uh just a quick introduction my name is
eric benick i'm
from weber state university my
job title is kind of fancy it's director
of computing services but it really
means just
jack of all trades you just do
everything
the
the idea behind the presentation which i
called
system administration with the cyber
security was
a
kind of a practical application
with
free tools and at first i tried to think
about
what i did with those tools and
looked at specific instances but the
thing is there in our environment we
have some
really nice and expensive stuff that
goes with it some incident management
software
crowdstrike that type of stuff
and so i didn't really want to make it
so specific to that that it wasn't
applicable to everybody else so it's
been through multiple revisions the
the idea is i tried to make it more
universally applicable
so that
regardless of what your size is
big or small
i hope you could just get some ideas
might help you
improve things in your area maybe make
your life a little bit easier
there's a ton
just a free stuff out there
that you may or may not need and
there's probably going to be a couple of
things that i
show or talk about that you
already know about
and a couple of words just at the
beginning here
make sure you check the terms and
conditions of the tools before you start
using them i know a big thing we run
into is uh
there's stuff out there that's free for
personal use but when you put it on your
enterprise system you're stuck paying
for it are you supposed to
get approval to use it in your
environment and
a big reason behind that is sometimes
some of the
administrative tools
especially for remote administration can
trigger incidents
and if nobody's expecting it it can be
alarming i've i've seen that several
times actually with
cis internals and some of the other
things because
they can be used for
privilege escalation and lateral
movement and sometimes hackers use them
but
they're really useful for legitimate
reasons too
and these are all things that i've used
before and found to be useful
i tried not to just
google a list of stuff
bring a bunch of junk and then
talk about it because that's not really
what the point is everybody can do that
um and i just also want to say
i'm not making a personal endorsement
of companies that produce these products
sometimes there's really good stuff
that's put out there by companies
as contributions to the community that
that's part of what they do
but
it doesn't mean that i'm saying go out
and buy this product or
you know take your business to this
vendor i just think that one specific
thing is good
so i'm gonna go on a couple of
fundamentals this is just because i have
to start somewhere and i'm not going to
spend time discussing these because
they're really basic but
it's kind of an assumption when i talk
about this stuff that
there's a few things that have been done
already
i would hope that you have a good set of
policies in place so that you actually
know what you're doing and hold people
accountable
you're gonna have support from the
management
because really if you don't you're in
big trouble and
you'll never get your
job done
make sure you've identified user roles
this is really important for the next
part which is permissions and privileges
because different users need different
permissions most
you know everyday productivity users
don't need to be admins and
maybe developers do so
make sure you know that
and powershell
it's so useful if you're managing
computers in a windows environment i
know they say it's a cross-platform the
cross-platform
applicability is
limited in in my opinion and experience
but
for windows 100 that's just kind of a
need to know thing if you want to
make your life easier
so
going to the next part this is also
going to be really brief just
some suggestions for next steps after
you get down the basics there's
a lot of good security baselines and
templates available through microsoft
that's a good place to start
to figure out what kind of security you
want to implement
um learn about windows wmi which is
their management instrumentation so this
is useful in both your scripting and if
you're a developer
creating your apps
in c sharp it basically gives you all
the information about objects and
classes and
everything you could recall from windows
uh that would be useful in
doing stuff um
you know maybe learn a little bit about
pro and ports and protocols
know how to collect windows logs and
also read and understand a good portion
of it
this one is
kind of something
i prefer but it
i just suggest try to standardize
with one hardware source or vendor if
possible i know a lot of times it's not
due to budgetary but there are vendor
tools that are very useful
that you get to take advantage of by
primarily going with one
one manufacturer
you just get good group policies if
you're
have a domain set up and
don't don't feel bad about copying what
others have done
because
that's a good place to start to find out
what they've done and apply it a couple
of recommendations that maybe you want
to do right now
is
disable excel 4.0 macros
block internet explorer because of
