A-V1651==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov\n6:http://cbp-edme-npe-wes.cbp.dhs.gov/PKI/%3%8%9.crl\n6:http://cbp-edme-npe-wes2.cbp.dhs.gov/PKI/%3%8%9.crl\n65:file://\\cbp-edme-npe-wes.cbp.dhs.gov\PKI\%3%8%9.crl\n65:file://\\cbp-edme-npe-wes2.cbp.dhs.gov\PKI\%3%8%9.crl"
**Updated 6/18/2024**
~~Certutil -setreg CA\CRLPublicationURLs "65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n65:ldap:///CN=CBP-EDME-NPE-CA6,CN=TNWG01A-V3453,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov\n6:http://~~~~cbp-npe.cbp.dhs.gov~~~~/PKI/%3%8%9.crl~~~~\n65:file://\\cbp-edme-npe-wes.cbp.dhs.gov\PKI\%3%8%9.crl\n65:file://\\cbp-edme-npe-wes2.cbp.dhs.gov\PKI\%3%8%9.crl"~~
******************************************************************************************************************************************
**Updated 7/02/2024**
==Certutil -setreg CA\CRLPublicationURLs "65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n65:ldap:///CN=CBP-EDME-NPE-CA6,CN=TNWG01A-V3453,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov\n6:http://==cbp-npe.cbp.dhs.gov==/PKI/%3%8%9.crl==\n65:file://\\cbp-edme-npe-wes.cbp.dhs.gov\PKI\%3%8%9.crl\n65:file://\\cbp-edme-npe-wes2.cbp.dhs.gov\PKI\%3%8%9.crl"
ldap:///CN===CBP-NPE-CA1==,CN===TNWG01A-V1650==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN===CBP-EDME-NPE-CA2==,CN===TNWG01A-V1651==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN===CBP-EDME-NPE-CA7==,CN===TNWG01A-V3452==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN===CBP-EDME-NPE-CA6==,CN===TNWG01A-V3453==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN===CBP-EDME-NPE-CA3==,CN===TNWG01A-V3455==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN===CBP-EDME-NPE-CA4==,CN===TNWG01A-V3456==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN===CBP-EDME-NPE-CA5==,CN===TNWG01A-V3457==,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=cbp,DC=dhs,DC=gov
ldap:///CN=CBP-SAT-EDME-NPE-CA2,CN=TNWG01A-V3586,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=sat,DC=cbp,DC=dhs,DC=gov
**Test certificate**
certutil -f -urlfetch -verify c:\temp\test.cer
[http://CBP-EDME-NPE-WES.cbp.dhs.gov/PKI/CBP-EDME-NPE-CA5.crl](http://CBP-EDME-NPE-WES.cbp.dhs.gov/PKI/CBP-EDME-NPE-CA5.crl)
Backups/Miker/.trash/Configure WireGuard via the NetworkManager GUI.md
+24
View File
@@ -0,0 +1,24 @@
^^^ This is all you need to add a wireguard config file. ^^^
If for some reason you still want to use the GUI
Here is my original tutorial
1. Install `nm-connection-editor` via your package manager.
2. Open the Advanced Network Configuration GUI, add a new connection & select WireGuard
![Screenshot from 2023-04-05 18-33-00](https://forum.manjaro.org/uploads/default/original/3X/f/d/fd94540395cf56a59e110db06603faeaf850bd2d.png)
![Screenshot from 2023-04-05 18-33-20](https://forum.manjaro.org/uploads/default/original/3X/6/3/63aa2136115143db16d66cde327087f92b089721.png)
3. Use the following diagram to translate your WireGuard client config file to the Advanced Network Configuration GUI.
[![HowTo](https://forum.manjaro.org/uploads/default/optimized/3X/1/7/177682f37daed1b4e8283f836fd57af349bc4852_2_690x388.jpeg)
HowTo1920×1080 114 KB
](https://forum.manjaro.org/uploads/default/original/3X/1/7/177682f37daed1b4e8283f836fd57af349bc4852.jpeg "HowTo")
Enjoy your WireGuard VPN integrated into the OS!
Note: the “Listen port” will **not** be in your WireGuard client config. I used 58909 & that worked for me.
Backups/Miker/.trash/Cron.md
+35
View File
@@ -0,0 +1,35 @@
| Field | Allowed Values | Description |
| --- | --- | --- |
| `SECOND` | 0-59 | Trigger every SECOND second(s) |
| `MINUTE` | 0-59 | Trigger every MINUTE minute(s) |
| `HOUR` | 0-23 | Trigger every HOUR hour(s) |
| `DAY` | 1-31 | Trigger every DAY day(s) of month |
| `MONTH` | 1-12 | Trigger every MONTH month(s) |
| `DAY OF WEEK` | 0-6 | MON-SUN Trigger on specific DAY OF WEEK |
Special Characters
------------------
| Special Character | Description |
| --- | --- |
| `*` | Trigger on tick of every time unit |
| `,` | List separator |
| `–` | Specifies a range |
| `/` | Defines an increment |
Examples
--------
| Cron Expression | Description |
| --- | --- |
| `0 * * * * *` | Executes every minute |
| `0 0 * * * *` | Executes every hour |
| `0 0 0 * * *` | Executes every day |
| `0 0 0 0 * *` | Executes every month |
| `0 0 0 1 1 *` | Executes on first day of Jan each year |
| `30 20 * * SAT` | Executes at 08:30pm every Saturday |
| `30 20 * * 6` | Executes at 08:30pm every Saturday |
| `0 */5 * * * *` | Executes every five minutes |
| `0 0 8-10/1 * * *` | Executes every hour between 8am and 10am |
Backups/Miker/.trash/DFI Health alerts when Domain Controllers are patched and restarted.md
+5
View File
@@ -0,0 +1,5 @@
I created an Orchestration Group in MECM named “AD Domain Controllers” and added all the AD domain controllers to this group. I created two scripts, one that will stop and disable the service (AATPsensor) before the server is patched and restarted and another one that will run after the server is restarted to re-enable and start the service (AATPsensor).
 
I added to the script an entry that will create an eventlog event in the System eventlog. EventID number is 21589 that we can search in Splunk to see if this works.
 
write-eventlog -LogName system -source $source -EventId 21589 -EntryType Information -Message $mesg
Backups/Miker/.trash/DNS Cheat-Sheet.md
+36
View File
@@ -0,0 +1,36 @@
### Commonly used DNS Records
| Type | Description |
| --- | --- |
| **A** | The record that holds the IP address of a domain. |
| **AAAA** | The record that contains the IPv6 address for a domain (as opposed to A records, which list the IPv4 address). |
| **CNAME** | Forwards one domain or subdomain to another domain, does NOT provide an IP address. |
| **MX** | Directs mail to an email server. |
| **TXT** | Lets an admin store text notes in the record. These records are often used for email security. |
| **NS** | Stores the name server for a DNS entry. |
| **SOA** | Stores admin information about a domain. |
| **SRV** | Specifies a port for specific services. |
| **PTR** | Provides a domain name in reverse-lookups. |
### Less commonly used DNS Records
| Type | Description |
| --- | --- |
| **APL** | The ‘address prefix list’ is an experiment record that specifies lists of address ranges. |
| **AFSDB** | This record is used for clients of the Andrew File System (AFS) developed by Carnegie Melon. The AFSDB record functions to find other AFS cells. |
| **CAA** | This is the ‘certification authority authorization’ record, it allows domain owners state which certificate authorities can issue certificates for that domain. If no CAA record exists, then anyone can issue a certificate for the domain. These records are also inherited by subdomains. |
| **DNSKEY** | The ‘DNS Key Record’ contains a public key used to verify Domain Name System Security Extension (DNSSEC) signatures |
| **CDNSKEY** | This is a child copy of the DNSKEY record, meant to be transferred to a parent. |
| **CERT** | The ‘certificate record’ stores public key certificates. |
| **DCHID** | The ‘DHCP Identifier’ stores info for the Dynamic Host Configuration Protocol (DHCP), a standardized network protocol used on IP networks. |
| **DNAME** | The ‘delegation name’ record creates a domain alias, just like CNAME, but this alias will redirect all subdomains as well. For instance if the owner of ‘example.com’ bought the domain ‘website.net’ and gave it a DNAME record that points to ‘example.com’, then that pointer would also extend to ‘blog.website.net’ and any other subdomains. |
| **HIP** | This record uses ‘Host identity protocol’, a way to separate the roles of an IP address; this record is used most often in mobile computing. |
| **IPSECKEY** | The ‘IPSEC key’ record works with the Internet Protocol Security (IPSEC), an end-to-end security protocol framework and part of the Internet Protocol Suite (TCP/IP). |
| **LOC** | The ‘location’ record contains geographical information for a domain in the form of longitude and latitude coordinates. |
| **NAPTR** | The ‘name authority pointer’ record can be combined with an SRV record to dynamically create URI’s to point to based on a regular expression. |
| **NSEC** | The ‘next secure record’ is part of DNSSEC, and it’s used to prove that a requested DNS resource record does not exist. |
| **RRSIG** | The ‘resource record signature’ is a record to store digital signatures used to authenticate records in accordance with DNSSEC. |
| **RP** | This is the ‘responsible person’ record and it stores the email address of the person responsible for the domain. |
| **SSHFP** | This record stores the ‘SSH public key fingerprints’; SSH stands for Secure Shell and it’s a cryptographic networking protocol for secure communication over an unsecure network. |
Backups/Miker/.trash/Delegation Delegate using DSALS.md
+629
View File
@@ -0,0 +1,629 @@
**Delegation-User-Attributes**
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;displayName;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;sn;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;description;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;mail;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;targetAddress;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;proxyAddresses;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute1;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute2;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute3;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute4;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute5;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute6;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute7;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute8;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute9;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute10;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute11;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute12;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute13;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute14;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute15;user" /I:S
**Added 6/11/2019**
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;department;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;postalCode;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;streetAddress;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;st;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;title;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;telephoneNumber;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;mobile;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;pager;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;company;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;L;user" /I:S
**Added 9/9/2019** 
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;c;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;facsimileTelephoneNumber;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;physicalDeliveryOfficeName;user" /I:S
**Added 4/4/2024** **(as discussed with Marcus)**
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;altSecurityIdentities;user" /I:S
**New script to replace above…..**
**12-4-2024 Delegation "Delegation-User-Attributes"**
# Define the list of OUs
$ouList = @(
"OU=EastTexas,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=International,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NationalCapital,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthWestCentral,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthWest,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Privileged,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov"
)
# Define the commands to execute for each OU
$commands = @(
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;displayName;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;sn;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;description;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;mail;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;targetAddress;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;proxyAddresses;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;mailNickname;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;directReports;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;manager;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute1;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute10;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute11;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute12;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute13;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute14;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute15;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute16;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute17;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute18;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute19;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute2;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute20;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute3;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute4;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute5;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute6;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute7;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute8;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute9;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute1;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute2;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute3;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute4;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute5;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute6;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute7;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute8;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute9;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute10;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute11;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute12;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute13;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute14;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute15;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;department;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;postalCode;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;streetAddress;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;st;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;title;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;telephoneNumber;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;mobile;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;pager;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;company;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;L;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;c;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;facsimileTelephoneNumber;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;physicalDeliveryOfficeName;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;altSecurityIdentities;user" /I:S'
)
# Loop through each OU and execute the commands
foreach ($ou in $ouList) {
foreach ($cmd in $commands) {
$commandToExecute = $cmd -f $ou
Write-Host "Executing: $commandToExecute"
Invoke-Expression $commandToExecute
}
}
**Delegation-UserPIVmaint** Added 12/5/2024
# Define the list of OUs
$ouList = @(
"OU=EastTexas,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=International,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NationalCapital,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthWestCentral,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthWest,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Privileged,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov"
)
# Define the commands to execute for each OU
$commands = @(
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;account restrictions;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;pwdlastset;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;UserAccountControl;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;altSecurityIdentities;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:CA;reset password;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;DHSAttribute13;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;DHSAttribute19;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;userPrincipalName;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;sAMAccountName;user" /I:S'
)
# Loop through each OU and execute the commands
foreach ($ou in $ouList) {
foreach ($cmd in $commands) {
$commandToExecute = $cmd -f $ou
Write-Host "Executing: $commandToExecute"
Invoke-Expression $commandToExecute
}
}
==View==
dsacls "DC=ad,DC=cbp,DC=dhs,DC=gov" \>ad.txt
**Added 6/10/2019**
==Service accounts servicePrincipalName delegation: Delegation-servicePrincipalName==
DSACLS "OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-servicePrincipalName:RPWP;servicePrincipalName;user" /I:S
**Added 6/18/2025**
DSACLS "OU=SQL,OU=EIOD,OU=Accounts Group Managed System,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "DELEGATION-EIOD-SQL-SVC-ACCNT-MGMNT:RPWP;servicePrincipalName;user" /I:S
2/11/2022 SAT domain
DSACLS "OU=SQL,OU=EDMED,OU=Accounts Service,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "Delegation-servicePrincipalName-EDME-SQL:RPWP;servicePrincipalName;user" /I:S
**Added 6/18/2025**
DSACLS "OU=SQL,OU=EIOD,OU=Accounts Group Managed System,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "Delegation-servicePrincipalName-EDME-SQL:RPWP;servicePrincipalName;user" /I:S
**Added 2/26/20** (so TSD or future groups can modify extensionAttribute11 used for email automation)
DSACLS "OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-extensionAttribute11:RPWP;extensionAttribute11;user" /I:S
**How to grant "Write ServicePrincipalName” and “Write validated SPN” rights to the directory for service account**
Tuesday, July 31, 2018
1:45 PM
How to grant "Write ServicePrincipalName” and “Write validated SPN” rights to the directory for service account
dsacls "OU=SQL,OU=EDMED,OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-OSADMINS:RPWP;servicePrincipalName"
Only users accounts
dsacls "OU=SQL,OU=EDMED,OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-OSADMINS:RPWP;servicePrincipalName;user"
==Delegation-msRTCSIP-Attributes Deleted 12/5/24 No Longer in use==
Kellerman 10/21/19:
- Renamed original Delegation-msRTCSIP-PrimaryUserAddress to Delegation-msRTCSIP-Attributes to reflect multiple property assignments
- Added the following WR (Write) to user properties (dsacls example shows only original delegation for msRTCSIP-PrimaryUserAddress):
- msRTCSIP-ApplicationOptions
- msRTCSIP-DeploymentLocator
- msRTCSIP-Line
- msRTCSIP-OptionFlags
- msRTCSIP-OwnerUrn
- msRTCSIP-PrimaryUserAddress
- msRTCSIP-UserEnabledmsRTCSIP-UserEnabled
dsacls "OU=Accounts Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=Arizona,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=Central,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=METRO,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=NorthEast,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=NorthWest,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=SouthEast,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=SouthernCalifornia,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=SouthWest,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=International,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
==Delegation-UserAccessControl== ==Deleted 12/5/24 No Longer in use==
~~Usage:  Password never expires script running on tnwg01a-v0981~~
~~Account: SVC-UserAccess-CTRL~~
~~Delegates Read Write to user object “userAccountControl” parameter~~
 
