I’m sure you’re probably tired of the bombardment of Info-Sec (Information Technology Security) articles and posts telling you that you need something more to fight lateral movement. Do this, do that, buy this, trial that, use this freeware. It is exhausting if you are an IT Pro trying to do the best thing without impacting your budget or users too much. Ransomware and other exploits target lateral movement as a way to get to the privileged accounts on your network. I am not going to list changes that have a big impact on your users like removing local admin rights. You should never allow users to have local admin rights in any production environment and, if you are allowing it, you’re going to spend a lot of time implementing the removal of those rights. Passwords should be long and complex and if you aren’t protecting your log in accounts with lock out policies then you have bigger problems than Ransomware. Patching shouldn’t be talked about because patching isn’t negotiable any more. Do it and don’t ask questions. You shouldn’t be more than 30 days (14 days is better) behind in patching and you should be patching ALL of your third party software in that time frame as well. Instead, I will be talking about things that IT Pros can do that cost very little or nothing at all and have little impact on your users. Most of this will consist of minor configuration changes in Microsoft software including Windows and Office as well as other infrastructure changes related to networking that can yield decent protection rewards. So let’s get to it.
Migrating DHCP roles between Windows servers can be painful. I wanted to share my favorite method for doing this. I think it is the least difficult and the most effective way of getting your DHCP services moved to a newer Windows server with ZERO downtime. It isn’t perfect and it can fail. However, it works most of the time and when it does, you will feel like it was too easy!
This sounds really easy but it can be challenging if you have never done it before. Out of the box Windows does not want to run Powershell scripts in an automated fashion. There are some security hurdles put in place for this reason. This blog post will show you what you need to know to make Powershell task scheduling a breeze.