mshtml vulnerability in docs i know that
was talked about a little bit in the
keynote
those are ones that are
kind of exploited frequently or
attempted to exploit
and just think about things you can
combine
tools or procedures to make better
do what works for you
so and a good example actually of one
that i've used a lot is
when automating things
especially with reporting and
information gathering powershell has a
built-in option that you can email stuff
out so we use
basically an smtp relay server to
email our reports and then they actually
show up automatically in box so that you
can just go in there and collect them or
run them on a regular basis and have
them you know historical archive
so that's a really easy but useful
combination of things um
so
i'll start out by the next section it's
just a little bit about human risk
management so
from the side that i work in the biggest
risk are the people
um
i do a little bit of server
administration but it's primarily user
workstations
so
when you're thinking about
how to apply security and and policies
in that area how to configure machines
just think about those people you got to
know your users but think about how you
can
work with their interactions with the
machines to mitigate problems
good thing is user session white lists
if you have a domain
maybe not let every authenticated user
log into every computer
maybe try to create security groups and
you can automate that by putting people
in the right ou's based on departments
or whatever
so that they get updated automatically
but that'll limit access to computers to
people
that might have some kind of a reason to
get into them
microsoft lapse that's a good one for
remote administration if you
have people that are standard users but
maybe need to have the ability to
install something
you know you can generate that random
password
and or connect and help them with that
hardened rdp connections if you went to
the privileged escalation stuff and saw
the mimikats
maybe they showed it how you can dump
the memory processes from
basically open rdp sessions to steal
people's credentials that are stored in
clear text so
there's some things about that
especially when you're connecting to
servers or sensitive systems there's an
admin session that
helps protect you disable password
saving least privilege model windows
credential guard is another good one
keep yourself safe so
next part
going to talk a little bit about
automation
these are things that i've done
that we found to be helpful is
so windows task scheduler if you don't
have access to
system center configuration manager
this is something you know that's built
into windows
yeah and there's all kinds of hooks that
can be used to execute scripts or gather
information
pretty much anything that you could
think of to create a recurring event
and
the
the result is you can
basically create reports email them to a
box account and collect that stuff
so i'm going to pull up a couple of
examples here
of stuff that we've already done
so i got one
so this is going to be a report on a
specific
workstation about their largest folders
so
there could be
somebody calling and complaining oh i'm
out of space or you know i'm getting
this warning that
i can't save
you might want to know where where all
their data is being used so
this one is talking about
uh where it actually just lists every
folder and what the the size and the
number of files are of all those things
so as we can see here
it lists all the size percentages of
what the total storage is
it's useful for trying to figure it out
if they're making that type of complaint
can be done remotely
gathered remotely it's
a pretty easy tool if
if you're going to do that that's
through powershell
windows stability metrics
let me pull this up i don't think this
will show properly in
box we'll try
this one gives you a rating of
application stability and if they have
instable
or unstable applications
it can give you an indication of
maybe why it failed
so as you can see here on this
workstation
it gives us information from the system
logs
application
failed to start
application error and this can help you
actually predict problems before they
happen so
if you
if you have a lot of systems you could
scan this
and pull it up when people ask about it
if you only manage a few systems you can
actually
create a report that tells you what your
most
you know unreliable apps are
oh actually there's another one i can
show you the
um
battery health that's another good one
uh if you manage a lot of computers
i'll skip some of these just because
they're more ideas free space and files
microsoft safety scanner that's actually
a good plan b if you
have an incident management that comes
up and you want to find out more
about what what's going on maybe you
don't know if it's a false positive or
a true positive
microsoft has a safety scanner app built
into windows
so you can actually generate those
reports
pull them up remotely and see what it
says and it'll actually give you an
indication of stuff that's been modified
in the registry when
what change was made what it could be a
hint of