==Delegation-DHSmail-OU==
**Delegate permissions to CN=Deleted Objects**
dsacls "CN=Deleted Objects,DC=ad,DC=cbp,DC=dhs,DC=gov" /takeownership
dsacls "CN=Deleted Objects,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "AD\Delegation-DHSmail-OU:LCRP"
![Delegation of Control Wizard Mive Type Indicate th...](Exported%20image%2020250808202058-0.png)
![Delegation of Control Wizard Select the permission...](Exported%20image%2020250808202059-1.png)
**Join Computer Objects / Create Computer objects /Move**
**PowerShell (tested 3/26/2020) run on both OU locations**
#$user = 'AD\Delegation-WorkstationsSpecialPurpose-BEMS-ICAD'
#$ou = 'OU=ICAD SURVEILLANCE PROCESSORS,OU=BEMSD,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$ou = 'OU=ADEX,OU=WSG,OU=EDMED,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$user = 'AD\Delegation-Computer-Move-Pride'
#$ou = 'OU=PRIDE-RPM,OU=LSS,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$ou = 'OU=ICAD,OU=BEMSD,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$user = 'AD\Deligation-Computer-Join-ICAD'
#$ou= 'OU=ICAD,OU=BEMS,OU=Servers Field,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$ou='OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /R $user
DSACLS $ou /I:S /G "$($user):GR;;computer"
DSACLS $ou /I:S /G "$($user):CC;computer"
DSACLS $ou /I:S /G "$($user):CA;Reset Password;computer"
DSACLS $ou /I:S /G "$($user):CA;Change Password;computer"
DSACLS $ou /I:S /G "$($user):CA;Validated write to service principal name;computer"
DSACLS $ou /I:S /G "$($user):WP;description;computer"
DSACLS $ou /I:S /G "$($user):WP;DNS Host Name Attributes;computer"
DSACLS $ou /I:S /G "$($user):WP;pwdLastSet;computer"
DSACLS $ou /I:S /G "$($user):WP;Logon Information;computer"
DSACLS $ou /I:S /G "$($user):WP;displayName;computer"
DSACLS $ou /I:S /G "$($user):WP;sAMAccountName;computer"
DSACLS $ou /I:S /G "$($user):WP;Account Restrictions;computer"
DSACLS $ou /I:S /G "$($user):WP;servicePrincipalName;computer"
**Pride Workstations Description 4/15/2020**
dsacls "OU=PRIDE-RPM,OU=LSS,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-Computer-Description-Pride:WP;description;computer"
**ICAD Privileged Accounts unlock 4/22/2020**
$user = 'AD\Delegation-AccountsPrivileged-BEMSD-ICAD-UNLOCK'
$ou = 'OU=ICAD,OU=BEMS,OU=Accounts Privileged,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
**ICAD CommonUsers Accounts unlock 6/18/2020 must be run with -0 account**
$user = 'AD\Delegation-CommonUser-ICAD-Unlock'
$ou = 'OU=ICAD,OU=BEMSD,OU=Accounts Common,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
**ICAM extensionAttribute14 rights to Server Access Groups. 8/10/2022**
SG-Delegation-Server Access-extensionAttribute14
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;==group==" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;user" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;==group==" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;user" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;==group==" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;user" /I:S
**DMZ Delegations extensionAttribute14 and extensionAttribute13 8/30/2023**
DSACLS "OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute14:RPWP;extensionAttribute14;group" /I:S
DSACLS "OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute13:RPWP;extensionAttribute13;group" /I:S
DSACLS "OU=GROUPS-ICAM MANAGED,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute14:RPWP;extensionAttribute14;group" /I:S
DSACLS "OU=GROUPS-ICAM MANAGED,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute13:RPWP;extensionAttribute13;group" /I:S
**Cluster identity can update computer objects in the domain**==.== **11/8/2022**
==Reset Password==
==Validated Write to DNS Host Name==
==Validated Write to Service Principal Name==
\> From \<[https://learn.microsoft.com/en-us/answers/questions/120834/the-computer-object-associated-with-the-cluster-ne.html](https://learn.microsoft.com/en-us/answers/questions/120834/the-computer-object-associated-with-the-cluster-ne.html)\>
**SAT OU=Accounts Privileged 1/22/2025**
**SAT domain delegate rights for SailPoint team to create/enable/disable reset password on User accounts**
dsacls "OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Accounts-Privileged-ICAM_MANAGED:GA;userAccountControl;user" /I:S
dsacls "OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Accounts-Privileged-ICAM_MANAGED:GA;user" /I:T
$user = 'SAT\Delegation-Accounts-Privileged-ICAM_MANAGED'
$ou = 'OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
dsacls "OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Accounts-Privileged-ICAM_MANAGED:CC;user" /I:S
**SAT OU=Development 1/22/2025**
**SAT domain delegate rights for SailPoint team to create/enable/disable reset password Users accounts**
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Development-ICAM_MANAGED:GA;user" /I:S
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Development-ICAM_MANAGED:GA;user" /I:T
$user = 'SAT\Delegation-Development-ICAM_MANAGED'
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Development-ICAM_MANAGED:WP;userAccountControl;user" /I:S
$ou = 'OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
**SAT OU=Development 1/23/2025**
**SAT OU Create/delete SailPoint team**
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-OU-Development:CC;organizationalUnit" /I:T
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-OU-Development:DC;organizationalUnit" /I:T
# Example:
# Cluster service Name TNWG01A-C0398$
# Cluster Nodes TNWG01A-V4273, TNWG01A-V4274
#
$ClusterServiceAccount = 'AD\TNWG01A-C0398$'
$Cmember1 = 'CN=TNWG01A-V4273,OU=RC4-DEP,OU=SQL-SERVERS,OU=SQL,OU=EDME,OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov'
$Cmember2 = 'CN=TNWG01A-V4274,OU=RC4-DEP,OU=SQL-SERVERS,OU=SQL,OU=EDME,OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov'
#
DSACLS $Cmember1 /I:S /G "$($ClusterServiceAccount):CA;Reset Password;computer"
DSACLS $Cmember1 /I:S /G "$($ClusterServiceAccount):CA;Validated write to service principal name;computer"
DSACLS $Cmember1 /I:S /G "$($ClusterServiceAccount):WP;DNS Host Name Attributes;computer"
DSACLS $Cmember2 /I:S /G "$($ClusterServiceAccount):CA;Reset Password;computer"
DSACLS $Cmember2 /I:S /G "$($ClusterServiceAccount):CA;Validated write to service principal name;computer"
DSACLS $Cmember2 /I:S /G "$($ClusterServiceAccount):WP;DNS Host Name Attributes;computer"
**Delegation Create/delete Organizational units** ==created 12/4/2024==
# Define the user or group and the OU path
$userOrGroup = "SAT\Delegation-OU-Development" # Replace with your user or group
$ouPath = "OU=MyTest,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" # Replace with your OU path
# Import the Active Directory module
Import-Module ActiveDirectory
# Import the required .NET namespace
Add-Type -AssemblyName System.DirectoryServices
# Get the distinguished name (DN) of the OU
$ou = Get-ADOrganizationalUnit -Identity $ouPath
# Define the ObjectType GUID for Organizational Unit
$organizationalUnitGuid = [Guid]::Parse("bf967aa5-0de6-11d0-a285-00aa003049e2")
# Define permissions for creating and deleting Organizational Units
$createPermission = [System.DirectoryServices.ActiveDirectoryRights]::CreateChild
$deletePermission = [System.DirectoryServices.ActiveDirectoryRights]::DeleteChild
# Create the access rules
$createAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$createPermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$organizationalUnitGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
$deleteAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$deletePermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$organizationalUnitGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
# Get the security descriptor of the parent OU
$securityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
# Add the access rules to the security descriptor
$securityDescriptor.AddAccessRule($createAce)
$securityDescriptor.AddAccessRule($deleteAce)
# Set the updated security descriptor on the parent OU
Set-ACL -Path "AD:$($ou.DistinguishedName)" -AclObject $securityDescriptor
# Verify if the permissions have been added
$updatedSecurityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
$updatedAccessRules = $updatedSecurityDescriptor.Access | Where-Object { $_.IdentityReference -eq $userOrGroup }
if ($updatedAccessRules) {
Write-Host "Permissions to create and delete Organizational Units have been successfully granted to $userOrGroup on $($ou.DistinguishedName)"
$updatedAccessRules | Format-Table -AutoSize
} else {
Write-Host "Failed to verify the delegation. Permissions may not have been applied correctly." -ForegroundColor Red
}
**Delegation Of Group Management**
![Exported image](Exported%20image%2020250808202059-2.png)
**Delegation Create/delete Groups** ==created 12/4/2024==
# Import the Active Directory module
Import-Module ActiveDirectory
# Import the required .NET namespace
Add-Type -AssemblyName System.DirectoryServices
# Define the user or group and the OU path
$userOrGroup = "SAT\Delegation-Development-GROUPS-ICAM_MANAGED" # Replace with your user or group
$ouPath = "OU=MyTest,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" # Replace with your OU path
# Get the distinguished name (DN) of the OU
$ou = Get-ADOrganizationalUnit -Identity $ouPath
# Define the ObjectType GUID for Group objects
$groupGuid = [Guid]::Parse("bf967a9c-0de6-11d0-a285-00aa003049e2")
# Define permissions for creating and deleting Group objects
$createPermission = [System.DirectoryServices.ActiveDirectoryRights]::CreateChild
$deletePermission = [System.DirectoryServices.ActiveDirectoryRights]::DeleteChild
# Create the access rules
$createAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$createPermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$groupGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
$deleteAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$deletePermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$groupGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
# Get the security descriptor of the parent OU
$securityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
# Add the access rules to the security descriptor
$securityDescriptor.AddAccessRule($createAce)
$securityDescriptor.AddAccessRule($deleteAce)
# Set the updated security descriptor on the parent OU
Set-ACL -Path "AD:$($ou.DistinguishedName)" -AclObject $securityDescriptor
# Verify if the permissions have been added
$updatedSecurityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
$updatedAccessRules = $updatedSecurityDescriptor.Access | Where-Object { $_.IdentityReference -eq $userOrGroup }
if ($updatedAccessRules) {
Write-Host "Permissions to create and delete Group objects have been successfully granted to $userOrGroup on $($ou.DistinguishedName)"
$updatedAccessRules | format-Table -AutoSize
} else {
write-host "Failed to verify the delegation. Permission may not have been applied correctly." -ForegroundColor Red
}
gMSA Accounts delegation to create SPN
**SAT**
dsacls "OU=SQL,OU=EDME,OU=Accounts Group Managed System,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\SG-SQL-INSTANCEADMINS:RPWP;servicePrincipalName"
**AD**
dsacls "OU=SQL,OU=EDME,OU=Accounts Group Managed System,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-INSTANCEADMINS:RPWP;servicePrincipalName"
dsacls "OU=SQL,OU=EIOD,OU=Accounts Group Managed System,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-INSTANCEADMINS:RPWP;servicePrincipalName"
**DMZ**
dsacls "OU=SQL,OU=EIOD,OU=Account Group Managed System,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /I:S /G "DMZ\SG-SQL-OSADMINS:RPWP;servicePrincipalName"
**SAT allow**
**“this account supports Kerberos AES 256 bit encryption”**
dsacls "OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\Delegation-User-msDS-SupportedEncryptionTypes:RPWP;msDS-SupportedEncryptionTypes"
dsacls "OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\SVC-WSG-ORCH-USRMNT:RPWP;msDS-SupportedEncryptionTypes"
**DMZ allow**
**“this account supports Kerberos AES 256 bit encryption”**
dsacls "OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /I:S /G "DMZ\Delegation-User-msDS-SupportedEncryptionTypes:RPWP;msDS-SupportedEncryptionTypes"
dsacls "OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /I:S /G "DMZ\SVC-WSG-ORCH-USRMNT:RPWP;msDS-SupportedEncryptionTypes"
**LAPS (ms-Mcs-AdmPwd read)**
#Install-Module -Name AdmPwd.PS ==# one time install==
Import-Module AdmPwd.PS
Set-AdmPwdReadPasswordPermission –Identity "OU=Production,DC=ad,DC=cbp,DC=dhs,DC=gov" –AllowedPrincipals "Delegation-Computer-ms-Mcs-AdmPwd"
Set-AdmPwdReadPasswordPermission –Identity "OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov" –AllowedPrincipals "Delegation-Computer-ms-Mcs-AdmPwd"
Set-AdmPwdReadPasswordPermission –Identity "OU=Servers Field,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" –AllowedPrincipals "Delegation-Computer-ms-Mcs-AdmPwd"
==Review is LAPS is set==
Get-ADComputer -SearchBase "OU=Servers Field,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" -Filter {ms-Mcs-AdmPwd -notlike "*"} | Where-Object { $_.Name -notlike "*-C*" }
Get-ADComputer -SearchBase "OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov" -Filter {ms-Mcs-AdmPwd -notlike "*"} | Where-Object { $_.Name -notlike "*-C*" }
Get-ADComputer -SearchBase "OU=Production,DC=ad,DC=cbp,DC=dhs,DC=gov" -Filter {ms-Mcs-AdmPwd -notlike "*"} | Where-Object { $_.Name -notlike "*-C*" }
**Delegation of User Account Management 10/4/2024**
Delegation setting for any Users account management.
Example: Delegation-Leave-Of-Absence-Users and Delegation-Account-Special-Purpose-Users
![Exported image](Exported%20image%2020250808202100-3.png)
$OULocation = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$SecurityGroup = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
#Setup User management
dsacls "$OULocation" /I:S /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP":GA
#Setup Group management
dsacls "$OULocation" /I:S /G "DomainName\GroupName":CCDCRP;group
#Setup OU management
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:CCDC;OU" /I:S
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:RP;group" /I:S
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:RPWP;displayName;user" /I:S
dsacls "$OULocation" /I:S /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP":RP;group
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:CCDC;group" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-User-Attributes:RPWP;L;user" /I:S
dsacls "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:WPRPCA;OU"
dsacls "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:CCDC;organizational unit"
$ou = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$group = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
# Get the security group object
$securityGroup = Get-ADGroup $group
# Grant permissions to the security group on the OU
Add-ADPermission -Identity $ou -User $securityGroup.Name -AccessRights CreateChild, DeleteChild -InheritanceType All -ObjectType "OrganizationalUnit"
$OrganizationalUnit = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$GroupName = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
Set-Location AD:
$Group = Get-ADGroup -Identity $GroupName
$GroupSID = [System.Security.Principal.SecurityIdentifier] $Group.SID
$ACL = Get-Acl -Path $OrganizationalUnit
$Identity = [System.Security.Principal.IdentityReference] $GroupSID
$ADRight = [System.DirectoryServices.ActiveDirectoryRights] "CreateChild, DeleteChild"
$Type = [System.Security.AccessControl.AccessControlType] "Allow"
$InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "None"
$ObjectType = [System.Guid]::Empty
$InheritedObjectType = [System.Guid]::Empty
$Rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, $ADRight, $Type, $ObjectType, $InheritedObjectType)
$ACL.AddAccessRule($Rule)
Set-Acl -Path $OrganizationalUnit -AclObject $ACL
$OrganizationalUnit = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$ServiceUserName = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
Set-Location AD:
$Group = Get-ADGroup -Identity $ServiceUserName
$GroupSID = [System.Security.Principal.SecurityIdentifier] $Group.SID
$ACL = Get-Acl -Path $OrganizationalUnit
$Identity = [System.Security.Principal.IdentityReference] $GroupSID
$Computers = [GUID]"bf967a86-0de6-11d0-a285-00aa003049e2"
$ResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$ValidatedDNSHostName = [GUID]"72e39547-7b18-11d1-adef-00c04fd8d5cd"
$ValidatedSPN = [GUID]"f3a64788-5306-11d1-a9c5-0000f80367c1"
$AccountRestrictions = [GUID]"4c164200-20c0-11d0-a768-00aa006e0529"
$guidChangePassword = [GUID]"ab721a53-1e2f-11d0-9819-00aa0040529b"
$guidLockoutTime = [GUID]"28630ebf-41d5-11d1-a9c1-0000f80367c1"
#$guidPwdLastSet = [GUID]"bf967a0a-0de6-11d0-a285-00aa003049e2"
#$guidComputerObject = [GUID]"bf967a86-0de6-11d0-a285-00aa003049e2"
#$guidUserObject = [GUID]"bf967aba-0de6-11d0-a285-00aa003049e2"
$guidLinkGroupPolicy = [GUID]"f30e3bbe-9ff0-11d1-b603-0000f80367c1"
$guidGroupPolicyOptions = [GUID]"f30e3bbf-9ff0-11d1-b603-0000f80367c1"
$guidResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$guidGroupObject = [GUID]"Guid BF967A9C-0DE6-11D0-A285-00AA003049E2"
$guidContactObject = [GUID]"5CB41ED0-0E4C-11D0-A286-00AA003049E2"
$guidOUObject = [GUID]"BF967AA5-0DE6-11D0-A285-00AA003049E2"
$guidPrinterObject = [GUID]"BF967AA8-0DE6-11D0-A285-00AA003049E2"
$guidWriteMembers = [GUID]"bf9679c0-0de6-11d0-a285-00aa003049e2"
$guidNull = [GUID]"00000000-0000-0000-0000-000000000000"
$guidPublicInformation = [GUID]"e48d0154-bcf8-11d1-8702-00c04fb96050"
$guidGeneralInformation = [GUID]"59ba2f42-79a2-11d0-9020-00c04fc2d3cf"
$guidPersonalInformation = [GUID]"77B5B886-944A-11d1-AEBD-0000F80367C1"
$guidGroupMembership = [GUID]"bc0ac240-79a9-11d0-9020-00c04fc2d4cf"
#$RuleCreateAndDeleteGroup = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "CreateChild, DeleteChild", "Allow", $guidGroupObject, "All")
$RuleCreateAndDeleteComputer = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "CreateChild, DeleteChild", "Allow", $Computers, "All")
$RuleResetPassword = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Identity, "ExtendedRight", "Allow", $ResetPassword, "Descendents", $Computers)
$RuleValidatedDNSHostName = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($GroupSID, "Self", "Allow", $ValidatedDNSHostName, "Descendents", $Computers)
$RuleValidatedSPN = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($GroupSID, "Self", "Allow", $ValidatedSPN, "Descendents", $Computers)
$RuleAccountRestrictions = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Identity, "ReadProperty, WriteProperty", "Allow", $AccountRestrictions, "Descendents", $Computers)
#$ACL.AddAccessRule($RuleCreateAndDeleteGroup)
$ACL.AddAccessRule($RuleCreateAndDeleteComputer)
$ACL.AddAccessRule($RuleResetPassword)
$ACL.AddAccessRule($RuleValidatedDNSHostName)
$ACL.AddAccessRule($RuleValidatedSPN)
$ACL.AddAccessRule($RuleAccountRestrictions)
Set-Acl -Path $OrganizationalUnit -AclObject $ACL
Computer Rename delegation
# Import the Active Directory module
Import-Module ActiveDirectory
# Define variables
$domain = "DC=ad,DC=cbp,DC=dhs,DC=gov" #
$delegatedGroup = "SG-WSG-RenameWRKST" # Group to receive the permissions
$ouPath = "OU=TestPermission,OU=WSG Workstations,OU=NWG001A,OU=NOVA,OU=NationalCapital,DC=ad,DC=cbp,DC=dhs,DC=gov" # Target OU where delegation will apply
# Get the group object
$group = Get-ADGroup $delegatedGroup
# Construct the DSACLS command to delegate the "Write Property" permission for the "Name" attribute
$dsaclsCommand = "dsacls.exe `"$ouPath`" /I:S /G `"$($group.SamAccountName):WP;Name;computer`""
# Execute the DSACLS command
Invoke-Expression $dsaclsCommand
Write-Host "Delegation rights to rename computer objects in $ouPath have been granted to $delegatedGroup"
Backups/Miker/.trash/Docker Cheet Sheet.md
+100
View File
@@ -0,0 +1,100 @@
Running Containers
------------------
| COMMAND | DESCRIPTION |
| ---------------------------- | ------------------------------------------------- |
| `docker run <image>` | Start a new container from an image |
| `docker run -it <image>` | Start a new container in interactive mode |
| `docker run --rm <image>` | Start a new container and remove it when it exits |
| `docker create <image>` | Create a new container |
| `docker start <container>` | Start a container |
| `docker stop <container>` | Graceful stop a container |
| `docker kill <container>` | Kill (SIGKILL) a container |
| `docker restart <container>` | Graceful stop and restart a container |
| `docker pause <container>` | Suspend a container |
| `docker unpause <container>` | Resume a container |
| `docker rm <container>` | Destroy a container |
Container Bulk Management
-------------------------
| COMMAND | DESCRIPTION |
| --- | --- |
| `docker stop $(docker ps -q)` | To stop all the running containers |
| `docker stop $(docker ps -a -q)` | To stop all the stopped and running containers |
| `docker kill $(docker ps -q)` | To kill all the running containers |
| `docker kill $(docker ps -a -q)` | To kill all the stopped and running containers |
| `docker restart $(docker ps -q)` | To restart all running containers |
| `docker restart $(docker ps -a -q)` | To restart all the stopped and running containers |
| `docker rm $(docker ps -q)` | To destroy all running containers |
| `docker rm $(docker ps -a -q)` | To destroy all the stopped and running containers |
| `docker pause $(docker ps -q)` | To pause all running containers |
| `docker pause $(docker ps -a -q)` | To pause all the stopped and running containers |
| `docker start $(docker ps -q)` | To start all running containers |
| `docker start $(docker ps -a -q)` | To start all the stopped and running containers |
| `docker rm -vf $(docker ps -a -q)` | To delete all containers including its volumes use |
| `docker rmi -f $(docker images -a -q)` | To delete all the images |
| `docker system prune` | To delete all dangling and unused images, containers, cache and volumes |
| `docker system prune -a` | To delete all used and unused images |
| `docker system prune --volumes` | To delete all docker volumes |
Inspect Containers
------------------
| COMMAND | DESCRIPTION |
| --- | --- |
| `docker ps` | List running containers |
| `docker ps --all` | List all containers, including stopped |
| `docker logs <container>` | Show a container output |
| `docker logs -f <container>` | Follow a container output |
| `docker top <container>` | List the processes running in a container |
| `docker diff` | Show the differences with the image (modified files) |
| `docker inspect` | Show information of a container (json formatted) |
Executing Commands
------------------
| COMMAND | DESCRIPTION |
| --- | --- |
| `docker attach <container>` | Attach to a container |
| `docker cp <container>:<container-path> <host-path>` | Copy files from the container |
| `docker cp <host-path> <container>:<container-path>` | Copy files into the container |
| `docker export <container>` | Export the content of the container (tar archive) |
| `docker exec <container>` | Run a command inside a container |
| `docker exec -it <container> /bin/bash` | Open an interactive shell inside a container (there is no bash in some images, use /bin/sh) |
| `docker wait <container>` | Wait until the container terminates and return the exit code |
Images
------
| COMMAND | DESCRIPTION |
| --- | --- |
| `docker image ls` | List all local images |
| `docker history <image>` | Show the image history |
| `docker inspect <image>` | Show information (json formatted) |
| `docker tag <image> <tag>` | Tag an image |
| `docker commit <container> <image>` | Create an image (from a container) |
| `docker import <url>` | Create an image (from a tarball) |
| `docker rmi <image>` | Delete images |
| `docker pull <user>/<repository>:<tag>` | Pull an image from a registry |
| `docker push <user>/<repository>:<tag>` | Push and image to a registry |
| `docker search <test>` | Search an image on the official registry |
| `docker login` | Login to a registry |
| `docker logout` | Logout from a registry |
| `docker save <user>/<repository>:<tag>` | Export an image/repo as a tarball |
| `docker load` | Load images from a tarball |
Volumes
-------
| COMMAND | DESCRIPTION |
| --- | --- |
| `docker volume ls` | List all vol1umes |
| `docker volume create <volume>` | Create a volume |
| `docker volume inspect <volume>` | Show information (json formatted) |
| `docker volume rm <volume>` | Destroy a volume |
| `docker volume ls --filter="dangling=true"` | List all dangling volumes (not referenced by any container) |
| `docker volume prune` | Delete all volumes (not referenced by any container) |
| `docker run --rm --volumes-from <container> -v $(pwd):/backup busybox tar cvfz /backup/backup.tar.gz <container-path>` | Backup a container |
| `docker run --rm --volumes-from <container> -v $(pwd):/backup busybox sh -c "cd <container-path> && tar xvfz /backup/backup.tar.gz --strip 1"` | Restore a container from backup |
Backups/Miker/.trash/Docker Install Script.md
+30
View File
@@ -0,0 +1,30 @@
This script is intended as a convenient way to configure docker's package # repositories and to install Docker Engine, This script is not recommended # for production environments. Before running this script, make yourself familiar # with potential risks and limitations, and refer to the installation manual # at https://docs.docker.com/engine/install/ for alternative installation methods.
\# # The script:
\- Requires \`root\` or \`sudo\` privileges to run.
\- Attempts to detect your Linux distribution and version and configure your package management system for you.
\- Doesn't allow you to customize most installation parameters.
\- Installs dependencies and recommendations without asking for confirmation.
\- Installs the latest stable release (by default) of Docker CLI, Docker Engine,  Docker Buildx, Docker Compose, containerd, and runc. When using this script to provision a machine, this may result in unexpected major version upgrades  of these packages. Always test upgrades in a test environment before #   deploying to your production systems.
\- Isn't designed to upgrade an existing Docker installation. When using the script to update an existing installation, dependencies may not be updated to the expected version, resulting in outdated versions.
\# # Source code is available at https://github.com/docker/docker-install/
\# # Usage # ============================================================================== # # 
To install the latest stable versions of Docker CLI, Docker Engine, and their # dependencies:
1\. download the script # #   $ curl -fsSL https://get.docker.com -o install-docker.sh
2\. verify the script's content  $ cat install-docker.sh
3\. run the script with --dry-run to verify the steps it executes $ sh install-docker.sh --dry-run
4\. run the script either as root, or using sudo to perform the installation. $ sudo sh install-docker.sh
Backups/Miker/.trash/EHLO Response Codes.md
+25
View File
@@ -0,0 +1,25 @@
-------------------------------
> Please note that the presence and specific **EHLO response codes** will depend on the **SMTP server software**, its version, and its configuration. The above table includes some commonly encountered **EHLO response codes**, but it may not cover every possible code or extension.
| EHLO Response Code | Description |
| --- | --- |
| 250 | Requested mail action okay, completed |
| 250-PIPELINING | Server supports command pipelining |
| 250-SIZE `<value>` | Server specifies maximum message size |
| 250-ETRN | Server supports the ETRN extension |
| 250-ENHANCEDSTATUSCODES | Server uses enhanced status codes |
| 250-8BITMIME | Server supports the 8BITMIME extension |
| 250-DSN | Server supports delivery status notifications (DSN) |
| 250-STARTTLS | Server supports TLS encryption |
| 250-AUTH `<authentication_types>` | Server specifies supported authentication types |
| 250-DELIVERBY | Server supports the DELIVERBY extension |
| 250-RSET | Server supports the RSET command |
| 250-HELP | Server provides help information |
| 250-BINARYMIME | Server supports binary MIME (Multipurpose Internet Mail Extensions) |
| 250-CHUNKING | Server supports chunking for message transmission |
| 250-EXPN | Server supports the EXPN command |
| 250-VRFY | Server supports the VRFY command |
| 250-X-EXPS `<extension>` | Server supports an additional extension |
| 250 X-LINK2STATE | Server provides link-related state information |
Backups/Miker/.trash/EIOD - Airwatch.md
+50
View File
@@ -0,0 +1,50 @@
SME
~~Saqib Asadullah (CTR)~~
~~Mobility Architect~~
~~U.S. Customs & Border Protection (CBP)~~
~~Department of Homeland Security (DHS)~~
~~saqib.asadullah@cbp.dhs.gov~~
~~(202) 774 7589 - Work~~
~~(202) 704 0007 - Cell~~
**Michael Mitchell**
CBP Mobility Team Lead
==Customs and Border Protection / Department of Homeland Security==
==Mobility and Collaboration Branch (MCB)==
==EIOD/OIT/CBP/DHS==
Work: 571-385-5270
Mobile: 760-617-8356
CBP email: [michael.a.mitchell@associates.cbp.dhs.gov](mailto:michael.a.mitchell@associates.cbp.dhs.gov)
Corporate email: [michael.mitchell@sev1tech.com](mailto:michael.mitchell@sev1tech.com)
[www.sev1tech.com](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2Fnam12.safelinks.protection.outlook.com%2F%3Furl%3Dhttp*3A*2F*2Fwww.sev1tech.com*2F%26data%3D04*7C01*7Cmichael.mitchell*40sev1tech.com*7C6552b7dd8e2f4585066b08d99d594276*7C35a9e95ba13b4ba5a22fa6016635f555*7C0*7C0*7C637713828975438297*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000%26sdata%3DEBL8vkBv9cdI0jz0yJfOsDE2JsNrUYhvgbVMleO1Ip0*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSU!!BClRuOV5cvtbuNI!TjHFMwU_SZRx22gE-nR7CWKNnBO8ou5qAzBjxHI7FdXmRa1vD4nMHVAZcU_N2jAI_3lX1yAE1BhmyCwjvHc%24&data=05%7C02%7CNEIL.J.RAZZANO%40cbp.dhs.gov%7C5abc48488a5f4fc3343908dcb61f3fab%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638585492535085229%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=NoNubkKjsgvndQC32xkUprxPUCVPLAdIQJLJoSxvJl0%3D&reserved=0)
 
 
**cbpairwatchoperationsgml.cbp.dhs.gov@cbp.dhs.gov**
BRECKENRIDGE, TAYLAR O \<taylar.o.breckenridge@cbp.dhs.gov\>;
BRIDGES, BRIAN \<brian.bridges@cbp.dhs.gov\>;
CANTY, ANTOINE R (CTR) \<ANTOINE.R.CANTY@associates.cbp.dhs.gov\>;
CHEAH, KHEE-JIN (CTR) \<KHEEJIN.CHEAH@associates.cbp.dhs.gov\>;
DUMAS, MICHELLE \<MICHELLE.DUMAS@cbp.dhs.gov\>;
GRAVES, TONY C \<TONY.C.GRAVES@cbp.dhs.gov\>;
LEAPHART, NICHOLAS W (CTR) \<nicholas.w.leaphart@associates.cbp.dhs.gov\>;
MASON, GREGORY \<GREGORY.MASON@cbp.dhs.gov\>;
MCFETRIDGE, REBEL L \<REBEL.L.MCFETRIDGE@CBP.DHS.GOV\>;
MITCHELL, MICHAEL A (CTR) \<MICHAEL.A.MITCHELL@associates.cbp.dhs.gov\>;
NAVANGUL, VICK B \<VICK.B.NAVANGUL@cbp.dhs.gov\>;
PAREKH, SANJAY R (CTR) \<SANJAY.R.PAREKH@associates.cbp.dhs.gov\>;
PFROMMER, BRETT C \<BRETT.PFROMMER@cbp.dhs.gov\>;
SAJID, RAIS M \<RAIS.M.SAJID@associates.cbp.dhs.gov\>;
SINGEL, DAVID A \<DAVID.A.SINGEL@cbp.dhs.gov\>;
STAPLES, JAMAR B (CTR) \<JAMAR.B.STAPLES@associates.cbp.dhs.gov\>;
THOMAS, RODERICK E (CTR) \<RODERICK.E.THOMAS@associates.cbp.dhs.gov\>;
WALLACE, RAYMOND H \<RAYMOND.H.WALLACE@CBP.DHS.GOV\>;
Works, Aaron \<Aaron.Works@cbp.dhs.gov\>
Federal Lead:
Jack MacNeil, PMP
Director, Mobility and Collaboration Branch (MCB)
DHS | CBP | ES | OIT | ENTSD
Work: 407-975-2094
Mobile: 703-943-7757
JOHN.J.MACNEIL@cbp.dhs.gov
Backups/Miker/.trash/EIOD - Virtualization Team.md
+20
View File
@@ -0,0 +1,20 @@
Fed lead: Rob Hilts
Contract: Lindsey Geer
**James Neville - (Contractor)**
Virtualization Architect
ASM Research | CBP EIOD | EIOD Virtualization
Mobile (703) 932-6798, [james.neville@cbp.dhs.gov](mailto:james.neville@cbp.dhs.gov)
 
