Read: 13 mins. How do you find out who made a change to an Active Directory or Builtin Local Group? Which users were added to or removed from a group? When was a group deleted? In this post, we look at Group and Membership change Event IDs, and explore how to use Splunk to find relevant information to aid in your investigations.
Read: 6 mins. We have recently enabled Single-Sign On (SSO) for our Cisco Umbrella dashboard and had to convert the existing, non-SSO accounts to use SSO. What should have been a straight-forward process was greeted with login issues and an inexplicable association with the OpenDNS dashboard. Here is how we secured the accounts and got SSO to work for each of them.
Read: 3 mins. A sensitive, internal meeting was held within Microsoft Teams, and someone had accidentally recorded it. The organizer was extremely unhappy when nobody admitted to it, particularly since any attendee was able to download a copy of the recording. An urgent request to the Office 365 and Information Security teams was put out to investigate. How did we go about in doing so?
Read: 4 mins. HP is a leader in business-class printers with its LaserJet Pro series of devices. The new M404 series is no slouch and has become our primary, paper output option at home. For businesses, this new entry includes some excellent, security-focused features.
Read: 2 mins. FortiManager uses a self-signed, untrusted "Fortinet_Local" certificate by default. Here is how to request and implement a CA-signed one so the "Your connection isn't private"/"This site is not secure" error thrown by your browser goes away.
Read: 22 mins. A Windows account keeps getting locked out and breaks a business-critical application that is responsible for a large volume of revenue. Angry customers have called into customer service to complain, and your manager has asked you for help. How do you find the source for the lockouts? Here is a comprehensive guide to aid you with resolving the issue. BONUS: Look up when an account was modified, disabled, enabled, unlocked, or had its password reset -- and by whom