it's it's basically just a tool
to give you more information
see
so audit logins and audit failed logins
so this is a pretty useful one
and i'm gonna see if i can pull up this
report here just to make sure i can show
you here
so if you have nice tools you could
actually pull this up through
[Music]
you know something else but
if you don't maybe you suspect somebody
is
logging into your computer
when
they're supposed to be closed could be
a different employee or could be
you know staff somewhere else
these ones i've actually got stored in
different folders here
so this is actually
an add-on powershell module
that you can get from the powershell
gallery which
i think it was made for azure but it
works just fine on most workstations
so this one takes information from the
windows logs
it tells you about what you know the
name of the computer
what type of log it came from
the provider you know event type
audit failure so these could be
um some of these are part of the
security scan so just when i ran this
one
it's got me i probably put in the
password wrong
security scan this is actually our
vulnerability scanner
it's not it's not too eventful on here
because there wasn't anything malicious
going on but you could see right away if
you had somebody that wasn't authorized
to be logging in that was connecting
we'll go on there's all kinds of stuff
you can do you can whitelist extensions
and chrome and edge it's really useful
if you
have a problem with people installing
coupon clippers or whatever they don't
need
disk space reports so
i'm going to move on to the tools
section which is actually
the bulk of this presentation
so
rather than creating a bunch of
powerpoint slides that kind of static
images i'm going to go through
some of these and pull them up
we'll go through the links actually
on this first one
it's a tool called wim witch
and
i found this useful in maintaining our
images
you know a lot of machines with updated
drivers
you might image them and then they fail
right away because maybe they don't have
the nvme controller or
they might not have the right network
adapter
uh this is
a script in powershell that has a gui
while i'm waiting for that to pop up
i'll go to the
page here
so this is a so this blog or our page is
a good resource for tools
which i'll include in the information
i'm going to make available to everybody
but
uh it's it's part of the free tools this
msn point manager suite provides to
people
and sometimes it takes a second to load
but
essentially what it does is it takes
your wim images that you captured maybe
through
system center or you could have done it
through like windows mtt or if you do
your own
and allows you to essentially inject the
updates
drivers
some customizations
a lot of stuff
language packs you can add or remove
things
and
if you if you image a lot of computers
and you get tired of sitting around for
the updates to finish this is really
useful because you can essentially keep
a
an up-to-date image all the time or
we update ours weekly just adding
relevant drivers or updates to it
that way it saves you a little bit of
considerable time i should say if you
have a lot of computers
and
makes life
it's a little easier
in that regard
and
well if it eventually pulls up
i'll go on
so that the windwitch tool actually goes
really good with this one it's called
modern driver management
and this is a tool provided by the same
company
there's a lot of things you can do so
this one actually can work together with
your domain
and it uses wmi to actually scan
the vendor
and the model number of all your
machines
then you can actually download the
driver packages you
you can automate this
so that
at given interval all the driver
packages for all your supported devices
are updated
you can actually
also use some of this stuff as part of a
task sequence so if you use powershell
if you have windows pe with powershell
integrated
there's some stuff you can do with this
tua to automate
injection of drivers while you're
downloading and imaging things
and there's a little bit of extra
configuration involved
otherwise uh
i'd pull it up for you but i've used
this one in my office
um this one's up now so this is a whim
this is a
whim which has the gui here
as you can see you can you can import
your existing images which would be
on your system center server
you know you can insert scripts to be
done as part of that
that image installation
drivers here you can inject entire
directories or
individual files
autopilot so if you want to get rid of
some of those prompts when you're
setting up a computer
configuration manager integration
a lot of stuff
you know useful for
maintaining your packages or your images
so
real quick i'm going to just talk about
uh
some of the tools i use that are vendor
specific so
i know lenovo has them hp has them for
dell i use it's called command configure
which is actually able to modify bio
settings
so
you get a bunch of computers you want to
make sure
tpm is enabled on all of them
wake on lan
uh
you know vpro or what whatever you want
you can actually configure this to
automatically apply those bios settings