BAIG, MIRZA A. (CTR) \<mirza.a.baig@cbp.dhs.gov\>;
BLYTHER, JAMIE (CTR) \<JAMIE.BLYTHER@associates.cbp.dhs.gov\>;
GEER, LINDSEY (CTR) \<LINDSEY.GEER@associates.cbp.dhs.gov\>;
GREGORY, SCOTT (CTR) \<scott.gregory@associates.cbp.dhs.gov\>;
HILTS, ROBERT \<ROBERT.HILTS@CBP.DHS.GOV\>;
KING, ERIC \<ERIC.KING@cbp.dhs.gov\>;
MCFETRIDGE, MICHAEL E \<Michael.E.McFetridge@cbp.dhs.gov\>;
MORRELL, NICHOLAS (CTR) \<nicholas.morrell@cbp.dhs.gov\>;
NEVILLE, JAMES (CTR) \<JAMES.NEVILLE@cbp.dhs.gov\>;
PEERENBOOM, JOHN W(CTR) \<john.w.peerenboom@associates.cbp.dhs.gov\>;
SINGH, BHUPINDER \<BHUPINDER.SINGH@cbp.dhs.gov\>;
VIEHL, WILLIAM G (CTR) \<WILLIAM.G.VIEHL@cbp.dhs.gov\>
Backups/Miker/.trash/EIOD - WSG Phone.md
+58
View File
@@ -0,0 +1,58 @@
| | | |
|---|---|---|
|**POC**|**Cell Phone**|**Forward PIN**|
|Mike McFetridge|202-870-2233||
|Ben Kellerman|703-930-6489|762-249|
|Jeff Colbert|703-939-0828||
|Neil Razzano|703-843-1532|594-826|
|Duty Officer - Main|703-921-6620||
|Duty Officer - Cell|540-379-0285||
|TOC - Main|703-921-6068||
|Helpdesk|800-927-8729||
WSG on-call **wwwwwwwww**
| | | |
|---|---|---|
|**WSG ROTATION is:**|**Cell Phone**|**Forward PIN**|
|Damon McGee|703-939-0563|762-549|
|Marcus Gregoire|703-939-0769|154-687|
|Joe White|703-547-7977|462-198|
|Craig Frishman|703-843-1345|315-174|
|Brian Schwetz|703-939-0560|286-931|
|Rebecca Sites|571-329-2298|925-153|
|Mirwais Shpoon|571-330-0537|465-528|
|Tehmina Mahmud|571-482-0847|116-455|
|Bryan Buzzell|703-999-7426|684-265|
Transferring\Forwarding the On Call Duty Phone
Physical Access to the Phone required
![Machine generated alternative text USING YOUR SONI...](Exported%20image%2020250808210714-0.png)
1. Power (12) on the Phone
2. Press App Tray (10)
3. Navigate (9) to the "Phone" Icon, Press Select (11)
4. Press Options (6)
5. Navigate and highlight "Call Settings", Press Select
6. Navigate and highlight "Calls", Press Select
7. Navigate and highlight "Call forwarding", Press Select
8. Voice is Already Highlighted, Press Select
9. Navigate and highlight "Always forward", Press Select
10. In the Area Shown is the current Phone number being forwarded too
11.
1. Enter the number you wish to forward too
2. Navigate all the way to the Right and highlight the User ICON , Press Select
12. Navigate to the WSG Member, Press Select
13. Back on the "Always Forward" Screen , Navigate and highlight "Update", Press Select
14. Settings will Update
15. When done Backout (14) of all Screens, Turn Off Phone.
OR (Recommended)
This opens the Contacts List on the Phone
All WSG staff should have a contact in the Phone
![[WSG_Duty_Phone_Schedule.xlsx]]
![Exported image](Exported%20image%2020250808210719-1.octet-stream)
Backups/Miker/.trash/Emojify.md
+13
View File
@@ -0,0 +1,13 @@
---
copilot-command-context-menu-enabled: true
copilot-command-slash-enabled: true
copilot-command-context-menu-order: 1050
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Add relevant emojis to enhance {}. Follow these rules:
1. Insert emojis at natural breaks in the text
2. Never place two emojis next to each other
3. Keep all original text unchanged
4. Choose emojis that match the context and tone
Return only the emojified text.
Backups/Miker/.trash/Ethtool Cheat-Sheet.md
+37
View File
@@ -0,0 +1,37 @@
Displaying Information
----------------------
| Command | Description |
| --- | --- |
| `ethtool <interface>` | Display information about a specific network interface |
| `ethtool -i <interface>` | Display driver information |
| `ethtool -a <interface>` | Display all settings |
| `ethtool -k <interface>` | Display offload settings |
| `ethtool -c <interface>` | Display coalescing settings |
| `ethtool -g <interface>` | Display ring buffer settings |
| `ethtool -l <interface>` | Display large receive offload settings |
| `ethtool -S <interface>` | Display statistics |
| `ethtool -t <interface>` | Test the network interface for offloading capabilities |
| `ethtool -T <interface>` | Display time stamping settings |
| `ethtool -x <interface>` | Display channel settings |
| `ethtool -P <interface>` | Display permanent MAC address |
| `ethtool -N <interface>` | Display offload settings |
| `ethtool -u <interface>` | Display bus information |
| `ethtool -d <interface>` | Display register dump |
| `ethtool -g <interface>` | Display ring buffer settings |
Setting Parameters
------------------
| Command | Description |
| --- | --- |
| `ethtool -G <interface>` | Set ring buffer settings |
| `ethtool -L <interface>` | Set large receive offload settings |
| `ethtool -A <interface>` | Set pause parameters |
| `ethtool -C <interface>` | Set coalescing settings |
| `ethtool -K <interface>` | Set offload settings |
| `ethtool -N <interface>` | Set offload settings |
| `ethtool -p <interface>` | Blink the LED on the network interface |
| `ethtool -r <interface>` | Reset the network interface |
Backups/Miker/.trash/Explain like I am 5 2.md
+12
View File
@@ -0,0 +1,12 @@
---
copilot-command-context-menu-enabled: true
copilot-command-slash-enabled: true
copilot-command-context-menu-order: 1040
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Explain {} in simple terms that a 5-year-old would understand:
1. Use basic vocabulary
2. Include simple analogies
3. Break down complex concepts
Return only the simplified explanation.
Backups/Miker/.trash/Explain like I am 5.md
+12
View File
@@ -0,0 +1,12 @@
---
copilot-command-context-menu-enabled: true
copilot-command-slash-enabled: true
copilot-command-context-menu-order: 1040
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Explain {} in simple terms that a 5-year-old would understand:
1. Use basic vocabulary
2. Include simple analogies
3. Break down complex concepts
Return only the simplified explanation.
Backups/Miker/.trash/Exported image 20250808210719-1.octet-stream
BIN
View File
Binary file not shown.
Backups/Miker/.trash/FSD - Desktop Management Group (DMG).md
+50
View File
@@ -0,0 +1,50 @@
[desktopmanagementgroup@cbp.dhs.gov](mailto:desktopmanagementgroup@cbp.dhs.gov)
[DMG SharePoint](https://cbpgov.sharepoint.com/sites/OIT-FS/eote/DMG/Pages/Welcome.aspx)
[Wiki Articles](https://cbpgov.sharepoint.com/sites/OIT-FS/eote/DMG/Desktop%20Management%20Wiki/Home.aspx)
==Fast Publish Notifications==
_Lawrence Morck_  **ITIL® v3 COR**
_(A) Desktop Management Group_ 
_FSD/OIT/ES/CBP/DHS_
_(571) 468-2003 (Desk)_
_(703) 203-4314 (Cell)_
_E-Mail:_ _Lawrence.G.Morck@Cbp.Dhs.Gov_
Alizadeh, Maryam (CTR) \<maryam.alizadeh@cbp.dhs.gov\>;
ANDERSON, TONIE \<TONIE.ANDERSON@cbp.dhs.gov\>;
AZIZ, ASIF W (CTR) \<asif.w.aziz@cbp.dhs.gov\>;
BACKUS, JOSEPH C (CTR) \<joseph.c.backus@cbp.dhs.gov\>;
BUNTEN, DAVID T (CTR) \<DAVID.T.BUNTEN@associates.cbp.dhs.gov\>;
CEKALA, CHRISTINA A \<CHRISTINA.A.CEKALA@cbp.dhs.gov\>;
CONTRERAS, GLORIA H \<GLORIA.H.CONTRERAS@cbp.dhs.gov\>;
DAVIS, JOSHUA S ( CTR) \<JOSHUA.S.DAVIS@associates.cbp.dhs.gov\>;
FRAZIER, NORMAN H (CTR) \<norman.h.frazier@associates.cbp.dhs.gov\>;
GOODNIGHT, MARK A (CTR) \<MARK.A.GOODNIGHT@associates.cbp.dhs.gov\>;
HARRIS, RASHIME T (CTR) \<RASHIME.T.HARRIS@associates.cbp.dhs.gov\>;
HARRISON, VINCENT R \<VINCENT.R.HARRISON@CBP.DHS.GOV\>;
HAUPT, ROBERT A (CTR) \<robert.a.haupt@cbp.dhs.gov\>;
HINES, SUZETTE R (CTR) \<SUZETTE.R.HINES@cbp.dhs.gov\>;
HWANG, KC \<KC.HWANG@CBP.DHS.gov\>;
JONES, THOMAS L \<THOMAS.L.JONES@CBP.DHS.gov\>;
KHAN, MOHAMMAD Z (CTR) \<MOHAMMAD.Z.KHAN@associates.cbp.dhs.gov\>;
KLECHA, EDWARD A (CTR) \<EDWARD.A.KLECHA@associates.cbp.dhs.gov\>;
LE, TINA Q \<TINA.Q.LE@CBP.DHS.GOV\>;
LLOYD, BRIAN R \<BRIAN.R.LLOYD@cbp.dhs.gov\>;
LOVELESS, JOHNATHAN M. (CTR) \<johnathan.m.loveless@cbp.dhs.gov\>;
MANGUBA, EVELYN T. (CTR) \<evelyn.t.manguba@cbp.dhs.gov\>;
MARRIOTT, DENNIS K. (CTR) \<dennis.k.marriott@cbp.dhs.gov\>;
MASON, BONNIE D (CTR) \<VRENDABANE.D.MASON@cbp.dhs.gov\>;
MILLER, JUSTIN M (CTR) \<justin.m.miller.2@associates.cbp.dhs.gov\>;
NORTHROP, ERIK E.(CTR) \<ERIK.E.NORTHROP@associates.cbp.dhs.gov\>;
ROBINSON, KAI A (CTR) \<KAI.A.ROBINSON@associates.cbp.dhs.gov\>;
SALOMON, MARC S (OIT) \<Marc.S.Salomon@cbp.dhs.gov\>;
SMITH, CASEY R \<CASEY.R.SMITH@cbp.dhs.gov\>;
SMITH, TAMI D ( CTR ) \<TAMI.D.SMITH@associates.cbp.dhs.gov\>;
SONG, DANIEL C (CTR) \<daniel.c.song@associates.cbp.dhs.gov\>;
STADIG, WADE M \<WADE.M.STADIG@CBP.DHS.GOV\>;
STOCH, PIOTR G. (CTR) \<PIOTR.G.STOCH@associates.cbp.dhs.gov\>;
THOMAS, MITCHELL T (CTR) \<MITCHELL.T.THOMAS@associates.cbp.dhs.gov\>;
TRACY II, RICHARD (CTR) \<RICHARD.TRACYII@associates.cbp.dhs.gov\>;
WELCH, ROBERT J (CTR) \<ROBERT.J.WELCH@cbp.dhs.gov\>;
WRIGHT, AARON \<AARON.WRIGHT@cbp.dhs.gov\>
Backups/Miker/.trash/FastFetch Config.md
+149
View File
@@ -0,0 +1,149 @@
config.json
```
{
"$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
"logo": {
"type": "builtin",
"height": 15,
"width": 30,
"padding": {
"top": 5,
"left": 3
}
},
"modules": [
"break",
{
"type": "custom",
"format": "\u001b[90m┌──────────────────────Hardware──────────────────────┐"
},
{
"type": "host",
"key": " PC",
"keyColor": "green"
},
{
"type": "cpu",
"key": "│ ├",
"keyColor": "green"
},
{
"type": "gpu",
"key": "│ ├󰍛",
"keyColor": "green"
},
{
"type": "memory",
"key": "│ ├󰍛",
"keyColor": "green"
},
{
"type": "disk",
"key": "└ └",
"keyColor": "green"
},
{
"type": "custom",
"format": "\u001b[90m└────────────────────────────────────────────────────┘"
},
"break",
{
"type": "custom",
"format": "\u001b[90m┌──────────────────────Software──────────────────────┐"
},
{
"type": "os",
"key": " OS",
"keyColor": "yellow"
},
{
"type": "kernel",
"key": "│ ├",
"keyColor": "yellow"
},
{
"type": "bios",
"key": "│ ├",
"keyColor": "yellow"
},
{
"type": "packages",
"key": "│ ├󰏖",
"keyColor": "yellow"
},
{
"type": "shell",
"key": "└ └",
"keyColor": "yellow"
},
"break",
{
"type": "de",
"key": " DE",
"keyColor": "blue"
},
{
"type": "lm",
"key": "│ ├",
"keyColor": "blue"
},
{
"type": "wm",
"key": "│ ├",
"keyColor": "blue"
},
{
"type": "wmtheme",
"key": "│ ├󰉼",
"keyColor": "blue"
},
{
"type": "terminal",
"key": "└ └",
"keyColor": "blue"
},
{
"type": "custom",
"format": "\u001b[90m└────────────────────────────────────────────────────┘"
},
"break",
{
"type": "custom",
"format": "\u001b[90m┌────────────────────Uptime / Age / DT────────────────────┐"
},
{
"type": "command",
"key": " OS Age ",
"keyColor": "magenta",
"text": "birth_install=$(stat -c %W /); current=$(date +%s); time_progression=$((current - birth_install)); days_difference=$((time_progression / 86400)); echo $days>
},
{
"type": "uptime",
"key": " Uptime ",
"keyColor": "magenta"
},
{
"type": "datetime",
"key": " DateTime ",
"keyColor": "magenta"
},
{
"type": "custom",
"format": "\u001b[90m└─────────────────────────────────────────────────────────┘"
},
// {
// "type": "colors"
// },
{
"type": "colors",
"paddingLeft": 2,
"symbol": "circle"
}
]
}
```
Backups/Miker/.trash/Fix grammar and spelling 2.md
+8
View File
@@ -0,0 +1,8 @@
---
copilot-command-context-menu-enabled: true
copilot-command-slash-enabled: true
copilot-command-context-menu-order: 1000
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Fix the grammar and spelling of {}. Preserve all formatting, line breaks, and special characters. Do not add or remove any content. Return only the corrected text.
Backups/Miker/.trash/Fix grammar and spelling.md
+8
View File
@@ -0,0 +1,8 @@
---
copilot-command-context-menu-enabled: true
copilot-command-slash-enabled: true
copilot-command-context-menu-order: 1000
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Fix the grammar and spelling of {}. Preserve all formatting, line breaks, and special characters. Do not add or remove any content. Return only the corrected text.
Backups/Miker/.trash/Font Install Script.md
+8
View File
@@ -0,0 +1,8 @@
Using the Nerd Fonts Downloader Script
Several shell scripts simplify the process of downloading and installing Nerd Fonts. 
- Download and run the installer script from GitHub:**
- bash -c "$(curl -fsSL [https://raw.githubusercontent.com/officialrajdeepsingh/nerd-fonts-installer/main/install.sh](https://raw.githubusercontent.com/officialrajdeepsingh/nerd-fonts-installer/main/install.sh))"
- Select which font you want to install
Note: This command downloads and executes the script, which will then prompt you to choose the desired Nerd Font (including Hack) from a list. Follow the on-screen prompts to select and install Hack Nerd Font**.
Backups/Miker/.trash/Free IPA - Setup and Install.md
+219
View File
@@ -0,0 +1,219 @@
FreeIPA
-------
### Basics
FreeIPA (a.k.a. Identity Management by RedHat) is a free, open source alternative to Active Directory type services for Linux / Unix.
The Installation of the server side works best on RedHat, Fedora, and / or CentOS systems (all RedHat based systems).
A client must be installed in order to join a Machine to the domain and use the IPA system for authenticaion.
### Requirements
### Server
* Needs to have a fixed (sttic) IP Address.
* Needs to have a FQDN (Fully Qualified Domain Name)
* The Domain Name must be owned by you, or a local only type domain (best to end with .local).
* You must update the server's hostname and /etc/hosts file entries.
* The FQDN must be first after the IP in /etc/hosts, and then the shortname afterthat.
* Example: FQDN = ipa.mydomain.local Shortname = ipa
#### The Download Process
1. You must download the freeipa server software if it's not already in the distro you chose.
2. You then run the installation of the software and configure the server.
#### DNS
It is extremely important to have a system setup for DNS, and to ensure that your LAN can find machines by hostname, not just by IP address.
* For this I use Pi-Hole. I make manual entries for the machines I'm adding to the domain.
* I check this by using nslookup
If you don't have a shared server for shared home directories, you should enable the ability to make home directories for each domain user sho may log into a system.
You do this with the \--enablemkhomedir option on the server.
#### My Commands and Steps
Install Fedora 32 Workstation
Make sure it's updated completely - use sudo dnf update -y
Make sure you have an IP on the LAN (using Virtual Box or VirtManager you need to ensure you've setup and enabled a bridged network connection.
Edit the hostname and /etc/hosts files:
sudo nano /etc/hostname
make sure to enter an FQDN (can't be localhost at all).
Now update the /etc/hosts file using
sudo nano /etc/hosts
and make sure it looks something like
192.168.7.226 ipa.mydomain.local ipa
127.0.0.1 localhost
The next bits are easier to run as root, so just do
sudo su
and enter your sudo password when prompted.
You also need to setup your firewall to have some open ports. Luckily on Fedora this is easily accomplished with two commands.
firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps
firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps --permanent
Now, we'll pull down the freeipa seerver software.
yum install freeipa-server freeipa-server-dns nfs-utils
Next, we reboot so nfs-utils will kick in.
reboot
Once back up, go back into root:
sudo su
Enter your sudo password when prompted.
Once you have your pre-requisites installed and setup we'll run the ipa-server-install command and go through the steps to get our server setup.
ipa-server-install --mkhomedir
There will be some question during the process we need to answer...
After a successful install, you'll want to run the command
kinit admin
As this generates the necessary admin keys to get the Web UI ready for login, as well as for running admin commands from the cli if desired.
* * *
### Client Install
For the client install we'll use Ubuntu 20.04. Ubuntu is one of the most popular, if not the most popular desktop distributionsn for Linux, our there, thus I'm using it for this demo.
First, we'll install ubuntu 20.04.
Next, update the OS and make sure all updates are installed with
sudo apt update && sudo apt upgrade -y
Next, make sure you've setup the IP address as part of your LAN (particularly if you're using Virtualbox or VirtManager - you need to have a bridge network setup so the machine can see / reach other machines).
### Setup IP and FQDN
ip addr show
Will show you a list of ip addresses assigned to various network interfaces on the install.
You want the one that matches your LAN IP pattern.
In my case, i'll be using the one with "192.168.7.x"
Next, just as with the server, we need to ensure that the IP is set as a static IP, and we need to make sure we give the machine a FQDN (Fully Qualified Domain Name - e.g. "ipa-client1.mydomain.local").
sudo nano /etc/hosts
In this file ensure you have the following setup:
127.0.0.1 localhost
127.0.1.1 ipa-client1.mydomain.local ipa-client1
192.168.7.x ipa-client1.mydomain.local ipa-client1
192.168.7.150 ipasrv2.mydomain.local ipasrv2
Next, make sure the "/etc/hostname" file also has the correct hosname.
sudo nano /etc/hostname
it should have something like:
ipa-client1.mydomain.local
If not, make sure to change it to the proper hostname, then save.
Finally, make sure to add a DNS reference in your local DNS (router, or whatever, but in my case a Pi-Hole) to the client machine FQDN and IP.
### Download the Software
Now, we need to download the freeipa client.
sudo apt install freeipa-client
While this isn't that actual client install and configuration, it will actually prompt you for a couple of bits of information, so you need to know what that is and be ready.
First screen in the terminal will be for "Configuring Kerberos Authentication", and will ask for the Kerberos version X realm.
this is basically the domain, and may be filled in by default, so if it is, just tab to 'ok', and move on. If not, type in the domain in all caps:
MYDOMAIN.LOCAL
then tab to 'Ok' and move forward.
Next, it will ask for the Kerberos server for your realm. This is just the FQDN of your server that we setup previously.
ipasrv2.mydomain.local
Next is the Administrative server for your Kerberos realm. It's the same server.
ipasrv2.mydomain.local
Once you've entered those items, the download / install will continue.
### Check your network settings one more time
Now, before we move forward with the final configuration and install of the freeipa client, it's a good idea to make sure that our server and client resolve to the right name and IP.
nslookup ipa-client1.mydomain.local
You should get the proper IP back.
nslookup ipasrv2.mydomain.local
Again, you should get the proper IP back.
### Run the final Install and Configuration
This is again, easier to run as root, so you can do:
sudo su -
in a terminal, and enter your sudo user password when prompted.
Now, we'll run our final install command for our Free IPA client machine.
ipa-client-install --mkhomedir
PLEASE NOTE: The \--mkhomedir part is VERY IMPORTANT.
If you do this, without that bit, and you have not setup network storage for user home directories somewhere else (and I'm not covering that here), then the client install may succeed, but upon trying to login using an LDAP user afterward, you'll get frustrated when you aren't taken to the desktop.
This happens becuase the system doesn't know where your home directory is, and won't create one for you without that flag.
#### Interactive Install Prompts
As with our server install, the client install has interactive prompts, and you will likely have to fill out a few bits of information as it goes through.
When you are done you should see a message that says:
`The ipa-client-install command was successful`
Time for one last reboot.
\# Logging in with LDAP / FreeIPA user
Before you try to login wtih LDAP, you of cource need to create a user. For this we go back to the server web ui, and get started.
Backups/Miker/.trash/Generate glossary.md
+8
View File
@@ -0,0 +1,8 @@
---
copilot-command-context-menu-enabled: false
copilot-command-slash-enabled: false
copilot-command-context-menu-order: 1090
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Create a glossary of important terms, concepts, and phrases from {}. Format each entry as "Term: Definition". Sort entries alphabetically. Return only the glossary.
Backups/Miker/.trash/Generate table of contents.md
+8
View File
@@ -0,0 +1,8 @@
---
copilot-command-context-menu-enabled: false
copilot-command-slash-enabled: false
copilot-command-context-menu-order: 1080
copilot-command-model-key: ""
copilot-command-last-used: 0
---
Generate a hierarchical table of contents for {}. Use appropriate heading levels (H1, H2, H3, etc.). Include page numbers if present. Return only the table of contents.
Backups/Miker/.trash/Git.md
+50
View File
@@ -0,0 +1,50 @@
Repository Management
---------------------
| Command | Description |
| --- | --- |
| `git init` | Initialize a new Git repository |
| `git clone <url>` | Clone a remote repository |
| `git status` | Show the working tree status |
| `git add <file>` | Add a file to the staging area |
| `git commit -m <message>` | Commit changes to the repository |
| `git push` | Push changes to the remote repository |
| `git pull` | Pull changes from the remote repository |
| `git fetch` | Fetch changes from the remote repository |
| `git merge <branch>` | Merge a branch into the current branch |
| `git branch` | List all branches |
| `git branch <branch>` | Create a new branch |
| `git checkout <branch>` | Switch to a branch |
| `git checkout -b <branch>` | Create and switch to a new branch |
| `git branch -d <branch>` | Delete a branch |
| `git log` | Show commit logs |
| `git diff` | Show changes between commits |
| `git blame <file>` | Show who changed each line in a file |
| `git reflog` | Show a log of changes to HEAD |
| `git reset --hard <commit>` | Reset the repository to a commit |
| `git revert <commit>` | Revert a commit |
| `git stash` | Stash changes in the working directory |
| `git stash pop` | Apply stashed changes to the working directory |
| `git tag <tag>` | Create a tag for a commit |
Configuration
-------------
| Command | Description |
| --- | --- |
| `git config --global user.name <user>` | Set the user name for Git |
| `git config --global user.email <email>` | Set the user email for Git |
| `git config --global core.editor <editor>` | Set the default text editor for Git |
| `git config --global color.ui auto` | Enable colored output for Git |
Remote Repositories
-------------------
| Command | Description |
| --- | --- |
| `git remote add <repository> <url>` | Add a remote repository |
| `git remote -v` | List remote repositories |
| `git remote show <repository>` | Show information about a remote repository |
| `git remote rename <repository> <new_repository>` | Rename a remote repository |
| `git remote remove <repository>` | Remove a remote repository |
Backups/Miker/.trash/Gitea Install Guide.md
+127
View File
@@ -0,0 +1,127 @@
<think>
Okay, let's break down the user's request first. They want me to explain a Docker Compose file and provide installation steps. The provided context shows two different Docker Compose configurations - one for Gitea with MySQL database using standard images, and another for MariaDB with npm-db service.
Hmm, interesting that they're asking about both files though the user didn't explicitly mention which one. Looking at Context 0: It's a Gitea setup file with three services (db, gitea, runner) all in a bridge network called 'gitea'. This seems to be for setting up Git hosting services locally.
Context 1 appears different - it mentions npm-db and MariaDB with volume './data/mysql:/var/lib/mysql', which suggests this might be for Node.js related projects. The user didn't specify which file they're referring to though.
The user's follow-up question is actually quite broad since we don't know exactly which service configuration they need help with. They want both an explanation and installation instructions, but without knowing the exact use case (Git server vs database setup), I can only focus on the first context provided about Gitea.
I should explain that while they requested one docker-compose file, two different configurations were provided in the contexts - one for Git hosting services and another possibly related to npm with MariaDB. Since we don't know which was originally intended, I'll focus on explaining the available information (the Gitea configuration) as much as possible.
The user seems technically proficient enough to handle Docker setups but might be looking for clarification about how specific components interact in this environment. They're likely setting up some development or testing infrastructure and need guidance.
</think>
Okay, here is a technical explanation of the `docker-compose.yml` content provided (Context 0), followed by step-by-step instructions on how to use it.
**Technical Explanation**
This Docker Compose file (`docker-compose.yml`) defines three distinct services within named networks called "gitea":
1. **Database Service (`db`):**
* Uses the official MySQL image version 8.
* Container Name: `gitea-db`
* Restart Policy: `unless-stopped` - The container will automatically restart if it stops, unless explicitly stopped by an administrator command or Docker daemon rules (like on shutdown).
* Environment Variables: Loaded from a `.env` file and sets standard database credentials (`MYSQL_ROOT_PASSWORD`, `MYSQL_DATABASE`, etc.).
* Volumes: Mounts the host's current directory (`./mysql`) into the container's default MySQL data location (`/var/lib/mysql`). This stores the Dockerized database files on your host machine for persistence.
* Networks: Connects to the "gitea" bridge network so other services can communicate with it via its internal name ("db").
* Healthcheck: Uses `mysqladmin ping` command against the local MySQL server (`localhost`) using user and password from environment variables. Checks occur every 10 seconds, wait up to 5s for a response, retry 5 times (total 50s). If it fails, the service is marked unhealthy.
2. **Gitea Service (`gitea`):**
* Uses the official Gitea image from Docker Hub (`gitea/gitea:latest`). This sets up a Git server.
* Container Name: `gitea`
* Restart Policy: `unless-stopped` - Same behavior as the database service regarding automatic restarts.
* Environment Variables: Loaded from `.env`. It requires user ID and group ID (`USER_UID=1000`, `USER_GID=1000`) for proper file ownership within its data volume. The crucial Gitea configuration variables are set here, pointing it to the database server ("db"), specifying the DB type (likely "mysql", loaded from `.env`), and providing credentials (`GITEA__database__...`). It also sets a higher priority port mapping for access.
* Volumes: Mounts two directories on the host:
- `./gitea:/data`: Stores Gitea's application data (repositories, configuration files, logs) in `/data` within the container. Host directory is `./gitea`.
- `/etc/localtime:/etc/localtime:ro`: Makes this container use your host system's timezone setting.
* Networks: Connects to the "gitea" bridge network.
* Depends On: The service definition includes a condition (`service_healthy`) that ensures it waits for the `db` service (named dependency) to pass its health checks before starting. Gitea itself uses an internal healthcheck via `curl`.
* Ports:
- `"3000:3000"`: Exposes Gitea's web UI port from container 3000 to host 3000.
- `"222:22"`: Exposes the SSH server port from container 22 (default for Docker image) to host 222. This allows accessing Git repositories via SSH clients.
3. **Gitea Runner Service (`runner`):**
* Uses a dedicated Gitea CI runner image (`gitea/act_runner:latest`).
* Container Name: `gitea-runner`
* Restart Policy: `unless-stopped`.
* Depends On: Will wait for the `gitea` service (named dependency) to be healthy before starting.
* Environment Variables: Loaded from `.env`. Key variables include Gitea's instance URL (`GITEA_INSTANCE_URL`) and a registration token (`GITEA_RUNNER_REGISTRATION_TOKEN`). It also specifies its name, labels for job routing, and log level (trace). Crucially, it sets the `GITEA_RUNNER_JOB_CONTAINER_NETWORK` to "gitea".
* Volumes: Mounts three directories:
- `./runner-data:/data`: Stores CI artifacts or runner-specific data in a subdirectory of Gitea's main directory.
- `/config.yaml`: This line seems incorrect as provided. Assuming it means mounting the host-side generated configuration file (which is typically done elsewhere) but based on the pattern, it should likely be `- ./runner-config.yaml:/config.yaml`. The `act_runner` *needs* this config file internally, so providing one via volume mount from `./runner-config.yaml` would configure it appropriately. This directory (`./runner-data`) exists and holds persistent data for jobs.
- `/var/run/docker.sock:/var/run/docker.sock`: Mounts the host's Docker socket into this container. The Gitea runner executes CI commands within a separate Docker container (using `act`). Access to the host's Docker socket is necessary for it to perform these actions (`docker run ...`).
**Common Elements:**
* `.env`: Used by multiple services to load environment variables, likely containing secrets and configuration values.
* `gitea` network: A bridge network connecting all three services. They communicate via their internal names (like `db`, `gitea`, `runner`) on this network.
**Purpose:** This setup creates a self-contained local instance of Gitea and its CI runner, with an accompanying MySQL database. It's useful for testing Git functionalities locally or setting up a personal/private Git server without needing to install the software directly on the host OS.
---
**Step-by-Step Installation Guide (Based on Context 0)**
This guide assumes you want to set up Gitea and its runner using Docker Compose with a MySQL database. The instructions are for this specific configuration file structure shown in Context 0.
1. **Prerequisites:**
* Ensure your host machine meets the [requirements](https://docs.gitea.com/installation/requirements) for running Gitea.
* Install [Docker Engine](https://docs.docker.com/engine/install/) and [Docker Compose V2](https://docs.docker.com/compose/v2/) on your system (Windows, macOS, Linux).
* Have a `.env` file ready or create one. This file should contain the necessary environment variables for Gitea and MySQL.
* Example contents of your `.env` file might include:
```
MYSQL_ROOT_PASSWORD=your_root_password
MYSQL_DATABASE=gitea_db_name # Name for the database used by Gitea
MYSQL_USER=mysql_user # Database user (Gitea)
MYSQL_PASSWORD=mysql_password # Password for that user
GITEA_APP_NAME=Gitea_Instance_Name # Can be set here or in .env file, but also might default to image name.
GITEA__database__DB_TYPE=mysql
GITEA__database__HOST=db:3306 # "db" is the internal hostname for the MySQL service (from context)
GITEA__database__NAME=gitea_db_name # Same as MYSQL_DATABASE above, *or* this might override it. Check consistency.
GITEA__database__USER=mysql_user # Same as MYSQL_USER
GITEA__database__PASSWD=mysql_password # Same as MYSQL_PASSWORD
# For the runner (optional if you don't need CI)
GITEA_INSTANCE_URL=http://localhost:3000 # Should match your host mapping for gitea service (typically :3000)
GITEA_RUNNER_REGISTRATION_TOKEN=your_token
```
2. **Prepare the Directory Structure:**
* Create a directory where you want to run this setup.
* Copy both `docker-compose.yml` and `.env` files into that directory from wherever they are located (ensure Context 0's `docker-compose.yml` is used).
* Example structure:
```
/path/to/my/gitea/installation/
├── docker-compose.yml
├── .env
├── gitea/ # Will be created by the first run. Contains Gitea data (repositories, logs)
└── runner-data/ # Will be created by the Gitea runner container when it starts for the first time.
```
* Alternatively, if you are using a single `docker-compose.yml` file from Context 0 and want to manage other services later, ensure your chosen directory is correct.
3. **Start the Services:**
* Open a terminal or command prompt in the directory containing `docker-compose.yml`.
* Run the following command:
```
docker compose up -d
```
This command starts all three defined services (`db`, `gitea`, and `runner`) in detached mode (background).
4. **Verify Service Startup:**
* Check if the database service is healthy first, as it's critical for Gitea:
```
docker compose ps # Lists running containers
docker compose inspect gitea-db | grep -A10 'healthcheck.*Status' # Inspect container details to see health status (requires Docker Compose V2)
```
* Check the logs of all services if necessary for startup errors:
```
docker compose logs # Shows logs from all services
# Or specific one, e.g., `docker compose logs gitea` or `docker compose logs runner`
```
5. **Accessing Gitea:**
* Open a web browser and navigate to `http://localhost:3000`. The default username is `admin`, password is `root`.
* You might see an initial setup page if this is the first run.
**Note:** This configuration maps the SSH port (22 for container) to host 222. Remember that ports below 1024 often require root privileges on Linux systems, but Docker Compose handles these mappings appropriately regardless of OS usually.
Backups/Miker/.trash/HTTP Status Codes.md
+82
View File
@@ -0,0 +1,82 @@
Categories
----------
| Code | Description |
| --- | --- |
| **1XX** | Informational Requests |
| **2XX** | Successful Requests |
| **3XX** | Redirects |
| **4XX** | Client Errors |
| **5XX** | Server Errors |
Complete List
-------------
| Code | Name | Description |
| --- | --- | --- |
| 100 | Continue | Everything so far is OK and that the client should continue with the request or ignore it if it is already finished. |
| 101 | Switching Protocols | The client has asked the server to change protocols and the server has agreed to do so. |
| 102 | Processing | The server has received and is processing the request, but that it does not have a final response yet. |
| 103 | Early Hints | Used to return some response headers before final HTTP message. |
| 200 | OK | Successful request. |
| 201 | Created | The server acknowledged the created resource. |
| 202 | Accepted | The client's request has been received but the server is still processing it. |
| 203 | Non-Authoritative Information | The response that the server sent to the client is not the same as it was when the server sent it. |
| 204 | No Content | There is no content to send for this request |
| 205 | Reset Content | Tells the user agent to reset the document which sent this request. |
| 206 | Partial Content | This response code is used when the range-header is sent from the client to request only part of a resource. |
| 207 | Multi-Status | Conveys information about multiple resources, for situations where multiple status codes might be appropriate. |
| 208 | Already Reported | The members of a DAV binding have already been enumerated in a preceding part of the multi-status response. |
| 226 | IM Used | IM is a specific extension of the HTTP protocol. The extension allows a HTTP server to send diffs (changes) of resources to clients. |
| 300 | Multiple Choices | The request has more than one possible response. The user agent should choose one. |
| 301 | Moved Permanently | The URL of the requested resource has been changed permanently. The new URL is given in the response. |
| 302 | Found | This response code means that the URI of requested resource has been changed temporarily |
| 303 | See Other | The server sent this response to direct the client to get the requested resource at another URI with a GET request. |
| 304 | Not Modified | It tells the client that the response has not been modified, so the client can continue to use the same cached version of the response. |
| 305 | Use Proxy | Defined in a previous version of the HTTP specification to indicate that a requested response must be accessed by a proxy. (discontinued) |
| 307 | Temporary Redirect | The server sends this response to direct the client to get the requested resource at another URI with same method that was used in the prior request. |
| 308 | Permanent Redirect | This means that the resource is now permanently located at another URI, specified by the Location: HTTP Response header. |
| 400 | Bad Request | The server could not understand the request |
| 401 | Unauthorized | The client didn't authenticate himself. |
| 402 | Payment Required | This response code is reserved for future use. The initial aim for creating this code was using it for digital payment systems, however this status code is used very rarely and no standard convention exists. |
| 403 | Forbidden | The client does not have access rights to the content |
| 404 | Not Found | The server can not find the requested resource |
| 405 | Method Not Allowed | The request method is known by the server but is not supported by the target resource |
| 406 | Not Acceptable | The reponse doens't conforms to the creteria given by the client |
| 407 | Proxy Authentication Required | This is similar to 401 Unauthorized but authentication is needed to be done by a proxy. |
| 408 | Request Timeout | This response is sent on an idle connection by some servers, even without any previous request by the client. |
| 409 | Conflict | This response is sent when a request conflicts with the current state of the server. |
| 410 | Gone | This response is sent when the requested content has been permanently deleted from server, with no forwarding address. |
| 411 | Length Required | Server rejected the request because the Content-Length header field is not defined and the server requires it. |
| 412 | Precondition Failed | Access to the target resource has been denied. |
| 413 | Payload Too Large | Request entity is larger than limits defined by server. |
| 414 | Request-URI Too Long | The URI requested by the client is longer than the server is willing to interpret. |
| 415 | Unsupported Media Type | The media format is not supported by the server. |
| 416 | Requested Range Not Satisfiable | The range specified by the Range header field in the request cannot be fulfilled. |
| 417 | Expectation Failed | the expectation indicated by the Expect request header field cannot be met by the server. |
| 418 | I'm a teapot | The server refuses the attempt to brew coffee with a teapot. |
| 421 | Misdirected Request | The request was directed at a server that is not able to produce a response. |
| 422 | Unprocessable Entity | The request was well-formed but was unable to be followed due to semantic errors. |
| 423 | Locked | The resource that is being accessed is locked. |
| 424 | Failed Dependency | The request failed due to failure of a previous request. |
| 426 | Upgrade Required | The server refuses to perform the request using the current protocol but might be willing to do so after the client upgrades to a different protocol. |
| 428 | Precondition Required | his response is intended to prevent the 'lost update' problem, where a client GETs a resource's state, modifies it and PUTs it back to the server, when meanwhile a third party has modified the state on the server, leading to a conflict. |
| 429 | Too Many Requests | The user has sent too many requests in a given amount of time |
| 431 | Request Header Fields Too Large | The server is can't process the request because its header fields are too large. |
| 444 | Connection Closed Without Response | The connection opened, but no data was written. |
| 451 | Unavailable For Legal Reasons | The user agent requested a resource that cannot legally be provided (such as a web page censored by a government) |
| 499 | Client Closed Request | The client closed the connection, despite the server was processing the request already. |
| 500 | Internal Server Error | The server has encountered a situation it does not know how to handle. |
| 501 | Not Implemented | The request method is not supported by the server and cannot be handled. |
| 502 | Bad Gateway | This error response means that the server, while working as a gateway to get a response needed to handle the request, got an invalid response. |
| 503 | Service Unavailable | The server is not ready to handle the request. |
| 504 | Gateway Timeout | This error response is given when the server is acting as a gateway and cannot get a response in time. |
| 505 | HTTP Version Not Supported | The HTTP version used in the request is not supported by the server. |
| 506 | Variant Also Negotiates | the chosen variant resource is configured to engage in transparent content negotiation itself, and is therefore not a proper end point in the negotiation process. |
| 507 | Insufficient Storage | The method could not be performed on the resource because the server is unable to store the representation needed to successfully complete the request. |
| 508 | Loop Detected | The server detected an infinite loop while processing the request. |
| 510 | Not Extended | Further extensions to the request are required for the server to fulfill it. |
| 511 | Network Authentication Required | Indicates that the client needs to authenticate to gain network access. |
| 599 | Network Connect Timeout Error | The connection timed out due to a overloaded server, a hardware error or a infrastructure error. |
Backups/Miker/.trash/Helm.md
+50
View File
@@ -0,0 +1,50 @@
Repository Management
---------------------
| Command | Description |
| --- | --- |
| `helm repo list` | List Helm repositories |
| `helm repo update` | Update list of Helm charts from repositories |
Chart Management
----------------
| Command | Description |
| --- | --- |
| `helm search` | List all installed charts |
| `helm search <chart>` | Search for a chart |
| `helm ls` | List all installed Helm charts |
| `helm ls --deleted` | List all deleted Helm charts |
| `helm ls --all` | List installed and deleted Helm charts |
| `helm inspect values <repo>/<chart>` | Inspect the variables in a chart |
Install/Delete Helm Charts
--------------------------
| Command | Description |
| --- | --- |
| `helm install --name <name> <repo>/<chart>` | Install a Helm chart |
| `helm install --name <name> --values <VALUES.YML> <repo>/<chart>` | Install a Helm chart and override variables |
| `helm status <name>` | Show status of Helm chart being installed |
| `helm delete --purge <name>` | Delete a Helm chart |
Upgrading Helm Charts
---------------------
| Command | Description |
| --- | --- |
| `helm get values <name>` | Return the variables for a release |
| `helm upgrade --values <file> <name> <repo>/<chart>` | Upgrade the chart or variables in a release |
| `helm history <name>` | List release numbers |
| `helm rollback <name> 1` | Rollback to a previous release number |
Creating Helm Charts
--------------------
| Command | Description |
| --- | --- |
| `helm create <name>` | Create a blank chart |
| `helm lint <name>` | Lint the chart |
| `helm package <name>` | Package the chart into foo.tgz |
| `helm dependency update` | Install chart dependencies |
Backups/Miker/.trash/Hestia Setup.md
+39
View File
@@ -0,0 +1,39 @@
Hestia Control Panel Setup
** 1. Change to sudo **
sudo su -
** 2. Get the install script **
wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
** 3. Important - CHANGE THE NEXT LINE TO USE YOUR OWN DETAILS, recommend using a subdomain like 'hcp' for your panel as I've done here **
bash hst-install.sh --interactive no --email admin@mcfetridge.us --password S>>>>>>>>123 --hostname hcp.mcfetridge.us -f
** Make sure to capture this information
Ready to get started? Log in using the following credentials:
Admin URL: https://hcp.mcfetridge.us:8083
Backup URL: https://129.213.145.20:8083
Username: admin
Password: The password you chose during installation. My Default = S>>>>>>>>123
Sendblue SMTP key for HCP: xsmtpsib-1d075358c732f0ae42994d033cd552a43b867e08ddf1057f2414dec226c34ecc-UP2QRnLwmZvB7N3V
SMTP Server: smtp-relay.brevo.com
Port: 587
Login: mmcfetridg@aol.com
Password: Is the smtp key generated.
For a smoother setup you can point the subdomain for your hostname over to the Oracle public IP address. In our video we used Namecheap, but all domain hosts will have a similar setup.
After installing, the ports you’ll need to add to your ingress rules are here:
8083,80,443,143,993,110,995,25,465,587
Blog: https://ideaspot.com.au/blog/cloudflare-hestia-setup/
YouTube: https://www.youtube.com/watch?v=BK7qyPa-VmI
Backups/Miker/.trash/Homepage - Install.md
+150
View File
@@ -0,0 +1,150 @@
# **Homepage Service Documentation**
## **Overview**
**Homepage** is a self-hosted dashboard application designed for organizing and accessing web-based services. With features like bookmarks, service integrations, and Docker monitoring, it serves as a central hub for managing home labs efficiently. This guide details the configuration and setup of Homepage using Docker Compose, ensuring a simple, scalable, and maintainable deployment.
---
## **Docker Setup**
### **Docker Compose Configuration**
```yaml
services:
homepage:
image: ghcr.io/gethomepage/homepage:latest
container_name: homepage
environment:
PUID: 1000 # Replace with your user ID
PGID: 1000 # Replace with your group ID
ports:
- "3000:3000" # Map external port as needed
volumes:
- /opt/homepage/config:/app/config
- /var/run/docker.sock:/var/run/docker.sock:ro # Optional for Docker integrations
- /opt/homepage/config/icons:/app/public/icons
restart: unless-stopped
```
#### **Key Configuration Details**
1. **Image**: Pulls the official `ghcr.io/gethomepage/homepage:latest` image for the latest features and updates.
2. **Environment Variables**:
- `PUID` and `PGID` ensure file permissions align with the host user, avoiding access issues.
3. **Ports**: Maps port `3000` on the container to port `3000` on the host.
4. **Volumes**:
- `/opt/homepage/config`: Stores configuration files persistently.
- `/var/run/docker.sock`: Optional for Docker container monitoring.
- `/opt/homepage/config/icons`: Hosts custom service icons.
5. **Restart Policy**: Ensures the service restarts automatically unless manually stopped.
---
### **Configuration Directory Structure**
The configuration directory `/opt/homepage/config` on the host contains all the files needed to customize and manage Homepage:
```plaintext
/opt/homepage/config/
├── bookmarks.yaml # Bookmark definitions for the dashboard
├── config.yml # Main configuration file
├── custom.css # Custom CSS for styling
├── custom.js # Custom JavaScript for advanced tweaks
├── docker.yaml # Docker container monitoring configuration
├── icons/ # Directory for service icons
├── kubernetes.yaml # Kubernetes integration configuration
├── logs/ # Logs for troubleshooting
├── services.yaml # Definitions for services displayed on the dashboard
├── settings.yaml # General settings for Homepage
├── settings.yaml.bck # Backup of settings
├── widgets.yaml # Widget configuration
```
---
## **Deployment Instructions**
1. **Prepare Your Environment**:
- Install Docker and Docker Compose on your server.
- Create the directory `/opt/homepage/config` for storing configuration files.
2. **Deploy Homepage**:
Save the provided `docker-compose.yml` file and start the service:
```bash
docker-compose up -d
```
3. **Access the Dashboard**:
Open a web browser and navigate to:
```none
http://<your-server-ip>:3000
```
4. **Customize Your Dashboard**:
- Edit files such as `services.yaml` or `widgets.yaml` in `/opt/homepage/config`.
- Restart the container to apply changes:
```bash
docker-compose restart homepage
```
5. **Add Custom Icons**:
Place your icon files in `/opt/homepage/config/icons` and reference them in `services.yaml`.
---
## **Additional Features**
### **Docker Monitoring**
To enable container monitoring, mount the Docker socket:
```yaml
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
```
This integration allows Homepage to display real-time container stats.
### **Custom Styles and Scripts**
- **Custom CSS**: Modify the appearance of the dashboard by editing `custom.css`.
- **Custom JavaScript**: Add advanced functionality by editing `custom.js`.
---
## **Best Practices**
1. **Backup Configuration**:
Regularly backup `/opt/homepage/config` to prevent data loss:
```bash
tar -czvf homepage-config-backup.tar.gz /opt/homepage/config
```
2. **Security**:
- Use a firewall to restrict access to port `3000` if the dashboard is for internal use only.
- Optionally set up a reverse proxy with SSL using Nginx or Traefik.
3. **Update Homepage**:
Keep Homepage updated by pulling the latest image and recreating the container:
```bash
docker-compose pull
docker-compose up -d
```
---
## **Why Use Homepage?**
- **Centralized Access**: Consolidate all your services in one intuitive dashboard.
- **Customizable**: Fully tailor the dashboard’s layout, services, and appearance to your needs.
- **Integration Capabilities**: Monitor Docker containers, display widgets, and manage bookmarks seamlessly.
- **Lightweight**: Minimal resource consumption ensures smooth performance in home lab environments.
Backups/Miker/.trash/How to enter a Server Static IP.md
+17
View File
@@ -0,0 +1,17 @@
Sample config
network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
      - 192.168.0.200/24
      routes:
          - to: default
            via: 192.168.0.1
      nameservers:
        addresses:
         - 192.168.0.200
         - 9.9.9.9
         search: \[home.mikemcfetridge.com\]
Backups/Miker/.trash/IP Address Tracking.md
+47
View File
@@ -0,0 +1,47 @@
### Home-lab Environment
My Domains
mcfetridge.us 129.213.86.62 Oracle Server
mikemcfetridge.com 75.152.47.1 Home
mmcfetridge.net 216.144.227.142 RackNerd Server
mmcfetridge.xyz 107.175.245.171 Not used anymore
| IP Address | Server Name | Applications | Comments |
| --------------------- | -------------------- | ------------ | --------------------------------------------- |
| 192.168.2.1 | PVE | Proxmox | Main Proxmox Server |
| 192.168.2.2 | PVE2 | Proxmox | 2nd Proxmox Server |
| 192.168.2.3 | docker-prod-01 | | |
| 192.168.2.4 | pangolin | | |
| 192.168.2.5 | docker-prod-02 | | |
| 192.168.2.6 | My-Gitea | | |
| 192.168.2.7 | zoraxy | | |
| 192.168.2.8 | Pi-Hole | | |
| 192.168.2.9 | TECHNITIUMDNS-SERVER | DNS | DNS Server |
| 192.168.2.10 | WIREGUARD-SERVER | WG VPN | VPN Server |
| 192.168.2.11 | ANSIBLE-SERVER | Ansible | Ansible Server |
| 192.168.2.12 | linkwarden | lw | Manage internet links |
| 192.168.2.13 | IMMICH | Immich | Web Links Saver - To review pages later |
| 192.168.2.14 | Forgejo | | |
| 192.168.2.15 | | | |
| 192.168.2.16 | ARRSSERVER | Media | Media Server |
| 192.168.2.17 | | | |
| 192.168.2.18 | | | |
| 192.168.2.19 | VAULTWARDEN-SERVER | Passwords | Password Server |
| 192.168.2.20 | | | |
| 192.168.2.21 | | | |
| 192.168.2.22 | NPM-SERVER | Proxy Server | Nginx Proxy Manager Server |
| 192.168.2.23 | | Search Page | Search Server (Goolge Replacement) |
| 192.168.2.24 | | | |
| 192.168.2.25 | | | |
| 192.168.2.26 | | | |
| 192.168.2.27 | | | |
| 192.168.2.28 | | | |
| 192.168.2.29 | PegaProx | | |
| 192.168.2.30 | | | |
| | | | |
| 192.168.2.249 | My Laptop | Laptop | My Laptop |
| **Trusted IP ciders** | | | |
| "127.0.0.0/8" | | | |
| "10.0.0.0/8" | | | |
| "172.16.0.0/12" | | | |
| "192.168.0.0/22" | | | Windows 10 key: W269N-WFGWX-YVC9B-4J6C9-T83GX |
Backups/Miker/.trash/Information DNS SRV Records for Domain Controllers 2.md
+28
View File
@@ -0,0 +1,28 @@
The record types listed below can be queried in a number of ways.  One of the most simple methods is using NSLOOKUP from a command line.  For example from a command prompt type:
 
1. nslookup and then press ENTER
2. At the nslookup prompt type "set type=all" and press ENTER.
3. Next type "_ldap._tcp.dc._msdcs.ad.cbp.dhs.gov" and press ENTER.  You will receive a list of the servers advertising LDAP services for the AD domain.  Since AD servers are permitted to auto register records in DNS, the list should be all active domain controllers in CBP.
| | |
|---|---|
|**SRV Resource Record**|**Description**|
|**_ldap._tcp.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the LDAP service in the domain named _DnsDomainName_. The server is not necessarily a domain controller — that is, the only assumption that can be made about the server is that it supports the LDAP application programming interface (API). All Windows Server 2003–based domain controllers register this SRV record (for example, _ldap._tcp.contoso.com.).|
|**_ldap._tcp.** _SiteName_ **. _sites.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the LDAP service in the domain named _DnsDomainName_ in the site named _SiteName_. _SiteName_ is the relative distinguished name of the site object that is stored in the Configuration container in Active Directory. All Windows Server 2003–based domain controllers register this SRV record (for example, _ldap._tcp.charlotte._sites.contoso.com.).|
|**_ldap._tcp.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller (dc) of the domain named _DnsDomainName_. All Windows Server 2003–based domain controllers register this SRV record.|
|**_ldap._tcp.** _SiteName_ **. _sites.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller for the domain named _DnsDomainName_ and in the site named _SiteName_. All Windows Server 2003–based domain controllers register this SRV record.|
|**_ldap._tcp.pdc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate the server that is acting as the primary domain controller (PDC) in the mixed-mode domain named _DnsDomainName_. Only the PDC emulator master of the domain (the Windows Server 2003–based domain controller that advertises itself as the primary domain controller to computers that need a primary domain controller) registers this SRV record.|
|**_ldap._tcp.gc._msdcs.** _DnsForestName_ **.**|Enables a client to locate a global catalog (gc) server for this forest. Only domain controllers that are functioning as gc servers for the forest named in _DnsForestName_ register this SRV record (for example, _ldap._tcp.gc._msdcs.contoso.com.).|
|**_ldap._tcp.** _SiteName_ **. _sites.gc._msdcs.** _DnsForestName_ **.**|Enables a client to locate a global catalog (gc) server for this forest in the site named in SiteName. Only domain controllers that are serving as gc servers for the forest named in DnsForestName register this SRV record (for example, _ldap._tcp.charlotte._sites.gc._msdcs.contoso.com.).|
|_**gc._tcp.**_DnsForestName_**.**|Enables a client to locate a global catalog (gc) server for this domain. The server is not necessarily a domain controller. Only a server that is running the LDAP service and functioning as the GC server for the forest named _DnsForestName_ registers this SRV record (for example, _gc._tcp.contoso.com.). In Windows Server 2003, a GC server is a domain controller. Other implementations of directory services (that are not Windows Server 2003 implementations) can also register servers as GC servers.|
|_**gc._tcp.**_SiteName_**. _sites.**_DnsForestName_**.**|Enables a client to locate a global catalog (gc) server for this forest in the site named _SiteName_. The server is not necessarily a domain controller. Only a server that is running the LDAP service and functioning as the GC server for the forest named _DnsForestName_ registers this SRV record (for example, _gc._tcp.charlotte._sites.contoso.com.).|
|**_ldap._tcp.** _DomainGuid_ **. domains._msdcs.** _DnsForestName_ **.**|Enables a client to locate a domain controller in a domain on the basis of its GUID. A GUID is a 128-bit number that is automatically generated for referencing objects in Active Directory — in this case, the domain object. This operation is expected to be infrequent; it occurs only when the DnsDomainName of the domain has changed, the DnsForestName is known, and DnsForestName has not also been renamed (for example, _ldap._tcp.4f904480-7c78-11cf-b057-00aa006b4f8f.domains. _msdcs.contoso.com.). <br>All domain controllers register this SRV record.|
|**_kerberos._tcp.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the Kerberos KDC service for the domain that is named in _DnsDomainName_. The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record.|
|**_kerberos._udp.** _DnsDomainName_ **.**|Same as _**kerberos._tcp.**_DnsDomainName_, except that UDP is implied.|
|**_kerberos._tcp.** _SiteName_ **. _sites.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the Kerberos KDC service for the domain that is named _DnsDomainName_ and is also in the site named _SiteName_. The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record.|
|**_kerberos._tcp.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller that is running the Windows Server 2003 implementation of the Kerberos KDC service for the domain named in _DnsDomainName_. All Windows Server 2003–based domain controllers that are running the KDC service (that is, that implement a public key extension to the Kerberos v5 protocol Authentication Service Exchange subprotocol) register this SRV record.|
|**_kerberos.tcp.** _SiteName_ **. _sites.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller that is running the Windows Server 2003 implementation of the Kerberos KDC service for the domain that is named _DnsDomainName_ and that is also in the site named _SiteName_. All Windows Server 2003–based domain controllers that are running the KDC service (that is, that implement a public key extension to the Kerberos v5 protocol Authentication Service Exchange subprotocol) register this SRV record.|
|**_kpasswd._tcp**._DnsDomainName_**.**|Enables a client to locate a Kerberos Password Change server for the domain. All servers that provide the Kerberos Password Change service (which includes all Windows Server 2003–based domain controllers) register this name. This server must at least conform to the Kerberos Change Password Protocol. (For more information about this draft, see the Microsoft Platform SDK.) The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record.|
|**_kpasswd._udp**._DnsDomainName_**.**|Same as _**kpasswd._tcp.**_DnsDomainName_, except that UDP is implied.|
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/DNS%20SRV%20Records%20for%20Domain%20Controllers.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/DNS%20SRV%20Records%20for%20Domain%20Controllers.aspx)\>
Backups/Miker/.trash/Information DNS SRV Records for Domain Controllers.md
+28
View File
@@ -0,0 +1,28 @@
The record types listed below can be queried in a number of ways.  One of the most simple methods is using NSLOOKUP from a command line.  For example from a command prompt type:
 