and it can be scripted inserted as your
task sequence we also have group
policies so if we make a change to
whatever our configuration is
it applies automatically to all those
machines that we manage
dell command update is actually another
great tool that they provide
so it automates the updating of bios and
system drivers and if anybody's ever had
to manually go and update bios on
you know 50 machines you know
what a big time saver it is when you can
automate that and the a little bit of
warning for
automating bios updates they can
occasionally trigger bitlocker so if
you're running full disk encryption with
bitlocker make sure
you're also storing all your keys
somewhere either
in active directory or
you could be downloading them
store them somewhere because
occasionally you'll hit that and
you don't want to be stuck without a
unlock key
so we're going to go on next to
what would be considered information
gathering
so these ones here are tools that can be
used inside of other scripts
powershell typically
and they provide
information that uh that i find useful
in management there's
wiz tree which is actually a very fast
disk space analyzer can create a report
about
how many files you have where
similar to what i showed you before but
a lot more detailed with
uh graphical output
i think it makes like a block
type diagram where there's colored
squares that tell you each type of file
and how much space they're taking up in
relative to the entire disk
winderstat that's similar
there's also chainsaw log analysis this
is one that i actually just found out
about recently
and only used it a couple of times but
it is
an open source tool that can be used for
analyzing a large number of logs so
you're
gathering logs from 50 different
machines maybe you're looking for
specific events
or trends
um
and i read a lot of blog posts this is
uh one from bleeping computer this is
actually one that i
found out about so
log management seems to be one of the
things that there's not a lot of good
open source tools out there for
there's a few but
they're so
hard to come by or specific that
anything you can get your hands on is
useful so
this is a good tool if you if you're
doing log analysis
i recommend checking it out there's
a list here of what you can do
search through event logs for specific
event ids keywords or regex patterns
extract and parse window defender you
know basically antivirus alerts
detect users being created or added to
user groups
you know key events
attempts to brute force accounts rdp
logins etc so
the the idea with this is if there's
something going on in the big picture
maybe
a bunch of your computers are being
brute forced
you might not see it on the outside but
if you're doing an analysis you could
pick it up by saying there's
you know 10 000 log you know failed
login attempts across 50 different
machines
and
it's a good little tool for log analysis
so you don't have to actually go through
and look at all of those
things
uh win merge so if you ever had two
things you need to look at side by side
could be maybe you're looking at a
driver package to determine what's been
changed or what models are supported or
have been added
could be
text file could be anything a program
could be something that's detected by
your incident management response
if you have a known good version of that
file you want to see what it looks like
next to one that's in question
and this was useful recently we had
an event pull up that was
i think it was
intel amt
so there was a driver that was detected
as
having privileged escalation
in crowdstrike
but it was it was a pretty it seemed
like a pretty benign
daily thing
so
essentially pull up the
known good version look at it side by
side with the one that was being
detected as being malicious and you can
see right away the only thing that
really had changed is some
of the information formatting there
wasn't a whole lot so it was probably
a false positive generated by
an accidental report that had
application hash to their ai
which happens sometimes so
it's it's a it's a good thing though
when you
when you don't know about what the
situation is to try to verify it some
way
and that's one use there's
an infinite number of ways you can use
win merge
um hxd hex editor that's probably one a
lot of people have heard about
it's just a good freeware hex editor it
also allows you to do a quick and dirty
dump of memory processes which i like
so if you
maybe want to see
if you have insecure rdp sessions you
can go ahead and pull us up and try to
dump your memory processes
search them for
clear text examples of your usernames
and passwords and
this is also one that may trigger an
incident management so
if you are
memory dumping processes
that can get detected by the ai as
an attempt to steal credentials so
that's when you want to just kind of
think about
application management
these are things that
could help you create or distribute
packages
system center configuration manager has
its own you know built-in thing for
application distribution but you might
not have access to that
so
chocolaty is great open source tool i