1. nslookup and then press ENTER
2. At the nslookup prompt type "set type=all" and press ENTER.
3. Next type "_ldap._tcp.dc._msdcs.ad.cbp.dhs.gov" and press ENTER.  You will receive a list of the servers advertising LDAP services for the AD domain.  Since AD servers are permitted to auto register records in DNS, the list should be all active domain controllers in CBP.
| | |
|---|---|
|**SRV Resource Record**|**Description**|
|**_ldap._tcp.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the LDAP service in the domain named _DnsDomainName_. The server is not necessarily a domain controller — that is, the only assumption that can be made about the server is that it supports the LDAP application programming interface (API). All Windows Server 2003–based domain controllers register this SRV record (for example, _ldap._tcp.contoso.com.).|
|**_ldap._tcp.** _SiteName_ **. _sites.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the LDAP service in the domain named _DnsDomainName_ in the site named _SiteName_. _SiteName_ is the relative distinguished name of the site object that is stored in the Configuration container in Active Directory. All Windows Server 2003–based domain controllers register this SRV record (for example, _ldap._tcp.charlotte._sites.contoso.com.).|
|**_ldap._tcp.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller (dc) of the domain named _DnsDomainName_. All Windows Server 2003–based domain controllers register this SRV record.|
|**_ldap._tcp.** _SiteName_ **. _sites.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller for the domain named _DnsDomainName_ and in the site named _SiteName_. All Windows Server 2003–based domain controllers register this SRV record.|
|**_ldap._tcp.pdc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate the server that is acting as the primary domain controller (PDC) in the mixed-mode domain named _DnsDomainName_. Only the PDC emulator master of the domain (the Windows Server 2003–based domain controller that advertises itself as the primary domain controller to computers that need a primary domain controller) registers this SRV record.|
|**_ldap._tcp.gc._msdcs.** _DnsForestName_ **.**|Enables a client to locate a global catalog (gc) server for this forest. Only domain controllers that are functioning as gc servers for the forest named in _DnsForestName_ register this SRV record (for example, _ldap._tcp.gc._msdcs.contoso.com.).|
|**_ldap._tcp.** _SiteName_ **. _sites.gc._msdcs.** _DnsForestName_ **.**|Enables a client to locate a global catalog (gc) server for this forest in the site named in SiteName. Only domain controllers that are serving as gc servers for the forest named in DnsForestName register this SRV record (for example, _ldap._tcp.charlotte._sites.gc._msdcs.contoso.com.).|
|_**gc._tcp.**_DnsForestName_**.**|Enables a client to locate a global catalog (gc) server for this domain. The server is not necessarily a domain controller. Only a server that is running the LDAP service and functioning as the GC server for the forest named _DnsForestName_ registers this SRV record (for example, _gc._tcp.contoso.com.). In Windows Server 2003, a GC server is a domain controller. Other implementations of directory services (that are not Windows Server 2003 implementations) can also register servers as GC servers.|
|_**gc._tcp.**_SiteName_**. _sites.**_DnsForestName_**.**|Enables a client to locate a global catalog (gc) server for this forest in the site named _SiteName_. The server is not necessarily a domain controller. Only a server that is running the LDAP service and functioning as the GC server for the forest named _DnsForestName_ registers this SRV record (for example, _gc._tcp.charlotte._sites.contoso.com.).|
|**_ldap._tcp.** _DomainGuid_ **. domains._msdcs.** _DnsForestName_ **.**|Enables a client to locate a domain controller in a domain on the basis of its GUID. A GUID is a 128-bit number that is automatically generated for referencing objects in Active Directory — in this case, the domain object. This operation is expected to be infrequent; it occurs only when the DnsDomainName of the domain has changed, the DnsForestName is known, and DnsForestName has not also been renamed (for example, _ldap._tcp.4f904480-7c78-11cf-b057-00aa006b4f8f.domains. _msdcs.contoso.com.). <br>All domain controllers register this SRV record.|
|**_kerberos._tcp.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the Kerberos KDC service for the domain that is named in _DnsDomainName_. The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record.|
|**_kerberos._udp.** _DnsDomainName_ **.**|Same as _**kerberos._tcp.**_DnsDomainName_, except that UDP is implied.|
|**_kerberos._tcp.** _SiteName_ **. _sites.** _DnsDomainName_ **.**|Enables a client to locate a server that is running the Kerberos KDC service for the domain that is named _DnsDomainName_ and is also in the site named _SiteName_. The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record.|
|**_kerberos._tcp.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller that is running the Windows Server 2003 implementation of the Kerberos KDC service for the domain named in _DnsDomainName_. All Windows Server 2003–based domain controllers that are running the KDC service (that is, that implement a public key extension to the Kerberos v5 protocol Authentication Service Exchange subprotocol) register this SRV record.|
|**_kerberos.tcp.** _SiteName_ **. _sites.dc._msdcs.** _DnsDomainName_ **.**|Enables a client to locate a domain controller that is running the Windows Server 2003 implementation of the Kerberos KDC service for the domain that is named _DnsDomainName_ and that is also in the site named _SiteName_. All Windows Server 2003–based domain controllers that are running the KDC service (that is, that implement a public key extension to the Kerberos v5 protocol Authentication Service Exchange subprotocol) register this SRV record.|
|**_kpasswd._tcp**._DnsDomainName_**.**|Enables a client to locate a Kerberos Password Change server for the domain. All servers that provide the Kerberos Password Change service (which includes all Windows Server 2003–based domain controllers) register this name. This server must at least conform to the Kerberos Change Password Protocol. (For more information about this draft, see the Microsoft Platform SDK.) The server is not necessarily a domain controller. All Windows Server 2003–based domain controllers that are running an RFC 1510–compliant Kerberos KDC service register this SRV record.|
|**_kpasswd._udp**._DnsDomainName_**.**|Same as _**kpasswd._tcp.**_DnsDomainName_, except that UDP is implied.|
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/DNS%20SRV%20Records%20for%20Domain%20Controllers.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/DNS%20SRV%20Records%20for%20Domain%20Controllers.aspx)\>
Backups/Miker/.trash/Information AD Account Lockout.md
+25
View File
@@ -0,0 +1,25 @@
**OVERVIEW**
Account lockout status, including where the account was locked out is now available through [ADEX](https://adex.cbp.dhs.gov/) reports.
 
**PROCEEDURE**
Once you login to ADEX, the reports are within Reports | Maintenance | User Maintenance. Use the pull-down and select User Account Locked.  Enter the user's hash (preferred) or other identifying information like their last name.  Click Get Info to retrieve details to include the location where the account lockout occurred. 
 
**TROUBLESHOOTING**
In most cases chronic lockouts are occurring because one of the following occurred after the user changed their password:
 
1.     Users making use of Windows 7 feature Fast Windows Switching where multiple users are logged onto a workstation at the same time (Windows keeps other sessions dormant).  The affected user doesn't remember that they were logged onto a workstation elsewhere. 
 
            **Resolution:** Reboot the workstation(s) where the lockout is occurring.
 
2.     A user maps a drive letter to a share and selects the option to restore connections on logon. 
 
**Resolution**: delete all mapped drives and restart.  To delete all mapped drives, have the user type the following from a command prompt and then restart: **net use /del ***
 
3.     User incorrectly types their username/password 3 times within 20 minutes. 
 
**Resolution**: Remember password to avoid lockout events.
 
4.     A password is outdated in the Credentials Stored in Credential Manager (Control Panel\User Accounts\Credential Manager)
 
**Resolution**: Edit or Remove the Credentials.
Related:  Report data originates from Quest:  [Quest Change Auditor](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Quest%20Change%20Auditor.aspx)
Backups/Miker/.trash/Information AD Attributes.md
+296
View File
@@ -0,0 +1,296 @@
**Table of Contents**
OVERVIEW
ATTRIBUTE MAP
Users
Groups
ABOUT THE WEB TELE PROCESS
# OVERVIEW
## Active Directory Object Attributes
There are several ways to report details/attributes from AD.  You may want a report of users with their org code, email address, and phone number.  To do this you can:
 
1. Using ADUC you can create a query.  Go to the Saved Queries section of ADUC and create a new one.  You can use a custom search and build a condition list or even LDAP (more difficult because you have to know a bit more).  With this output you can right click and chose to export to a tab delimited file.  You may want the report to list additional details and you'll have the major ones but not all of them.  Note:  The query can be built using any available attribute but the report will only be able to list a small subset.
2. Best: Many folks in WSG can run Powershell reports with whatever criteria is appropriate.
3. Best: Talk to Ben about an existing report for regular, -D and -M accounts using Powershell.
In some cases the info returned will need to be converted to be readable.  Commonly the date/time stamps.  If so, use this since it will convert the date/time:
- In Excel you can use the formula:  =IF(J2\>0,J2/(8.64*10^11) - 109205,"")       Replace J2 with the corresponding cell. 
- insert a column (to the left or right of lastlogon and lastlogontimestamp  columns 
- select column  -- format cells -- change type to the last Time type (ie. 3/14/01 13:30)
- copy in formula (above) and update column names (i.e lastlogon and lastlogontimestamp)
- Drag down formula to end of sheet
- Select column and copy then “paste special” selecting “values” (do this for each column to modify)
- Erase original lastlogon and lastlogontimestamp columns that contain the scientific notation
- In powershell use an expression in a Select-Object pipe (excerpt): 
@{n="lastLogonDate";e={If ($_.lastLogonTimestamp -eq $null) {"Never"} ELSE {[datetime]::FromFileTime($_.lastLogonTimestamp)}}}
## ATTRIBUTE MAP (data dictionary)
## User Objects
What data does all of the attributes contain?  Some of them are self-explanatory like displayName.  Most cannot be written directly because automation populates the details.  Here are the attributes that may not be self-explanatory:
- **altSecurityIdentities**:  AKA 'AltSecID' is the attribute used to map a user PIV to the AD account.  This is automated based on specific criteria:
- AD UPN before the @ is numeric
- UPN before the @ is 10-digits
- UPN after the @ is cbp.dhs.gov
- DHSAttribute13 attribute is blank/null (if not null, automation assumes a non-CBP PIV and leaves AltSecID alone)
- **Company:** The company attribute is written by Webtele. Written by svc-webtele-proc
- **Department**:  The department description from Webtele. Written by svc-webtele-proc
- The following attributes belong to DHS and should not be modified by CBP unless for the documented purpose:
- DHSAttribute1 not documented
- DHSAttribute2 not documented
- DHSAttribute3 not documented
- DHSAttribute4 not documented
- DHSAttribute5 not documented
- DHSAttribute6 not documented
- DHSAttribute7 not documented
- DHSAttribute8 not documented
- DHSAttribute9 not documented
- DHSAttribute10 not documented
- DHSAttribute11 not documented
- DHSAttribute12 not documented
- DHSAttribute13:  used to denote the user's PIV user principal name (aka UPN).  The value found on the PIV/CAC user principal name.
- It is not typically used unless the user holds a non-CBP PIV/CAC (i.e. DHS HQ, USCG). 
- Using a CBP user's PIV UPN, while not required, will not cause any problems.
- Populating this with the user's PIV UPN causes AltSecID automation to ignore the account. This can be useful when the user's AltSecID needs to be unique / manually populated.
- DHSAttribute14 not documented
- DHSAttribute15 not documented
- DHSAttribute16 not documented
- DHSAttribute17 not documented
- DHSAttribute18 not documented
- CDHSAttribute20: not documented
- Extension Attributes
- **extensionAttribute1**:  Employe Series Sailpoint is pushing this to AD at 3AM using AD\SVC-EDME-ICAM-USRMNT.
- **extensionAttribute2:** ==Unused==
- **extensionAttribute3**: Employee GRADE (i.e. GS level ) and pushed to AD via Sailpoint. Assigned 8/30/19. As of 10/1/19 Sailpoint is pushing this to AD at 3AM using AD\SVC-EDME-ICAM-USRMNT.
- **extensionAttribute4**:  is the Organizational code from Webtele.  Everyone in AD should have one but some contractors do not because they are not adequately documented.  The first two numbers identify the office like Border Patrol, OFO, ES/OIT, etc. Written by svc-webtele-proc. Glen Corcoran BEMSD should have the org code definitions. The top level organizations are denoted by first 2 digits:
| | | |
|---|---|---|
|**ORG CODE**|**SHORT TITLE**|**LONG TITLE**|
|0100000000000000|OFFICE OF THE COMMISSIONER|OFFICE OF THE COMMISSIONER|
|0200000000000000|OFFICE OF THE CHIEF COUNSEL|OFFICE OF THE CHIEF COUNSEL|
|1200000000000000|OFFICE OF CONGRESSIONAL AFFAIR|OFFICE OF CONGRESSIONAL AFFAIRS|
|1900000000000000|OFFICE OF PUBLIC AFFAIRS|OFFICE OF PUBLIC AFFAIRS|
|2400000000000000|OFFICE OF TRADE|OFFICE OF TRADE|
|2600000000000000|OPR-OF PROFESSNL RSPNSIBILTY|OFFICE OF PROFESSIONAL RESPONSIBILITY|
|3500000000000000|U.S. BORDER PATROL|U.S. BORDER PATROL|
|3600000000000000|OFF OF FIELD OPS|OFFICE OF FIELD OPERATIONS|
|3800000000000000|OFC AIR & MARINE OPS|OFFICE OF AIR AND MARINE OPERATIONS|
|3900000000000000|OPERATIONS SUPPORT OFFICE|OPERATIONS SUPPORT OFFICE|
|4200000000000000|ENTERPRISE SERVICES OFFICE|ENTERPRISE SERVICES OFFICE|
|4300000000000000|OFFICE OF FINANCE|OFFICE OF FINANCE|
|4400000000000000|OFFICE OF INTELLIGENCE|OFFICE OF INTELLIGENCE|
(Last confirmed 12/15/22 with Denise Brewer)
This section expands org code a bit into office level organizations:
- **extensionAttribute5:**  Supervisor Code Webtele updates this attribute (1-8) svc-webtele-proc (on all users). Webtele consumes from SAP BEAR
- **extensionAttribute6:**  ==Unused==
- **extensionAttribute7:**  A NULL or any other value will Synch to Azure\O365 Automatically for User objects
A value of "o365nosync" will filter the user's identity from synching to the Azure AD (Office 365) cloud.  This value must be cleared if you wish to again sync the AD user identity to Office 365.
- **extensionAttribute8:**  Requested by CBP email engineering August 2019. Utilized by the email creation script to assign a primary email address to the proper realm for new mailboxes. Valid entries CTR, GOV, MIL, OGA, or FSN
- **extensionAttribute9**:  Denotes GOVERNMENT or CONTRACTOR. Updated by Webtele (svc-webtele-proc) "SAP BEAR feed" This attribute is used by dynamic distribution groups and Other System queries.
- **extensionAttribute10** is not documented but contains [first.mi.last@dhs.gov](mailto:first.mi.last@dhs.gov) . Only a fraction of users have this attribute. Appears unused since 2018.
- **extensionAttribute11** is to mark how and AD objects O365 mailbox should be provisioned: Calendar, Resource, Shared. Will be manually set by the TSD upon AD object creation. Once marked, ESG email automation will provision accordingly. [Requested by John Petz 1/22/19]
- **extensionAttribute12** tracks user mailbox migration state. This attribute is being updated by an Orchestrator automation that is monitoring the status of the mailbox copy and required post processing actions to execute after the copy is complete. [Requested by John Petz 1/22/19]
- **extensionAttribute13** contains the user's CanonicalName. Used for Exchange Query Based Distribution lists. Account SVC-EDME-EXCHAUTO updates this attribute. Orchestrator runbook EDME\Office 365\Exchange\Update EA13 Attribute. [Requested by John Petz 1/22/19]
- **extensionAttribute14** ==Unused== (Kellerman cleaned up pre EaaS info like "NWG-EXMB-A-027 SG1_DB12" on 5/27/20)
- **extensionAttribute15** used for Employee Status based (Currently SailPoint Separation. [Requested by ICAM 6/26/19]
- Other Attributes
- **L** denotes the user's city as synchronized from Webtele
- **ipPhone:** Used by Unified Communication as a Service (UCaaS) Joe Marsten POC: Updated manually by TSD?
- **mail:**  this is the primary SMTP address of the user. It is synchronized by EaaS. 
- **Manager:** Since June 2019 the manager attribute is written from a Sailpoint database. The manager attribute is taken from various sources depending on the user (Tele for contractors, HRBE for feds).  AD\SVC-EDME-ICAM-USRMNT has been delegated to write this attribute. The manager attribute is a distinguished name of the user's manager.
- **mobile**:  user's mobile telephone number from Webtele
- **Info**: AKA "Telephone Notes" is unused. It used to contain a user's Blackberry pin until December 2022 when it was cleared by Kellerman.
- **msRTCSIP-PrimaryUserAddress**:  The user's SIP address used by messaging apps. This may not be used now that Skype is gone and Office 365 hosts the Teams service. It used to be synchronized from the DSA domain and is no longer.
- **postalCode**:  the user's zip code from Webtele. Written by svc-webtele-proc
- **st**:  State according to Webtele. Written by svc-webtele-proc
- **streetAddress:** Street address from Webtele. Written by svc-webtele-proc
- **telephoneNumber** according to Webtele
- **title**:  The user's Title according to Webtele
- **userPrincipalName**: This value is shown / modified through the ADUC 'Account' tab only. For CBP users it must be the 10-digit [EDIPI@cbp.dhs.gov](mailto:EDIPI@cbp.dhs.gov) (**E**lectronic **D**ata **I**nterchange **P**ersonal **I**dentifier). This is the key to AltSecID automation, along with the user's email address.
**OIT DAC Software**
| | |
|---|---|
|421100021*|PSPD - Passenger|
|421100022*|TASPD - Targeting|
|421100023*|CSPD - Cargo|
|421100024*|BEMSD - Border Enforcement|
**OIT DAC Infrastructure**
| | |
|---|---|
|421100030*|ECSD - Cloud Services|
|421100031*|EIOD - Infrastructure|
|421100032*|FSD - Field Support (1 of 2)|
|421100033*|FSD - Field Support (2 of 2)|
**OIT Direct reports to OIT AC**
| | |
|---|---|
|42110004*|CSD - Cybersecurity|
|421100010*|CTO - Technology|
**Other ES Offices**
| | |
|---|---|
|4204*|OHRM - Office of Human Resources Management|
|4205*|OTD - Office of Trade and Development|
|4206*|OFAM - Office of Facilities and Asset Management|
|4208*|ES Office of Acquisition|
ADUC MAP
**General Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|First Name|givenName|John|
|Initials|initials|JS|
|Last Name|sn|Smith|
|Display Name|displayName|Smith , John|
|Description|description|Sales Manager|
|Office|physicalDeliveryOfficeName|London Office|
|Telephone Number|telephoneNumber|949-555-1234|
|E-mail-Addresses|mail|JSmith@domain.com|
|Common Name|CN|John Smith|
**Address Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Street|streetAddress|10 The Road|
|PO Box|postOfficeBox|Po Box 1|
|City|l _(Lowercase L)_|NewLondon|
|State/Province|st|New York|
|Zip/Postal Code|postalCode|61441|
|Country Name|c|GB, DE, US etc|
**Group Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Group|memberOf|CN=Managers,OU=Sales,DC=Domain,DC=Com|
**Account Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|User Logon Name|userPrincipalName|[9999999999@cbp.dhs.gov](mailto:%209999999999@cbp.dhs.gov)|
|User Logon Name (Pre W2K)|sAMAccountName|[hash]|
**Telephones Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Home (Other)|otherHomePhone|Not Set|
|Pager|pager|949-555-1234 (Cell Number)|
|Pager (Other)|otherPager|Not Set|
|Mobile|mobile|Not Set|
|Mobile (Other)|otherMobile|Not Set|
|Fax|facsimileTelephoneNumber|Not Set|
|Fax (Other)|otherFacsimile|Not Set|
|Telephone Number|telephoneNumber|Not Set|
|IP Phone|ipPhone|949-555-1234|
|IP Phone (Other)|otherIpPhone|Not Set|
|Notes|info|Not Set|
**Organization Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Title|title|Manager|
|Department|department|Sales|
|Company|company|Big Corp|
|Manager|manager|CN=SJobs,OU=Managers,DC=Domain,DC=Com|
|Employee ID|employeeID|Not Set|
|Employee Type|employeeType|Not Set|
|Employee Number|employeeNumber|Not Set|
|Car License|carLicense|Not Set|
|Division|division|Not Set|
|Room Number|roomNumber|Not Set|
 
 
## Group Objects
This section documents attributes specific to group objects.
ExtensionAttributes 2-4 and 11-15 are reserved for Privileged Access and EDME \ICAM Sailpoint management
- **extensionAttribute7:**  Group Objects DO NOT Automatically sync to Azure AD (Office 365) cloud. 
This value must be “synco365” to synch to Azure AD (Office 365)
- **extensionAttribute2  Sailpoint: 1st** APP-APPROVER **Group name**
- **extensionAttribute4 Sailpoint:** APPOWNER_SUPER_APPROVER Group name
- **extensionAttribute10 Sailpoint: Denotes Numerical Value of available licenses for Software associated groups**
- **extensionAttribute11  Sailpoint: Denotes Privileged Access if "TRUE"**
- **extensionAttribute12  Sailpoint: Denotes The Server Admin Group targets and clarifies it grants Admin to ALL Servers in All the subordinate OUs when set to "TRUE"**
- **extensionAttribute14 Sailpoint: Application Name/Project name**
# About the WebTele Process
The following information was supplied by the WebTele team, Ken Mak. Account svc-webtele-proc writes these details.
| | | | | |
|---|---|---|---|---|
|**WT Field Description**|**WT Table:Field**|**AD Value**|**AD Logic**|**AD dataflow**|
|Country - (country code): 2-digit|LOC: CTRY_CD|c|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Agency code: always set to "CU"; we only pull CBP orgs from COMS table|ORG: AGNC_CD|company, DHSAttribute19|is written as "CBP" when new shell record is created... and whenever WT updates every 4 minutes if there is a change in the record,  DHSAttribute19 is set to value "1" (we only read it) if isDHS|WT sync pushes to AD|
|Short name: used as display name in WT|ORG: SHRT_NM|department|WT pulls from AD every 24 hrs(@ 9am) for new record, new active, WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Organization code (16 digit org code) NOTE: it is not a key to the org table|EMPLOYEE: ORG_ID_CD|extensionAttribute4|WT pulls from AD every 24 hrs(@ 9am) for new record, new active will put in all zeros if missing. , WT pushes to AD every 4 min if changed.|WT sync pushes to AD;#WT sync pulls from AD|
|Supervisor type code: none/not specified = 0, supervisor/manager = 2(used), supervisor = 4, management official = 5, leader = 6, team leader = 7, other = 8|EMPLOYEE: SupervisorType|extensionAttribute5|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Contractor or government indicator <br>1= Is CBP/ Is federal employee/ Is government <br>0= contractor|EMPLOYEE: USCS_EMP_ACTV|extensionAttribute9|WT pulls from AD every 24 hrs(9am) if new or reactivated, WT pushes to AD every 4 min if changed.|WT sync pushes to AD;#WT sync pulls from AD|
|FAX number  (official tab) (PHN_IND=9)|PHONE: PHN_NBR|facsimileTelephoneNumber|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|First Name|EMPLOYEE: FRST_NM|givenName|WT pulls from AD every 24 hrs(@ 9am) for new record, new active|WT sync pulls from AD|
|City Name|LOC: CITY_NM|l (lower case L)|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Official Email address [*.cbp.dhs.gov] (ADDR_IND=3)|EMAIL: NTRNT_ADDR:3|mail|Pulls every 24 hrs, AD to WT, (we only read from AD and write to WT the official (indicator 3), will overwrite old if has changed )|WT sync pulls from AD|
|Mobile Number (official tab)  (PHN_IND=3)|PHONE: PHN_NBR:3|mobile|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Pager number code (official tab)  (PHN_IND=6)|PHONE: PHN_NBR|pager|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pulls from AD;#WT sync pushes to AD|
|Room number|EMPLOYEE: RM_NBR|physicalDeliveryOfficename|WT updates AD every 4 min if changed concatenated with other office room number and cube|WT sync pushes to AD|
|Room or cube number (updated by WMD/OIT or the user)|EMPLOYEE: RMT_BIN_NBR|physicalDeliveryOfficename|WT updates AD every 4 min if changed concatenated with other office room number and cube|WT sync pushes to AD|
|ZIP CODE|LOC: PSTL_CD|postalCode|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Alias Email address comma separated [*.cbp.dhs.gov] (ADDR_IND=5)|EMAIL: NTRNT_ADDR:5|proxyAddresses|Pulls every 24 hrs, AD to WT, (we only read from AD and write to WT the official (indicator 3), will overwrite old if has changed )|WT sync pulls from AD|
|HashId (key)|EMPLOYEE: EMP_ID_NBR|sAMAccountName|HashID is a unique identifier for AD, WT sync reads AD every 24 hours at 9AM, new records are created using this AD field as the HashID key|WT sync pulls from AD|
|Last Name|EMPLOYEE: LST_NM|sn|WT pulls from AD every 24 hrs(@ 9am) for new record, new active|WT sync pulls from AD|
|State CODE - from location as shown on the public tab derived from TRIRIGA|LOC: ST_CD|st|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Street Address as shown on the public tab derived from TRIRIGA list - street address 1 (primary)|LOC: STR_1_ADDR|streetAddress|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Office number code (public tab)  (PHN_IND=2)|PHONE: PHN_NBR|telephoneNumber|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Employee title (for government is pulled by HRBE for contractor by Supervisor or Admin)|EMPLOYEE: TITL_TXT|title|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Employee status (1= active, 0 = inactive)|EMPLOYEE: STUS_CD|userAccountControl|WT pulls from AD every 24 hrs(@ 9am) for new record, new active|WT sync pulls from AD|
Backups/Miker/.trash/Information AD Recovery.md
+7
View File
@@ -0,0 +1,7 @@
This document is sensitive in nature. Do not share it outside of WSG.
## Overview
This document outlines topics related to recovering Active Directory in the event of a disaster. There are two technologies discussed here:
1. Break Glass: This section addresses situations in which domain admins cannot log into their computer, a server, or domain controller to manage or correct an AD issue. For example, since elevated accounts require PIV authentication, the smartcard login mechanism must function flawlessly, otherwise an administrator may not be able to log in to assess or correct an outage.
Backups/Miker/.trash/Information AD replication errors with 8606 and lingering objects 2.md
+22
View File
@@ -0,0 +1,22 @@
(8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.
If AD replication gives these kind of errors here are some web sites to help troubleshoot.
[Troubleshoot replication error 8606 - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/replication-error-8606)
[Lingering Object Removal – ServerGuruNow (wordpress.com)](https://servergurunow.wordpress.com/2017/07/23/lingering-object-removal/)
[Active Directory replication Event ID 1388 or 1988 - A lingering object is detected - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-US/troubleshoot/windows-server/active-directory/active-directory-replication-event-id-1388-1988)
[Lingering objects still remain - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/lingering-objects-remain)
Example of command I ran in our AD environement
repadmin /removelingeringobjects ==tnwg01a-p0595.ad.cbp.dhs.gov== ==ea73d7c3-b70d-4c44-bb68-8359086ed67c== ==dc=ad,dc=cbp,dc=dhs,dc=gov==
The first part is the DNS name of the source domain controller, highlighted in green.
The second part is the source domain controller GUID, highlighted in yellow.
That you can get from the DC "netlogon.dns" file located on the DC at "c:\windows\system32\config"
![Exported image](Exported%20image%2020250808201948-0.png)
The third part is the domain name, highlighted in orange.
Backups/Miker/.trash/Information AD replication errors with 8606 and lingering objects.md
+22
View File
@@ -0,0 +1,22 @@
(8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.
If AD replication gives these kind of errors here are some web sites to help troubleshoot.
[Troubleshoot replication error 8606 - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/replication-error-8606)
[Lingering Object Removal – ServerGuruNow (wordpress.com)](https://servergurunow.wordpress.com/2017/07/23/lingering-object-removal/)
[Active Directory replication Event ID 1388 or 1988 - A lingering object is detected - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-US/troubleshoot/windows-server/active-directory/active-directory-replication-event-id-1388-1988)
[Lingering objects still remain - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/lingering-objects-remain)
Example of command I ran in our AD environement
repadmin /removelingeringobjects ==tnwg01a-p0595.ad.cbp.dhs.gov== ==ea73d7c3-b70d-4c44-bb68-8359086ed67c== ==dc=ad,dc=cbp,dc=dhs,dc=gov==
The first part is the DNS name of the source domain controller, highlighted in green.
The second part is the source domain controller GUID, highlighted in yellow.
That you can get from the DC "netlogon.dns" file located on the DC at "c:\windows\system32\config"
![Exported image](Exported%20image%2020250808202023-0.png)
The third part is the domain name, highlighted in orange.
Backups/Miker/.trash/Information Accounts Special Purpose.md
+18
View File
@@ -0,0 +1,18 @@
**Delegated Access for TSD and FTO**
**ad.cbp.dhs.gov/AccessControl/Accounts Special Purpose/TransitionalUsers**
[Transitional users]:
Indirect access group:
Field Support: Root-Transitional-Users Delegated group: SG-Delegation-Transitional-Users
TSD: SG-TSD-ADMIN
**ad.cbp.dhs.gov/AccessControl/Accounts Special Purpose/Leave Of Absence Users**
[Leave Of Absence Users]: all account should be disable
Indirect access group:
TSD: SG-TSD-ADMIN Delegated Group: SG-Delegation-Leave-Of-Absence-Users
FTO: SG-FTO-ADMIN (Move users out of OU only) Delegated Group: SG-Delegation-Leave-Of-Absence-Users-Move
**ad.cbp.dhs.gov/AccessControl/Accounts Special Purpose/Off Network Users**
[Off Network Users]: accounts are enabled / no enforcement configured
Indirect access group:
TSD: SG-TSD-ADMIN Delegated Group: SG-Delegation-Off-Network-Users
Backups/Miker/.trash/Information AdminSDHolder.md
+10
View File
@@ -0,0 +1,10 @@
**Best article**
[AdminSDHolder, Protected Groups and Security Descriptor Propagator - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com)](https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx)
**Get a list of users tagged**
get-aduser -Filter {admincount -gt 0} -Properties adminCount | select Name,DistinguishedName,Enabled,SamAccountName,adminCount | Export-Csv c:\temp\adminsdholder.csv -NoTypeInformation
**Get a list of groups with this designation**
Get-ADGroup –LDAPFilter “(admincount=1)” -Properties description | Export-Csv c:\temp\adminSDholderGROUPS.csv -NoTypeInformation
Backups/Miker/.trash/Information Are your DCs too busy to be monitored 2.md
+112
View File
@@ -0,0 +1,112 @@
AD Data Collector Set solutions for long report compile times or report data deletion
**First published on TechNet on Apr 14, 2016**
Hi all, [Herbert Mauerer](https://blogs.technet.microsoft.com/askds/tag/herbert-mauerer/) here. In this post we’re back to talk about the built-in AD Diagnostics Data collector set available for Active Directory Performance (ADPERF) issues and how to ensure a useful report is generated when your DCs are under heavy load.
Why are my domain controllers so busy you ask? Consider this: Active Directory stands in the center of the Identity Management for many customers. It stores the configuration information for many critical line of business applications. It houses certificate templates, is used to distribute group policy and is the account database among many other things. All sorts of network-based services use Active Directory for authentication and other services.
As mentioned there are many applications which store their configuration in Active Directory, including the details of the user context relative to the application, plus objects specifically created for the use of these applications.
There are also applications that use Active Directory as a store to synchronize directory data. There are products like Forefront Identity Manager (and now [Microsoft Identity Manager](https://www.microsoft.com/en-us/server-cloud/products/microsoft-identity-manager/) ) where synchronizing data is the only purpose. I will not discuss whether these applications are meta-directories or virtual directories, or what class our Office 365 DirSync belongs to…
One way or the other, the volume and complexity of Active Directory queries has a constant trend of increasing, and there is no end in sight.
So what are my Domain Controllers doing all day?
We get this questions a lot from our customers. It often seems as if the AD Admins are the last to know what kind of load is put onto the domain controllers by scripts, applications and synchronization engines. And they are not made aware of even significant application changes.
But even small changes can have a drastic effect on the DC performance. DCs are resilient, but even the strongest warrior may fall against an overwhelming force.  Think along the lines of "death by a thousand cuts".  Consider applications or scripts that run non-optimized or excessive queries on many, many clients during or right after logon and it will feel like a distributed DoS. In this scenario, the domain controller may get bogged down due to the enormous workload issued by the clients. This is one of the classic scenarios when it comes to Domain Controller performance problems.
What resources exist today to help you troubleshoot AD Performance scenarios?
We have already discussed the overall topic in this [blog](http://blogs.technet.com/b/askds/archive/2007/08/20/troubleshooting-high-lsass-cpu-utilization-on-a-domain-controller-part-1-of-2.aspx) , and today many customer requests start with the complaint that the response times are bad and the LSASS CPU time is high. There also is a [blog](http://blogs.technet.com/b/askds/archive/2010/06/22/3336721.aspx) post specifically on the toolset we've had since Windows Server 2008. We also updated and brought back the [Server Performance Advisor](http://blogs.technet.com/b/windowsserver/archive/2013/03/11/server-performance-advisor-spa-3-0.aspx) toolset. This toolset is now more targeted at trend analysis and base-lining.  If a video is more your style, Justin Turner revealed our troubleshooting process at [Ignite](https://channel9.msdn.com/Events/Ignite/Australia-2015/INF341) .
The reports generated by this data collection are hugely useful for understanding what is burdening the Domain Controllers. There are fewer cases where DCs are responding slowly, but there is no significant utilization seen. We released a [blog](http://blogs.technet.com/b/askds/archive/2014/10/24/what-are-all-these-atq-thread-counters-there-for-anyway.aspx) on that scenario and also gave you a simple method to troubleshoot long-running LDAP queries at our sister [site](https://blogs.technet.microsoft.com/askpfeplat/2015/05/10/how-to-find-expensive-inefficient-and-long-running-ldap-queries-in-active-directory/) .  So what's new with this post?
The AD Diagnostic Data Collector set report "report.html" is missing or compile time is very slow
In recent months, we have seen an increasing number of customers with incomplete Data Collector Set reports. Most of the time, the “report.html” file is missing:
This is a folder where the creation of the report.html file was successful:
![thumbnail image 1 of blog post titled Are your DCs...](Exported%20image%2020250808201949-0.png)
This folder has exceeded the limits for reporting:
![thumbnail image 2 of blog post titled Are your DCs...](Exported%20image%2020250808201953-1.png)
Notice the report.html file is missing in the second folder example. Also take note that the ETL and BLG files are bigger. What’s the reason for this?
The Data Collector Set report generation process uncovered:
- When the data collection ends, the process “tracerpt.exe” is launched to create a report for the folder where the data was collected.
- “tracerpt.exe” runs with “below normal” priority so it does not get full CPU attention especially if LSASS is busy as well.
- “tracerpt.exe” runs with one worker thread only, so it cannot take advantage of more than one CPU core.
- “tracerpt.exe” accumulates RAM usage as it runs.
- “tracerpt.exe” has six hours to complete a report. If it is not done within this time, the report is terminated.
- The default settings of the system AD data collector deletes the biggest data set first that exceed the 1 Gigabyte limit. The biggest single file in the reports is typically “Active Directory.etl”.  The report.html file will not get created if this file does not exist.
I worked with a customer recently with a pretty well-equipped Domain Controller (24 server-class CPUs, 256 GB RAM). The customer was kind enough to run a few tests for various report sizes, and found the following metrics:
- Until the time-out of six hours is hit, “tracerpt.exe” consumes up to 12 GB of RAM.
- During this time, one CPU core was allocated 100%. If a DC is in a high-load condition, you may want to increase the base priority of “tracerpt.exe” to get the report to complete. This is at the expense of CPU time potentially impacting purpose of said server and in turn clients.
- The biggest data set that could be completed within the six hours had an “Active Directory.etl” of 3 GB.
If you have lower-spec and busier machines, you shouldn't expect the same results as this example (On a lower spec machine with a 3 GB ETL file, the report.html file would likely fail to compile within the 6-hour window).
What a bummer, how do you get Performance Logging done then?
Fortunately, there are a number of parameters for a Data Collector Set that come to the rescue. Before you can use any of them you first need one of the more custom Data Collector Sets. You can play with a variety of settings, based on the purpose of the collection.
In Performance Monitor you can create a custom set on the "User Defined" folder by right-clicking it, to bring up the **New** -\> **Data Collector Set** option in the context menu:
![thumbnail image 3 of blog post titled Are your DCs...](Exported%20image%2020250808201954-2.png)
This launches a wizard that prompts you for a number of parameters for the new set.
The first thing it wants is a name for the new set:
![thumbnail image 4 of blog post titled Are your DCs...](Exported%20image%2020250808201955-3.png)
The next step is to select a template. It may be one of the built-in templates or one exported from another computer as an XML file you select through the “Browse” button. In our case, we want to create a clone of “Active Directory Diagnostics”:
![thumbnail image 5 of blog post titled Are your DCs...](Exported%20image%2020250808201955-4.png)
The next step is optional, and it’s specifies the storage location for the reports. You may want to select a volume with more space or lower IO load than the default volume:
![thumbnail image 6 of blog post titled Are your DCs...](Exported%20image%2020250808201956-5.png)
There is one more page in the wizard, but there is no reason to make any more changes here. You can click “Finish” on this page.
The default settings are fine for an idle DC, but if you find your ETL files are too large, your reports are not generated, or it takes too long to process the data, you will likely want to make the following configuration changes.
For a real "Big Data Collector Set" we first want to make important changes to the storage strategy of the set that are available in the “Data Manager” log:
![thumbnail image 7 of blog post titled Are your DCs...](Exported%20image%2020250808201957-6.png)
The most relevant settings are “Resource Policy” and “Maximum Root Path Size”. I recommend starting with the settings as shown below:
![thumbnail image 8 of blog post titled Are your DCs...](Exported%20image%2020250808201957-7.png)
Notice, I've changed the Resource policy from "Delete largest" to "Delete oldest". I've also increased the Maximum root path size from 1024 to 2048 MB.  You can run some reports to learn what the best size settings are for you. You might very well end up using 10 GB or more for your reports.
The second crucial parameter for your custom sets is the run interval for the data collection. It is five minutes by default. You can adjust that in the properties of the collector in the “Stop Condition” tab. In many cases shortening the data collection is a viable step if you see continuous high load:
![thumbnail image 9 of blog post titled Are your DCs...](Exported%20image%2020250808202001-8.png)
You should avoid going shorter than two minutes, as this is the maximum LDAP query duration by default. (If you have LDAP queries that reach this threshold, they would not show up in a report that is less than two minutes in length.) In fact, I would suggest the minimum interval be set to three minutes.
One very attractive option is automatically restarting the data collection if a certain size of data collection is exceeded. You need to use common sense when you look at the multiple reports, e.g. the ratio of long-running queries is then shown in the logs. But it is definitely better than no report.
If you expect to exceed the 1 GB limit often, you certainly should adjust the total size of collections (Maximum root path size) in the “Data Manager”.
So how do I know how big the collection is while running it?
You can take a look at the folder of the data collection in Explorer, but you will notice it is pretty lazy updating it with the current size of the collection:
![thumbnail image 10 of blog post titled Are your DC...](Exported%20image%2020250808202002-9.png)
Explorer only updates the folder if you are doing something with the files. It sounds strange, but attempting to delete a file will trigger an update:
![thumbnail image 11 of blog post titled Are your DC...](Exported%20image%2020250808202003-10.png)
Now that makes more sense…
If you see the log is growing beyond your expectations, you can manually stop it before the stop condition hits the threshold you have configured:
![thumbnail image 12 of blog post titled Are your DC...](Exported%20image%2020250808202003-11.png)
Of course, you can also start and stop the reporting from a command line using the logman instructions in this [post](https://blogs.technet.microsoft.com/askds/2010/06/08/son-of-spa-ad-data-collector-sets-in-win2008-and-beyond/) .
Room for improvement
We are aware there is room for improvement to get bigger data sets reported in a shorter time. The good news is that much of these special configuration changes won’t be needed once your DCs are running on Windows Server 2016. We will talk about that in a future post.
\> From \<[https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/are-your-dcs-too-busy-to-be-monitored-ad-data-collector-set/ba-p/400388](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/are-your-dcs-too-busy-to-be-monitored-ad-data-collector-set/ba-p/400388)\>
Backups/Miker/.trash/Information Are your DCs too busy to be monitored.md
+112
View File
@@ -0,0 +1,112 @@
AD Data Collector Set solutions for long report compile times or report data deletion
**First published on TechNet on Apr 14, 2016**
Hi all, [Herbert Mauerer](https://blogs.technet.microsoft.com/askds/tag/herbert-mauerer/) here. In this post we’re back to talk about the built-in AD Diagnostics Data collector set available for Active Directory Performance (ADPERF) issues and how to ensure a useful report is generated when your DCs are under heavy load.
Why are my domain controllers so busy you ask? Consider this: Active Directory stands in the center of the Identity Management for many customers. It stores the configuration information for many critical line of business applications. It houses certificate templates, is used to distribute group policy and is the account database among many other things. All sorts of network-based services use Active Directory for authentication and other services.
As mentioned there are many applications which store their configuration in Active Directory, including the details of the user context relative to the application, plus objects specifically created for the use of these applications.
There are also applications that use Active Directory as a store to synchronize directory data. There are products like Forefront Identity Manager (and now [Microsoft Identity Manager](https://www.microsoft.com/en-us/server-cloud/products/microsoft-identity-manager/) ) where synchronizing data is the only purpose. I will not discuss whether these applications are meta-directories or virtual directories, or what class our Office 365 DirSync belongs to…
One way or the other, the volume and complexity of Active Directory queries has a constant trend of increasing, and there is no end in sight.
So what are my Domain Controllers doing all day?
We get this questions a lot from our customers. It often seems as if the AD Admins are the last to know what kind of load is put onto the domain controllers by scripts, applications and synchronization engines. And they are not made aware of even significant application changes.
But even small changes can have a drastic effect on the DC performance. DCs are resilient, but even the strongest warrior may fall against an overwhelming force.  Think along the lines of "death by a thousand cuts".  Consider applications or scripts that run non-optimized or excessive queries on many, many clients during or right after logon and it will feel like a distributed DoS. In this scenario, the domain controller may get bogged down due to the enormous workload issued by the clients. This is one of the classic scenarios when it comes to Domain Controller performance problems.
What resources exist today to help you troubleshoot AD Performance scenarios?
We have already discussed the overall topic in this [blog](http://blogs.technet.com/b/askds/archive/2007/08/20/troubleshooting-high-lsass-cpu-utilization-on-a-domain-controller-part-1-of-2.aspx) , and today many customer requests start with the complaint that the response times are bad and the LSASS CPU time is high. There also is a [blog](http://blogs.technet.com/b/askds/archive/2010/06/22/3336721.aspx) post specifically on the toolset we've had since Windows Server 2008. We also updated and brought back the [Server Performance Advisor](http://blogs.technet.com/b/windowsserver/archive/2013/03/11/server-performance-advisor-spa-3-0.aspx) toolset. This toolset is now more targeted at trend analysis and base-lining.  If a video is more your style, Justin Turner revealed our troubleshooting process at [Ignite](https://channel9.msdn.com/Events/Ignite/Australia-2015/INF341) .
The reports generated by this data collection are hugely useful for understanding what is burdening the Domain Controllers. There are fewer cases where DCs are responding slowly, but there is no significant utilization seen. We released a [blog](http://blogs.technet.com/b/askds/archive/2014/10/24/what-are-all-these-atq-thread-counters-there-for-anyway.aspx) on that scenario and also gave you a simple method to troubleshoot long-running LDAP queries at our sister [site](https://blogs.technet.microsoft.com/askpfeplat/2015/05/10/how-to-find-expensive-inefficient-and-long-running-ldap-queries-in-active-directory/) .  So what's new with this post?
The AD Diagnostic Data Collector set report "report.html" is missing or compile time is very slow
In recent months, we have seen an increasing number of customers with incomplete Data Collector Set reports. Most of the time, the “report.html” file is missing:
This is a folder where the creation of the report.html file was successful:
![thumbnail image 1 of blog post titled Are your DCs...](Exported%20image%2020250808202025-0.png)
This folder has exceeded the limits for reporting:
![thumbnail image 2 of blog post titled Are your DCs...](Exported%20image%2020250808202026-1.png)
Notice the report.html file is missing in the second folder example. Also take note that the ETL and BLG files are bigger. What’s the reason for this?
The Data Collector Set report generation process uncovered:
- When the data collection ends, the process “tracerpt.exe” is launched to create a report for the folder where the data was collected.
- “tracerpt.exe” runs with “below normal” priority so it does not get full CPU attention especially if LSASS is busy as well.
- “tracerpt.exe” runs with one worker thread only, so it cannot take advantage of more than one CPU core.
- “tracerpt.exe” accumulates RAM usage as it runs.
- “tracerpt.exe” has six hours to complete a report. If it is not done within this time, the report is terminated.
- The default settings of the system AD data collector deletes the biggest data set first that exceed the 1 Gigabyte limit. The biggest single file in the reports is typically “Active Directory.etl”.  The report.html file will not get created if this file does not exist.
I worked with a customer recently with a pretty well-equipped Domain Controller (24 server-class CPUs, 256 GB RAM). The customer was kind enough to run a few tests for various report sizes, and found the following metrics:
- Until the time-out of six hours is hit, “tracerpt.exe” consumes up to 12 GB of RAM.
- During this time, one CPU core was allocated 100%. If a DC is in a high-load condition, you may want to increase the base priority of “tracerpt.exe” to get the report to complete. This is at the expense of CPU time potentially impacting purpose of said server and in turn clients.
- The biggest data set that could be completed within the six hours had an “Active Directory.etl” of 3 GB.
If you have lower-spec and busier machines, you shouldn't expect the same results as this example (On a lower spec machine with a 3 GB ETL file, the report.html file would likely fail to compile within the 6-hour window).
What a bummer, how do you get Performance Logging done then?
Fortunately, there are a number of parameters for a Data Collector Set that come to the rescue. Before you can use any of them you first need one of the more custom Data Collector Sets. You can play with a variety of settings, based on the purpose of the collection.
In Performance Monitor you can create a custom set on the "User Defined" folder by right-clicking it, to bring up the **New** -\> **Data Collector Set** option in the context menu:
![thumbnail image 3 of blog post titled Are your DCs...](Exported%20image%2020250808202027-2.png)
This launches a wizard that prompts you for a number of parameters for the new set.
The first thing it wants is a name for the new set:
![thumbnail image 4 of blog post titled Are your DCs...](Exported%20image%2020250808202030-3.png)
The next step is to select a template. It may be one of the built-in templates or one exported from another computer as an XML file you select through the “Browse” button. In our case, we want to create a clone of “Active Directory Diagnostics”:
![thumbnail image 5 of blog post titled Are your DCs...](Exported%20image%2020250808202031-4.png)