use it all the time and they have public
repositories for just about everything
you could think of
and
the most common apps for sure
if you install
the chocolatey module into chrome or not
into powershell then you can actually
remotely install and update apps
uh to users you know if they're on your
domain if they're outside your domain
uh make it a scheduled task to run that
command you could do
choco update chrome i think is what it
would be and that would just update
chrome to the latest version or
whatever application that you have that
installed with chocolaty
so
it does have the option to actually
create your own repositories there's
free
repository software one of them's nexus
nougat
you can use visual studio code to create
your packages
uh requires a little bit of work but
for free it's it's a great alternative
a lot easier than going and taking you a
speed drive and plugging it in
everywhere
um msix application packager so this is
a fairly new one
and we've used it a few times
for
applications that are really tricky with
trying to think of a good example we
have so we have one app that stores
registration key and the user
information in the in the user profile
but we have multiple users that log into
that machine which means every time a
new person logs in that application has
to be reactivated
and but it deactivates the last time
so you just have this mess of constantly
having to enter the key and reactivate
it
with the msi packager you can basically
re-wrap the installer to
do stuff let's say
we want to run it as the same user every
time so regardless of who's logged in
you can define a specific user
and when
to the users it's pretty much
transparent they just run and install it
as normal but
you you include the registration key
installs runs as that same user every
time
and they're
applications that are packaged with msix
are more similar to containers than
there are to traditional windows
installs so
if you're familiar with how that works
it's a much cleaner and safer way of
installing things
since when that application package is
deployed everything registry keys
it's essentially packaged as a separate
layer almost
you know a container on top of the os
so adding and moving apps is really easy
you know doing arguments
you could totally redesign how an
application is installed or how it
appears to the user
during the install process or
take something that wouldn't be a
transparent install and install it
and
it has a ton of features i have haven't
been able to explore it all yet but
um
it's very useful
so master packager this is one
i think i'll pull up here and show you
so this is another
free application packager similar to
msi packager msix
but provided by a third party
and
nice thing about this is it's another
one of those tools that
can be very useful but it's
difficult to come by there's a lot of
options that cost money to go out there
and
package applications but
not a lot that are free
let's see if i can pull something out
here real quick
so you can take existing msi installers
make this bigger pull them up in the in
the packager
and modify the parameters
of that msi installation
or you can just see what it has inside
of it sometimes
maybe you want to know what registry
registry keys this application is going
to add to your machine
that's another good use of this you can
actually open existing app packages
you know browse what those are going to
be
maybe you have a questionable
application that you got from somewhere
but you just
want to make sure it's safe
change the icons
as you would expect in
a package manager you can just pretty
much modify it any way you want
you can change the install and uninstall
parameters where location is
all that good stuff if you want to
install
user data or program files
a lot of useful things can be done with
an application packager
um psf deploy toolkit this is one
i've
i think i've used it once or twice
but when i did use it it was actually
pretty useful
so this is essentially
a toolkit designed for pushing out
applications via powershell
so this can be useful um just about any
environment you
you can use that app packager when i
just showed you to
create a new application package or
re-wrap an existing one
and then you can just do a mass
deployment with these powershell app
deployment toolkit
i won't go through all of the
information on that it's it's all
available on the website here but it
tells you
you know
you can integrate it with secm
um or standalone
all right so i'm going to go on to a
couple of things now that i think are
just primarily making life a little bit
easier
so
client center for configuration manager
now this is an open source project on
github that
works with
microsoft configuration manager but it
kind of consolidates
a lot of little things and gives you an
interesting interface
it's actually available in the microsoft
store too so it's
something that can be installed quite
easily
there it is
so you can essentially connect
to a computer on the network or in the
domain
i p address machine name
oh i gotta run it as an administrator
that's why it's not working
oh come on
maybe if my right click would work