The next step is optional, and it’s specifies the storage location for the reports. You may want to select a volume with more space or lower IO load than the default volume:
![thumbnail image 6 of blog post titled Are your DCs...](Exported%20image%2020250808202032-5.png)
There is one more page in the wizard, but there is no reason to make any more changes here. You can click “Finish” on this page.
The default settings are fine for an idle DC, but if you find your ETL files are too large, your reports are not generated, or it takes too long to process the data, you will likely want to make the following configuration changes.
For a real "Big Data Collector Set" we first want to make important changes to the storage strategy of the set that are available in the “Data Manager” log:
![thumbnail image 7 of blog post titled Are your DCs...](Exported%20image%2020250808202033-6.png)
The most relevant settings are “Resource Policy” and “Maximum Root Path Size”. I recommend starting with the settings as shown below:
![thumbnail image 8 of blog post titled Are your DCs...](Exported%20image%2020250808202033-7.png)
Notice, I've changed the Resource policy from "Delete largest" to "Delete oldest". I've also increased the Maximum root path size from 1024 to 2048 MB.  You can run some reports to learn what the best size settings are for you. You might very well end up using 10 GB or more for your reports.
The second crucial parameter for your custom sets is the run interval for the data collection. It is five minutes by default. You can adjust that in the properties of the collector in the “Stop Condition” tab. In many cases shortening the data collection is a viable step if you see continuous high load:
![thumbnail image 9 of blog post titled Are your DCs...](Exported%20image%2020250808202034-8.png)
You should avoid going shorter than two minutes, as this is the maximum LDAP query duration by default. (If you have LDAP queries that reach this threshold, they would not show up in a report that is less than two minutes in length.) In fact, I would suggest the minimum interval be set to three minutes.
One very attractive option is automatically restarting the data collection if a certain size of data collection is exceeded. You need to use common sense when you look at the multiple reports, e.g. the ratio of long-running queries is then shown in the logs. But it is definitely better than no report.
If you expect to exceed the 1 GB limit often, you certainly should adjust the total size of collections (Maximum root path size) in the “Data Manager”.
So how do I know how big the collection is while running it?
You can take a look at the folder of the data collection in Explorer, but you will notice it is pretty lazy updating it with the current size of the collection:
![thumbnail image 10 of blog post titled Are your DC...](Exported%20image%2020250808202035-9.png)
Explorer only updates the folder if you are doing something with the files. It sounds strange, but attempting to delete a file will trigger an update:
![thumbnail image 11 of blog post titled Are your DC...](Exported%20image%2020250808202038-10.png)
Now that makes more sense…
If you see the log is growing beyond your expectations, you can manually stop it before the stop condition hits the threshold you have configured:
![thumbnail image 12 of blog post titled Are your DC...](Exported%20image%2020250808202039-11.png)
Of course, you can also start and stop the reporting from a command line using the logman instructions in this [post](https://blogs.technet.microsoft.com/askds/2010/06/08/son-of-spa-ad-data-collector-sets-in-win2008-and-beyond/) .
Room for improvement
We are aware there is room for improvement to get bigger data sets reported in a shorter time. The good news is that much of these special configuration changes won’t be needed once your DCs are running on Windows Server 2016. We will talk about that in a future post.
\> From \<[https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/are-your-dcs-too-busy-to-be-monitored-ad-data-collector-set/ba-p/400388](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/are-your-dcs-too-busy-to-be-monitored-ad-data-collector-set/ba-p/400388)\>
Backups/Miker/.trash/Information Automated COMPUTER Account Maintenance 2.md
+48
View File
@@ -0,0 +1,48 @@
**Table of Contents**
**Overview**
**Process**
**Script**
**Exceptions**
**Logging**
## Overview
This document defines the process in which CBP has implemented automated processing to address the NIST Security control AC-2(3), for inactivity as it pertains to Microsoft Active Directory computer accounts.  
**AC-2(3) Defined:**
Access Control procedures or other documentation that document the automatic disabling of inactive accounts after organization defined time period. A CBP custom script process performs this function for computer accounts in AD.
CBP has defined that inactive STANDARD computer accounts as:
            Disabled after forty five (45) days of inactivity
            Deleted after sixty (60) days of inactivity
## Process
A scheduled task is executed by automation using Orchestrator daily, view/configure using RunBook Designer:
**Runbook Location:** EDMED\Runbooks\Job Runbooks\EDMED\WSG\Active Directory\User Tasks\ Clean User Objects V2
**Script:** D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1
**Command line argument:** RUN (if no argument supplied runs in 'whatif' mode)
**Log location**: Logs to subdirectory of the main script \Log\
This script is used to automate disable/delete user objects based on the last time they logged into AD, specifically the lastlogintimestamp attribute. The script can be run in 'whatif' mode (making no changes) unless you supply RUN as a command line argument. When you run with argument RUN the script will make changes. Examples:
& '.\ADUserCleanV2.1.ps1' # without RUN (or anything other than RUN) makes no changes, logs to screen and log file
& '.\ADUserCleanV2.1.ps1' RUN # with RUN command argument it will make changes in AD if you have AD permission to do so!
The script checks each users's lastlogintimestamp using configurable thresholds found in the beginning of the script. When a user is at the delete threshold it is deleted and when at disable threshold it is disabled.
Orchestrator Details
Account used by Orchestrator to make changes in AD and write to SQL: **AD\SVC-EDME-USER-CL**
Job Runbook
_DETAILS_
Computer: tnwg01a-v3824 (subject to change to cluster model vs. single server)
Program Path: c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
Parameters: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1 RUN
_ADVANCED_
Run as Username (Orchestrator global settings variable): {SVC-EDME-USER-CLEAN}
Password (Orchestrator global settings variable): {SVC-EDME-USER-CLEANPWD}
Scheduled Runbooks: References the above job runbook, runs daily at 8:12 PM (schedule is not significant)
Backups/Miker/.trash/Information Automated COMPUTER Account Maintenance.md
+48
View File
@@ -0,0 +1,48 @@
**Table of Contents**
**Overview**
**Process**
**Script**
**Exceptions**
**Logging**
## Overview
This document defines the process in which CBP has implemented automated processing to address the NIST Security control AC-2(3), for inactivity as it pertains to Microsoft Active Directory computer accounts.  
**AC-2(3) Defined:**
Access Control procedures or other documentation that document the automatic disabling of inactive accounts after organization defined time period. A CBP custom script process performs this function for computer accounts in AD.
CBP has defined that inactive STANDARD computer accounts as:
            Disabled after forty five (45) days of inactivity
            Deleted after sixty (60) days of inactivity
## Process
A scheduled task is executed by automation using Orchestrator daily, view/configure using RunBook Designer:
**Runbook Location:** EDMED\Runbooks\Job Runbooks\EDMED\WSG\Active Directory\User Tasks\ Clean User Objects V2
**Script:** D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1
**Command line argument:** RUN (if no argument supplied runs in 'whatif' mode)
**Log location**: Logs to subdirectory of the main script \Log\
This script is used to automate disable/delete user objects based on the last time they logged into AD, specifically the lastlogintimestamp attribute. The script can be run in 'whatif' mode (making no changes) unless you supply RUN as a command line argument. When you run with argument RUN the script will make changes. Examples:
& '.\ADUserCleanV2.1.ps1' # without RUN (or anything other than RUN) makes no changes, logs to screen and log file
& '.\ADUserCleanV2.1.ps1' RUN # with RUN command argument it will make changes in AD if you have AD permission to do so!
The script checks each users's lastlogintimestamp using configurable thresholds found in the beginning of the script. When a user is at the delete threshold it is deleted and when at disable threshold it is disabled.
Orchestrator Details
Account used by Orchestrator to make changes in AD and write to SQL: **AD\SVC-EDME-USER-CL**
Job Runbook
_DETAILS_
Computer: tnwg01a-v3824 (subject to change to cluster model vs. single server)
Program Path: c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
Parameters: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1 RUN
_ADVANCED_
Run as Username (Orchestrator global settings variable): {SVC-EDME-USER-CLEAN}
Password (Orchestrator global settings variable): {SVC-EDME-USER-CLEANPWD}
Scheduled Runbooks: References the above job runbook, runs daily at 8:12 PM (schedule is not significant)
Backups/Miker/.trash/Information Automated USER Account Maintenance 2.md
+167
View File
@@ -0,0 +1,167 @@
**Table of Contents**
**Overview**
**Process**
**Script**
**Exceptions**
**Notifications**
**Logging**
## Overview
This document defines the process in which CBP has implemented automated processing to address the NIST Security control AC-2(3), for inactivity as it pertains to Microsoft Active Directory user accounts.  
**AC-2(3) Defined:**
Access Control procedures or other documentation that document the automatic disabling of inactive accounts after organization defined time period. A CBP custom script process performs this function for accounts in AD.
CBP has defined that inactive STANDARD user accounts are to be:
            Disabled after thirty (30) days of inactivity
            Deleted after ninety (90) days of inactivity
September 2021, a WAIVER was signed to expand the number of inactive days by 30 days for approved individuals. Approved individuals who are contracted to Border Patrol for COVID medical services will have the thresholds expanded. These users will be added to group SG-ELECTRONIC-MEDICAL-RECORDS-CONTRACTORS:
Disabled after sixty (60) days of inactivity
           Deleted after one hundred twenty (120) days of inactivity
Attachment:
![[CRA-2021-09-536 Medical Services Contractors OU group_.pdf]]
Validated by Kellerman May 2023
![Exported image](Exported%20image%2020250808202145-0.png)
Example
[https://adex.cbp.dhs.gov/WSG-Forms/Logs/Users/UserLogSearch.cfm](https://adex.cbp.dhs.gov/WSG-Forms/Logs/Users/UserLogSearch.cfm)
**ADEX Location: Reports | Maintenance | User Maintenance**
The script writes activity to a SQL database so it can be viewed through ADEX. This is where you should start any investigation of maintenance activity. The SQL database is [dbo].[CBP_Account_Maint] on ConnectionString = "Server=adex.cbp.dhs.gov\wsg1;Database=adex;Integrated Security=true"
### ADEX / SQL logging (SQL log queried through ADEX)
The script logs activity in a subdirectory where the script is located, specifically \Log\. A new log is created every month (history is kept for each month), i.e. \Log\Clean AD User Accounts 2021-Nov.log
### Script Activity (text log)
## Logging
The script will notify "VIP" users in the same manner as above (email to the user + manager). However, VIP users who are members of AD\SG-EIOD-VIPLIST will also trigger an email notification to: TSD Federal Managers \<TSDFederalmanagers@cbp.dhs.gov\> with BCC to WSG. This security group is maintained by someone outside of WSG.
### VIP Notification
Instructions:
The criteria for keeping an account active requires an interactive computer logon at least every 30 days. Note that interactive does NOT include run-as administrator or run-as a different user functionality. You must log into a computer desktop directly to keep the account active. If nothing is done within 5 days the pending action will be executed.
Name: SHENKLE, ABBY ABBY.SHENKLE@cbp.dhs.gov
Account: BBBJR8L
Last Login: 02/13/2023 13:21:41
Location: CN=SHENKLE\, ABBY,OU=DCC010A UserAccounts,OU=DCC010A,OU=DCMETRO,OU=METRO,DC=ad,DC=cbp,DC=dhs,DC=gov
Pending Action: Delete
Days remaining: 5
This message is to inform you that an Active Directory account that belongs to you is about to be disabled or deleted due to login inactivity. Details:
cc: Manager on file (if exists)
This message is to inform you that an Active Directory account that belongs to you is about to be disabled or deleted due to login inactivity. Details:
The script will notify both the user and manager (known by user's 'manager' attribute) by email. The default script action is to notify 5 days in advance of the pending activity disable or delete. Users who don't have a defined manager will be the only recipient of the email. Here is a sample email:
### User Notification
## Notifications
1. AD User Query: The AD query can also be adjusted to ignore accounts by not including them in the script logic. The current criteria for accounts that will not be scrutinized as of 11/16/2020:
$_.samaccountname -notlike "GMB-*" -and
$_.userPrincipalName -notlike "GML*" -and
$_.userPrincipalName -notlike "GMB*" -and
$_.distinguishedName -notlike "CN=GMB-*" -and
$_.distinguishedName -notlike "*GM?,OU=*" -and
$_.userPrincipalName -notlike "GCAL-*" -and
$_.distinguishedName -notlike "CN=GCAL-*" -and
$_.userPrincipalName -notlike "RMB-*" -and
$_.distinguishedName -notlike "CN=RMB-*" -and
$_.distinguishedName -notlike "*-ROOM*" -and
$_.distinguishedName -notlike "*OU=Exchange,OU=AccessControl*" -and
$_.userPrincipalName -notlike "SVC-*" -and
$_.distinguishedName -notlike "CN=SVC_*" -and
$_.distinguishedName -notlike "CN=SVC-*"
5. Variables in the script: Exceptions can be made by modifying script variables:
1. Do not disable/delete based on distinguishedname: modify variable $DNskippers
2. Do not disable/delete based on samaccountname: modify variable $SamNameSkippers
3. Do not delete based on samaccountname: modify variable $doNotDelete. Accounts are eligible for disable, but not delete, UNLESS never logged in (if never logged in the standard criteria applies)
6. New Sept 2021: For medical records contractors. Extended the normal threshold 30 disable/90 delete to 60 disable/120 delete. User accounts receive this exception when the TSD adds approved individuals to the group SG-ELECTRONIC-MEDICAL-RECORDS-CONTRACTORS. Again, membership in this group is managed by the TSD only. Requested by Louis W Zook and approved by STP John Buckley. Note, adding members to this group does NOT change the 90 day delete limit for accounts never logged in. 8. New May 2022: Management requested special notice for "VIP" users in group AD\SG-EOID-VIPLIST. When this user is pending delete or disable, a notification will be sent to the designated mailing list TSD Federal Managers \<TSDFederalmanagers@cbp.dhs.gov\>. More detail in notifications section.
The script will process users according to the above criteria. However, to scope in or scope out users so the script doesn't have to do unnecessary work, there are two places to do this. The first option excludes accounts from the AD query so they are not scrutinized by the script. The second will be scrutinized by the script logic but skipped if a match is determined.
## Exceptions
# The DNSkippers is based on DISTINGUISHEDNAME add below as necessary using format "value", (don't forget the comma so next line is included)
- $DNskippers =
"OU=Leave Of Absence Users,OU=Accounts Special Purpose",
"OU=Off Network Users,OU=Accounts Special Purpose",
"OU=TASPO GRABBA",
"CN=Builtin",
"CN=Microsoft Exchange System Objects",
"CN=Users," # consider removing this so people can't hide here
# used as an exception to skip delete based on "samaccountname" attribute (will still disable). however, if never logged in it will be deleted at $deleteThreshold like others
- $doNotDelete = "STU-" # add others separated by , (comma). Skips any delete action for samaccountnames with this string - $SamNameSkippers = "RGMSWODNIW" # used as an exception to skip based on "samaccountname" attribute. add others separated by , (comma)
- $extendedThresholdException = Get-ADGroup S-1-5-21-2487492328-1375672958-281685340-1008227 # changed Feb 2023 to SID so group could be moved in AD but be the only one able to be used by the script.
- $extendedDisableThreshold = 60 # Exceptions: DISABLE at this number of DAYS since last logon timestamp
- $extendedDeleteThreshold = 120 # Exceptions: DELETE at this number of DAYS since last logon timestamp
- $emailErrorsTo = "benjamin.kellerman@cbp.dhs.gov" # email this contact if any errors are thrown in powershell
- $disableThreshold = 30 # DISABLE at this number of DAYS since last logon timestamp
- $deleteThreshold = 90 # DELETE at this number of DAYS since last logon timestamp
- $maxChanges = 150 # When the script makes this number of changes stop processing
Configurable parameters (with current values):
The script has 3 functions: 2 of them deal with connecting to and writing records to SQL (for easy review), and the last is responsible for making changes to active directory.
The script is written in Powershell and requires AD RSAT tools to run.
## Script
Scheduled Runbooks: References the above job runbook, runs daily at 1:10 AM (schedule is not significant)
Job Runbook
_DETAILS_
Computer: tnwg01a-v3824 (subject to change to cluster model vs. single server)
Program Path: c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
Parameters: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.x.ps1 RUN
_ADVANCED_
Run as Username (Orchestrator global settings variable): {SVC-EDME-USER-CLEAN}
Password (Orchestrator global settings variable): {SVC-EDME-USER-CLEANPWD}
Orchestrator Details
Account used by Orchestrator to make changes in AD and write to SQL: **AD\SVC-EDME-USER-CL**
The script checks each users's lastlogintimestamp using configurable thresholds found in the beginning of the script. When
a user is at the delete threshold it is deleted and when at disable threshold it is disabled.
& '.\ADUserCleanV2.x.ps1' # without RUN (or anything other than RUN) makes no changes, logs to screen and log file
& '.\ADUserCleanV2.x.ps1' RUN # with RUN command argument it will make changes in AD if you have AD permission to do so!
This script is used to automate disable/delete user objects based on the last time they logged into AD, specifically the lastlogintimestamp attribute. The script can be run in 'whatif' mode (making no changes) unless you supply RUN as a command line argument. When you run with argument RUN the script will make changes. Examples:
**Runbook Location:** EDMED\Runbooks\Job Runbooks\EDMED\WSG\Active Directory\User Tasks\ Clean User Objects V2
**Script:** D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.x.ps1
**Command line argument:** RUN (if no argument supplied runs in 'whatif' mode)
**Log location**: Logs to subdirectory of the main script \Log\ subdirectory
A scheduled task is executed by automation using Orchestrator daily, view/configure using RunBook Designer:
## Process
Backups/Miker/.trash/Information Automated USER Account Maintenance.md
+167
View File
@@ -0,0 +1,167 @@
**Table of Contents**
**Overview**
**Process**
**Script**
**Exceptions**
**Notifications**
**Logging**
## Overview
This document defines the process in which CBP has implemented automated processing to address the NIST Security control AC-2(3), for inactivity as it pertains to Microsoft Active Directory user accounts.  
**AC-2(3) Defined:**
Access Control procedures or other documentation that document the automatic disabling of inactive accounts after organization defined time period. A CBP custom script process performs this function for accounts in AD.
CBP has defined that inactive STANDARD user accounts are to be:
            Disabled after thirty (30) days of inactivity
            Deleted after ninety (90) days of inactivity
September 2021, a WAIVER was signed to expand the number of inactive days by 30 days for approved individuals. Approved individuals who are contracted to Border Patrol for COVID medical services will have the thresholds expanded. These users will be added to group SG-ELECTRONIC-MEDICAL-RECORDS-CONTRACTORS:
Disabled after sixty (60) days of inactivity
           Deleted after one hundred twenty (120) days of inactivity
Attachment:
![[CRA-2021-09-536 Medical Services Contractors OU group_ 1.pdf]]
Validated by Kellerman May 2023
![Exported image](Exported%20image%2020250808202230-0.png)
Example
[https://adex.cbp.dhs.gov/WSG-Forms/Logs/Users/UserLogSearch.cfm](https://adex.cbp.dhs.gov/WSG-Forms/Logs/Users/UserLogSearch.cfm)
**ADEX Location: Reports | Maintenance | User Maintenance**
The script writes activity to a SQL database so it can be viewed through ADEX. This is where you should start any investigation of maintenance activity. The SQL database is [dbo].[CBP_Account_Maint] on ConnectionString = "Server=adex.cbp.dhs.gov\wsg1;Database=adex;Integrated Security=true"
### ADEX / SQL logging (SQL log queried through ADEX)
The script logs activity in a subdirectory where the script is located, specifically \Log\. A new log is created every month (history is kept for each month), i.e. \Log\Clean AD User Accounts 2021-Nov.log
### Script Activity (text log)
## Logging
The script will notify "VIP" users in the same manner as above (email to the user + manager). However, VIP users who are members of AD\SG-EIOD-VIPLIST will also trigger an email notification to: TSD Federal Managers \<TSDFederalmanagers@cbp.dhs.gov\> with BCC to WSG. This security group is maintained by someone outside of WSG.
### VIP Notification
Instructions:
The criteria for keeping an account active requires an interactive computer logon at least every 30 days. Note that interactive does NOT include run-as administrator or run-as a different user functionality. You must log into a computer desktop directly to keep the account active. If nothing is done within 5 days the pending action will be executed.
Name: SHENKLE, ABBY ABBY.SHENKLE@cbp.dhs.gov
Account: BBBJR8L
Last Login: 02/13/2023 13:21:41
Location: CN=SHENKLE\, ABBY,OU=DCC010A UserAccounts,OU=DCC010A,OU=DCMETRO,OU=METRO,DC=ad,DC=cbp,DC=dhs,DC=gov
Pending Action: Delete
Days remaining: 5
This message is to inform you that an Active Directory account that belongs to you is about to be disabled or deleted due to login inactivity. Details:
cc: Manager on file (if exists)
This message is to inform you that an Active Directory account that belongs to you is about to be disabled or deleted due to login inactivity. Details:
The script will notify both the user and manager (known by user's 'manager' attribute) by email. The default script action is to notify 5 days in advance of the pending activity disable or delete. Users who don't have a defined manager will be the only recipient of the email. Here is a sample email:
### User Notification
## Notifications
1. AD User Query: The AD query can also be adjusted to ignore accounts by not including them in the script logic. The current criteria for accounts that will not be scrutinized as of 11/16/2020:
$_.samaccountname -notlike "GMB-*" -and
$_.userPrincipalName -notlike "GML*" -and
$_.userPrincipalName -notlike "GMB*" -and
$_.distinguishedName -notlike "CN=GMB-*" -and
$_.distinguishedName -notlike "*GM?,OU=*" -and
$_.userPrincipalName -notlike "GCAL-*" -and
$_.distinguishedName -notlike "CN=GCAL-*" -and
$_.userPrincipalName -notlike "RMB-*" -and
$_.distinguishedName -notlike "CN=RMB-*" -and
$_.distinguishedName -notlike "*-ROOM*" -and
$_.distinguishedName -notlike "*OU=Exchange,OU=AccessControl*" -and
$_.userPrincipalName -notlike "SVC-*" -and
$_.distinguishedName -notlike "CN=SVC_*" -and
$_.distinguishedName -notlike "CN=SVC-*"
5. Variables in the script: Exceptions can be made by modifying script variables:
1. Do not disable/delete based on distinguishedname: modify variable $DNskippers
2. Do not disable/delete based on samaccountname: modify variable $SamNameSkippers
3. Do not delete based on samaccountname: modify variable $doNotDelete. Accounts are eligible for disable, but not delete, UNLESS never logged in (if never logged in the standard criteria applies)
6. New Sept 2021: For medical records contractors. Extended the normal threshold 30 disable/90 delete to 60 disable/120 delete. User accounts receive this exception when the TSD adds approved individuals to the group SG-ELECTRONIC-MEDICAL-RECORDS-CONTRACTORS. Again, membership in this group is managed by the TSD only. Requested by Louis W Zook and approved by STP John Buckley. Note, adding members to this group does NOT change the 90 day delete limit for accounts never logged in. 8. New May 2022: Management requested special notice for "VIP" users in group AD\SG-EOID-VIPLIST. When this user is pending delete or disable, a notification will be sent to the designated mailing list TSD Federal Managers \<TSDFederalmanagers@cbp.dhs.gov\>. More detail in notifications section.
The script will process users according to the above criteria. However, to scope in or scope out users so the script doesn't have to do unnecessary work, there are two places to do this. The first option excludes accounts from the AD query so they are not scrutinized by the script. The second will be scrutinized by the script logic but skipped if a match is determined.
## Exceptions
# The DNSkippers is based on DISTINGUISHEDNAME add below as necessary using format "value", (don't forget the comma so next line is included)
- $DNskippers =
"OU=Leave Of Absence Users,OU=Accounts Special Purpose",
"OU=Off Network Users,OU=Accounts Special Purpose",
"OU=TASPO GRABBA",
"CN=Builtin",
"CN=Microsoft Exchange System Objects",
"CN=Users," # consider removing this so people can't hide here
# used as an exception to skip delete based on "samaccountname" attribute (will still disable). however, if never logged in it will be deleted at $deleteThreshold like others
- $doNotDelete = "STU-" # add others separated by , (comma). Skips any delete action for samaccountnames with this string - $SamNameSkippers = "RGMSWODNIW" # used as an exception to skip based on "samaccountname" attribute. add others separated by , (comma)
- $extendedThresholdException = Get-ADGroup S-1-5-21-2487492328-1375672958-281685340-1008227 # changed Feb 2023 to SID so group could be moved in AD but be the only one able to be used by the script.
- $extendedDisableThreshold = 60 # Exceptions: DISABLE at this number of DAYS since last logon timestamp
- $extendedDeleteThreshold = 120 # Exceptions: DELETE at this number of DAYS since last logon timestamp
- $emailErrorsTo = "benjamin.kellerman@cbp.dhs.gov" # email this contact if any errors are thrown in powershell
- $disableThreshold = 30 # DISABLE at this number of DAYS since last logon timestamp
- $deleteThreshold = 90 # DELETE at this number of DAYS since last logon timestamp
- $maxChanges = 150 # When the script makes this number of changes stop processing
Configurable parameters (with current values):
The script has 3 functions: 2 of them deal with connecting to and writing records to SQL (for easy review), and the last is responsible for making changes to active directory.
The script is written in Powershell and requires AD RSAT tools to run.
## Script
Scheduled Runbooks: References the above job runbook, runs daily at 1:10 AM (schedule is not significant)
Job Runbook
_DETAILS_
Computer: tnwg01a-v3824 (subject to change to cluster model vs. single server)
Program Path: c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
Parameters: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.x.ps1 RUN
_ADVANCED_
Run as Username (Orchestrator global settings variable): {SVC-EDME-USER-CLEAN}
Password (Orchestrator global settings variable): {SVC-EDME-USER-CLEANPWD}
Orchestrator Details
Account used by Orchestrator to make changes in AD and write to SQL: **AD\SVC-EDME-USER-CL**
The script checks each users's lastlogintimestamp using configurable thresholds found in the beginning of the script. When
a user is at the delete threshold it is deleted and when at disable threshold it is disabled.
& '.\ADUserCleanV2.x.ps1' # without RUN (or anything other than RUN) makes no changes, logs to screen and log file
& '.\ADUserCleanV2.x.ps1' RUN # with RUN command argument it will make changes in AD if you have AD permission to do so!
This script is used to automate disable/delete user objects based on the last time they logged into AD, specifically the lastlogintimestamp attribute. The script can be run in 'whatif' mode (making no changes) unless you supply RUN as a command line argument. When you run with argument RUN the script will make changes. Examples:
**Runbook Location:** EDMED\Runbooks\Job Runbooks\EDMED\WSG\Active Directory\User Tasks\ Clean User Objects V2
**Script:** D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.x.ps1
**Command line argument:** RUN (if no argument supplied runs in 'whatif' mode)
**Log location**: Logs to subdirectory of the main script \Log\ subdirectory
A scheduled task is executed by automation using Orchestrator daily, view/configure using RunBook Designer:
## Process
Backups/Miker/.trash/Information Azure CBA 2.md
+25
View File
@@ -0,0 +1,25 @@
Overview [Implement password hash synchronization with Microsoft Entra Connect Sync - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization)
On prem password sync using AAD connect:
[https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-selective-password-hash-synchronization#excluded-users-is-larger-than-included-users](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-selective-password-hash-synchronization#excluded-users-is-larger-than-included-users)
GSA guidance to move away from on prem to CBA [Certificate-Based Authentication on Microsoft Entra ID Guide (idmanagement.gov)](https://www.idmanagement.gov/implement/cba-azure/)
CISA guidance [Secure Cloud Business Applications (cisa.gov)](https://www.cisa.gov/sites/default/files/2024-03/Secure%20Cloud%20Business%20Applications%20-%20Hybrid%20Identity%20Solutions%20Guidance.pdf#page=25&zoom=100,0,0)
You must first enable PHS which includes all users, then implement selecting PHS configuration. Does that help to clarify?
 
The second area which speaks more to the global PHS option is in the table of optional features here:
[https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-custom#optional-features](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity%2Fhybrid%2Fconnect%2Fhow-to-connect-install-custom*optional-features__%3BIw!!BClRuOV5cvtbuNI!EdIhQ_2JnsMZZM15vDsR3UZMIYzaN7ulr_No9r0zXYGt0iRD3Q8zGYHhPk8K2k97Q9gwdjC0He11l_mXvb-5Tc7TbO5ldXLhFQ%24&data=05%7C02%7CMARCUS.A.GREGOIRE%40cbp.dhs.gov%7Ce976f01f04764dc9930808dc63bd67b1%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638494912366138617%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=haOHFXlPS8bGBpL5%2BH9Ofv1vMLJkOw%2FA3Ml0lNJmW00%3D&reserved=0)
 
| | |
|---|---|
|Password hash synchronization|If you selected federation as the sign-in solution, you can enable password hash synchronization. Then you can use it as a backup option.<br><br> <br><br>If you selected pass-through authentication, you can enable this option to ensure support for legacy clients and to provide a backup.<br><br> <br><br>For more information, see [Password hash synchronization](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity%2Fhybrid%2Fconnect%2Fhow-to-connect-password-hash-synchronization__%3B!!BClRuOV5cvtbuNI!EdIhQ_2JnsMZZM15vDsR3UZMIYzaN7ulr_No9r0zXYGt0iRD3Q8zGYHhPk8K2k97Q9gwdjC0He11l_mXvb-5Tc7TbO46W4S3pg%24&data=05%7C02%7CMARCUS.A.GREGOIRE%40cbp.dhs.gov%7Ce976f01f04764dc9930808dc63bd67b1%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638494912366145779%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Rw%2BMKNHfC4VmTvOY93gw7%2BYomK4nJ%2B9DcBeIVvhpRaw%3D&reserved=0).|
What happens to a user's cloud password after a user no longer fits the criteria for PHS? The answer to this is that the password that was last assigned remains active on the account.
The primary control to mitigate any risks associated with the user having a known cloud password at this stage would be enforcement of authentication methods using Conditional Access Authentication Strength (i.e. CBA). Use of the Password is denied in this scenario. Additionally, an administrator could reset the user's password again prior to removing them from scope of selective PHS. This would synchronize a password unknown to the user to the cloud and also reset their AD credential. The user at this point should be required to login with smart card to both AD and Entra, SCRIL and CA + Auth Strength respectively.
 
Keep in mind that if you do need to use PHS as a temporary or fallback method (i.e. TAP is unavailable) then the process for managing this temporary credential would include adding the user to an exclusion group that toggles which CA policy and subsequently which auth methods apply. When the user is removed, they fall back to the baseline which would enforce PIV.
Backups/Miker/.trash/Information Azure CBA.md
+25
View File
@@ -0,0 +1,25 @@
Overview [Implement password hash synchronization with Microsoft Entra Connect Sync - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization)
On prem password sync using AAD connect:
[https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-selective-password-hash-synchronization#excluded-users-is-larger-than-included-users](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-selective-password-hash-synchronization#excluded-users-is-larger-than-included-users)
GSA guidance to move away from on prem to CBA [Certificate-Based Authentication on Microsoft Entra ID Guide (idmanagement.gov)](https://www.idmanagement.gov/implement/cba-azure/)
CISA guidance [Secure Cloud Business Applications (cisa.gov)](https://www.cisa.gov/sites/default/files/2024-03/Secure%20Cloud%20Business%20Applications%20-%20Hybrid%20Identity%20Solutions%20Guidance.pdf#page=25&zoom=100,0,0)
You must first enable PHS which includes all users, then implement selecting PHS configuration. Does that help to clarify?
 
The second area which speaks more to the global PHS option is in the table of optional features here:
[https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-custom#optional-features](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity%2Fhybrid%2Fconnect%2Fhow-to-connect-install-custom*optional-features__%3BIw!!BClRuOV5cvtbuNI!EdIhQ_2JnsMZZM15vDsR3UZMIYzaN7ulr_No9r0zXYGt0iRD3Q8zGYHhPk8K2k97Q9gwdjC0He11l_mXvb-5Tc7TbO5ldXLhFQ%24&data=05%7C02%7CMARCUS.A.GREGOIRE%40cbp.dhs.gov%7Ce976f01f04764dc9930808dc63bd67b1%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638494912366138617%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=haOHFXlPS8bGBpL5%2BH9Ofv1vMLJkOw%2FA3Ml0lNJmW00%3D&reserved=0)
 
| | |
|---|---|
|Password hash synchronization|If you selected federation as the sign-in solution, you can enable password hash synchronization. Then you can use it as a backup option.<br><br> <br><br>If you selected pass-through authentication, you can enable this option to ensure support for legacy clients and to provide a backup.<br><br> <br><br>For more information, see [Password hash synchronization](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity%2Fhybrid%2Fconnect%2Fhow-to-connect-password-hash-synchronization__%3B!!BClRuOV5cvtbuNI!EdIhQ_2JnsMZZM15vDsR3UZMIYzaN7ulr_No9r0zXYGt0iRD3Q8zGYHhPk8K2k97Q9gwdjC0He11l_mXvb-5Tc7TbO46W4S3pg%24&data=05%7C02%7CMARCUS.A.GREGOIRE%40cbp.dhs.gov%7Ce976f01f04764dc9930808dc63bd67b1%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638494912366145779%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Rw%2BMKNHfC4VmTvOY93gw7%2BYomK4nJ%2B9DcBeIVvhpRaw%3D&reserved=0).|
What happens to a user's cloud password after a user no longer fits the criteria for PHS? The answer to this is that the password that was last assigned remains active on the account.
The primary control to mitigate any risks associated with the user having a known cloud password at this stage would be enforcement of authentication methods using Conditional Access Authentication Strength (i.e. CBA). Use of the Password is denied in this scenario. Additionally, an administrator could reset the user's password again prior to removing them from scope of selective PHS. This would synchronize a password unknown to the user to the cloud and also reset their AD credential. The user at this point should be required to login with smart card to both AD and Entra, SCRIL and CA + Auth Strength respectively.
 
Keep in mind that if you do need to use PHS as a temporary or fallback method (i.e. TAP is unavailable) then the process for managing this temporary credential would include adding the user to an exclusion group that toggles which CA policy and subsequently which auth methods apply. When the user is removed, they fall back to the baseline which would enforce PIV.
Backups/Miker/.trash/Information Bitlocker Scripts to enable on drives.md
+1
View File
@@ -0,0 +1 @@
There are scripts with MECM that will enable bitlocker on both the OS drive and data drives. The name of the script for the OS drive is "enable-wsgbitlocker-os". The name of the script for the data drives is "enable-wsgbitlocker-data". The OS drive needs to be enabled first and then the data drives. This is because the data drives need to store their recovery keys on an encrypted drive.
Backups/Miker/.trash/Information CBP Active Directory Domains.md
+14
View File
@@ -0,0 +1,14 @@
In the windows environment there is no such “DEV” designator
 
The designators for Windows are:
1. Production          ad.cbp.dhs.gov, dmz.cbp.dhs.gov, app.ad.cbp.dhs.gov, atsprod.ad.cbp.dhs.gov
2. SAT                       sat.cbp.dhs.gov, atsdev.cbp.dhs.gov
 
In the Production space:
There is a temporary holding space until the server is Production ready. (Pre-Production OU)
Every computer is expected to move from Pre-Production to Production.
 
Monitoring is setup automatically on every computer.  Only Production computers actionable alerts are forwarded to the TOC
DNS registration must reflect the domain membership.
Backups/Miker/.trash/Information CBP Active Directory Instances.md
+38
View File
@@ -0,0 +1,38 @@
The purpose of this Wiki is to cover Active Directory management for non-mainstream domains.  It will not cover "how-to" manage them but instead will focus on how to access them so that they can be managed, as well as any significant details.  There are 4 basic Active Directory locations maintained by WSG, and the others are FYI.  We will only expand upon the 3rd and 4th entity as WSG provides primary support for them:
1. **Production AD** (AD.CBP.DHS.GOV):  This is where nearly all production users and applications reside. 
2. **PreProduction AD** (organizational unit "PreProduction" in Production AD): 
- The purpose of this location within prod is for systems destinted for production. 
- It is also commonly approved for development/testing activity where the non-prod system must interact with production.
3. **APP** ~~(APP.AD.CBP.DHS.GOV)~~
- ~~This is a production subordinate domain within Production AD.~~ 
- ~~It was implemented to satisfy a requirement for TASPO and has become TASPO's primary production location.~~ 
- ~~It is also the location of DHS employees who require access to CBP resources (e.g. ICE) like Sharepoint.~~
- ~~Access Instructions~~
- ~~Launch ADUC with elevated credentials~~
- ~~Right-click the upper-most part of the tree and select Change domain.  Type:  App.ad.cbp.dhs.gov~~
4. **SAT** (SAT.cbp.dhs.gov) 
- This domain is the location where testing activity is performed, where new builds are located when the request is "non-prod". 
- If a system is not being prepped for production, this is where it belongs. 
- Every sysetm in this domain must be referred to by the FQDN vs. the server Netbios name.  Example:  tnwg01a-v9999.SAT.CBP.DHS.GOV and not simply "tnwg01a-v9999". 
- Unlike the first 3 domains referenced, there are no Active Directory trust relationships established with this domain.  That means your AD credentials will not work.  We may change this since most of the work in this domain will be "please reset my password" or similar.  With a trust or syncronization, the user will use their AD password.
- Only a handful of WSG engineers have accounts here (as of this writing) but everyone should.
- Access Instructions
- Log / RDP into the system using SAT\yourUsername
- RDP to the SAT system(s) that you need to work with.  Or, if you need to add users/groups, you can connect to SAT domain controllers in the next bullet. 
- RDP into one of the SAT domain controllers:  TNVNWG001A0001.sat.cbp.dhs.gov, TNVNWG001A0002.sat.cbp.dhs.gov
5. **ATSPROD**:  This domain belongs to TASPO.  At one point it was to be retired but no timeline was established.  This domain trusts CBP AD (i.e. 1-way).  Since WSG does not offer primary support for this domain, TASPO engineers will reach out if necessary.
6. **ATSDEV**:  This domain belongs to TASPO and is supported entirely by TASPO. 
7. **DSA.DHS** (aka AppAuth):  This is DHS domain where all DHS services (like EaaS) are located.  
- From a memo dating back to mid-2014, we do or should have admin privlidges to the CBP OU. 
- Access Instructions (read-only)
1. Launch ADUC
2. Right-click the upper-most part of the tree and select Change domain.  Type:  DSA.DHS
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Active%20Directory%20Instances.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Active%20Directory%20Instances.aspx)\>
Backups/Miker/.trash/Information Default Domain Accounts.md
+26
View File
@@ -0,0 +1,26 @@
AD.CBP.DHS.GOV
**Default Guest Account**
"Guest/ xGuest" is disabled
**Auditing/Alerting**
Changes to the Account (i.e. Enabled) generates an alert by Quest Change Auditor, and is immediately emailed internally to WSG Tier-0 Staff
**Default Admin Account**
Renamed From “Administrator” to “RGMSWODNIW”
The Account, by its nature cannot be disabled, it is in essence THE Admin Account for the Domain
This is to prevent any potential lockout from the Domain. The account will always enable itself shortly after its disabled
The Account is only used under the rarest of circumstances by Tier-0 Staff and Activity is monitored
 
- The password is only known\accessible to WSG Tier-0 staff
- The password is maintained in the WSG ADEX Password Database under “Protected Mode”
- Only members of the Tier-0 Security Group “AD\ SG-WSG-ADEX-PWD-DB-Protected” have access to the password
- Only WSG Tier-0 Staff, “Domain Admins”, have the ability to change the password
- The Password is updated and changed every 6 months, and after each use for an enterprise process
 
**Auditing/Alerting**
- Any Membership changes to the Tier-0 Security group “SG-WSG-ADEX-PWD-DB-Protected” generates an alert by Quest Change Auditor, and is immediately emailed internally to WSG Tier-0 Staff and CDS ISSOs
- Changes to the Account (i.e. Password change ) generates an alert by Quest Change Auditor, and is immediately emailed internally to WSG Tier-0 Staff and CDS ISSOs
- The Account is flagged in Microsoft ATA (Advanced Threat Analytics) to Alert the CBP SOC and WSG Tier-0 staff if this account is used to Authenticate to the Domain
Backups/Miker/.trash/Information Disable Bitlocker on drives.md
+21
View File
@@ -0,0 +1,21 @@
If you are disabling bitlocker for all drives the data drives need to be disabled first before you can disable the OS drive.
Here is a screen shot of what the drives would look like when BitLocker is enabled.
![Exported image](Exported%20image%2020250808202522-0.png)
To disable bitlocker on data drives open an elevated PowerShell console and run the following:
Disable-bitlocker -mountpoint \<drive letter:\>
Ex: disable-bitlocker -mounpoint "d:"
![Exported image](Exported%20image%2020250808202523-1.png)
You can use the cmdlet get-bitlockervolume to monitor the progress of the drive being decrypted by following the "Encryption Percentage"
If you want to disable bitlocker on multiple drives at once you can run the following:
Disable-bitlocker -mountpoint \<drive letter:\>,\<drive letter:\>
Example: disable-bitlocker -mountpoint "e:","S:"
![Exported image](Exported%20image%2020250808202524-2.png)
Screenshot of when BitLocker is disabled on all drives.
![Exported image](Exported%20image%2020250808202525-3.png)
Backups/Miker/.trash/Information Federal PKI Map 2.md
+1
View File
@@ -0,0 +1 @@
![Exported image](Exported%20image%2020250808202011-0.png)
Backups/Miker/.trash/Information Federal PKI Map.md
+1
View File
@@ -0,0 +1 @@
![Exported image](Exported%20image%2020250808201937-0.png)
Backups/Miker/.trash/Information Field Mappings.md
+20
View File
@@ -0,0 +1,20 @@
| | | |
|---|---|---|
|**ADEX Field Name**|**Example Data**|**Database Column Name**|
|==Application Name:==|ADEX|[MajorApp]|
|Application Program Office:|EDME|[Record_Owner]|
|Application POC:|Razzano JR, Neil|[APP_POC]|
|Alternate POC:|SCHWETZ, BRIAN C|[AlternatePOC]|
|WSG POC:|Windows Services Group|[POC]|
|Description:|ADEX|[Description]|
|PlatForm:|Physical|[Platform_Type]|
|Type:|Windows Server|[Type]|
|PIMS:|8004088399585959|[PIMS]|
|Serial Number:|USE5470P9L|[Serial_Number]|
|Grid Location:|34AN|[Grid_Location]|
|DRAC: DNS Name|tnwg01a-p0657-ilo.cbp.dhs.gov|[DRACName]|
|DRAC: IP|10.159.18.113|[DRACip]|
|DRAC: Gateway||[DRACGateway]|
|Description:|ADEX Server (WSG)|[Description]|
|Status:|Production|[Status]|
|Name:|TNWG01A-P0657|[Host-Name]|
Backups/Miker/.trash/Information How to recover a deleted AD object.md
+11
View File
@@ -0,0 +1,11 @@
To recover objects deleted in AD, you should utilize Quest Recovery Manager for AD.
The User Guide & Docs can be found right here:
![[RecoveryManagerForAD_ForestEdition_9.0.1_UserGuide_en-us.pdf]]
![[RecoveryManagerForAD_ForestEdition_9.0.1_QuickStartGuide_en-us.pdf]]
Marcus Gregoire is your main POC for AD backup related issues.
Recovery Manager is installed on server tnwg01a-v0505

Some files were not shown because too many files have changed in this diff Show More