okay
um
so some of the things that i think are
really useful about this is uh it's got
some good monitoring tools
you can monitor
processes in real time
you can see what services are running
it's got the event monitor which
is
information that will end up in your
system logs
but this tells me all processes that are
running adobe cef helper
you can also actually remotely terminate
processes so
if i want to get rid of this somebody's
complaining about something taking up a
lot of resources making the computer
slow
right click it
kill process
it's going to terminate that on that
machine
just as if you had done it from there
task manager
it's got some inventory information so
you can actually
see what software has been installed
gives you a list of stuff
some some information about the hardware
can tell you kind of hardware installed
you know make and model serial numbers
stuff of that nature power settings
a lot of neat little things that are
kind of combined into this user
interface
software distribution this is
kind of a quick and dirty way of pushing
out
applications via powershell and the the
nice thing about this tool is if you
have
uh stuff that you need to install needs
administrative credentials this will
actually
encrypt the credentials
for the user you're logged in as or the
user that you run it as that way if
you're executing something remotely
installing software the credentials
aren't
available
in clear text or in a file or something
to be stolen they're actually
encrypted and
and used to authenticate on the remote
machine if you've so as long as you have
admin privileges on that machine
everything should work as expected
they have you can actually open a remote
powershell terminal
um
there's some stuff here for uh reporting
let's see if there's anything
interesting
emt status check
yeah
so
it's a nifty little tool that really
that you can use
we use it occasionally just
to troubleshoot things
um so sysinternals this
this one's been around a long time and i
think
a lot of people are going to know about
this
and have used it before
but this is a really power powerful
extension
to microsoft powershell
really good for
doing networking diagnostic
troubleshooting remote administration
it was just recently updated to actually
be in the microsoft store so you can
have it updated automatically
a word of warning though this is
something that will almost certainly be
detected by
your incident management software simply
because it has so many functions that
are
done with administrative privileges or
stuff that would normally not be done
remotely
there's a whole list of things here for
file and disk utilities we use these as
part of our scripts for
doing all kinds of things you can um
i think there's like a speed test
in here so someone's complaining about
slow internet we
create a actually outputs what all of
their
network connections are
their configurations does a speed test
with against a designated server you
know it tells you what their transfer
rates are creates a report emails it to
box we open it up and then
we kind of have an idea of where to
start when we're troubleshooting
complaints of a
slow access
security utility so
auto log on
that's
it's basically a better way of doing the
if you have an instance where you have a
machine that you need to boot straight
into
an application like a kiosk maybe
a slightly improved way of doing that
gives the information about logged in
sessions rootkit revealer
you can
scan you can set up scan remotely via
script looking for
hints of a root kit
let's see it's a lot of information
about hardware miscellaneous
super useful this is this probably the
most useful
powershell suite
[Music]
that we use just because it has so many
useful tools inside of it
so i've got a couple of little things
here
i mean macs they do exist and we got
some of them
in our environment so i did include a
couple of things we've used before to
help with that
there's a really good little profile
creator anybody that's ever tried
making an mdm or using apple's
uh managing thing what is it i can't
remember
yeah anyway it stinks when you're when
you're managing profiles for ipads or
laptops and stuff like that
so there is a pretty good get project
available
and it's just called profile creator
and it
the application itself
isn't actively maintained but the
modules that are used in the application
are so
you can use the source code and
recompile for new versions of os x
big sur for example has been updated by
community users rather than the original
author
but for
still a majority of the macs out there
you can use this to actually create
profiles that will still work the
the one catch right now is if you use
the one that's on this page
you may have to
have a mac with an older version of the
os to make the profile creator work but
the profiles that you
generate will work perfectly fine on
the newer versions of the os
since the settings are all the same
and i mean there's a ton you can do
hundreds of options
if you've ever created profiles you know
you can customize everything
brigadier so this is an interesting tool
anybody that has an intel mac that still
has the ability to do boot camp
some of that setup and install can be
automated with this tool
uh basically scans the model number
from the bios automatically drives
downloads of driver packages from apple
server
and then after that it's up to you but
if you let's say you want to get rid of
the mac os or add another partition with
windows
you can create task sequences in system
center that
create the image you use the brigadier
command to download the app the driver
packages
and essentially continue installation
put it all together boot it up have a
working version of windows
and
saves you the time of messing around
with boot camp
it doesn't work with the m1 max
unfortunately that's
just a different world
a couple of words these are just shout
outs i'm not going to talk about them
really because the oldies but goldies
they're just
good tools in general other people i'm
sure we'll talk about them way more
notepad plus plus
it's just a good
text editor in general for
opening scripts really quick and looking
at stuff
wireshark
doesn't really need much introduction
i've used it several times when
troubleshooting issues with file shares
or
stuff like that um trying to track down
why this
app worked doesn't work when it should
it could be one single protocol isn't
working
vmware horizon that was a good one that
setting that up has all kinds of things
you need to
configure on the firewall
putty ssh ssh still exists
all over the place you being able to
access it from windows is is great
app locker it's probably a bit of an
under appreciated tool
if you
run an environment where you can't make
everybody a standard user but you can
do
application limitations on what they
install this is the way to do it
basically provided by windows you can
define
applications limit them either by
version or
you know not limit them by version you
can just
limit them by application name so
you might want them to be able to stall
every version of zoom
or every version newer than 5.0 set that
all up in
app locker and even though the users are
administrative users
if they try to do stuff outside of
what's defined they just can't so
i got some honorable mentions here oh so
these are tools that are pretty specific
to
maybe
if you have health care records in your
area
there's the health and human services
provides some useful little tools
there's
security risk assessment tool
sra tool this is
mostly a question and answer thing the
trick with this is you have to be honest
so we'll go through and ask you a whole
bunch of branching questions that helps
you evaluate where you're at
from a compliance standpoint and what
you can do to improve
if you don't know where to start this is
this a perfect place to start because
it's essentially
not very technical you just install the
app you run it generates reports
and
gives you an idea of what to do next
oh this is
another one provided by health and human
services security content automation
protocol
so
it's another tool just just to help you
check if you're you know where you're at
with compliance um
has a wide range of compatibility
install guide this one's a little bit
more technical to set up
so good information sources the
i mean the backbone to staying on top of
things is just develop a list of good
information sources maybe create a
mailing list
whatever works for you
in fact i use essentially
you know like a feed burner i think is
what it is
i've used that before
but essentially create your own feed of
these sites that you find interesting
that will have news for you that it
tells you what's going on in the world
of security could be
what zero day exploits are what the new
new tools are
what people are doing
good ideas
this one here i find especially
intriguing
system deploy so
this guy is a system administrator that
he just provides a ton of useful ideas
he
has done all kinds of cool stuff he's
replaced all the default visual basic
mdt scripts with powershell stuff he
provides in-tune reporting
tells you how to make dot-net menus for
powershell-based applications so you can
have a more traditional gui
maybe you want to make a one-click
button
application that
sets up a
you know a bunch of applications and
windows and you can do that
he's got all kinds of stuff highly
recommended just to see what he's got
because it's it's just really neat he's
really talented
a powershell gallery that's
of course microsoft
sponsored one
tons of tools
modules to extend powershell to do
pretty much anything you want one of
them
that i was looking at recently was
actually
um
duo i don't see it on here but
maybe it's in the git
but
just about anything you could want to do
is is available through the powershell
gallery you basically take what they
give you
customize it to do what you want it's
the sky's the limit
a couple other good places oh this is
another new one i found the cyber drain
it's just recently this is
something i found through the microsoft
mvp which is most valuable professionals
page
he does a lot of cloud stuff managing
microsoft 365.
he gives you a lot of just free
automations
and this guy's also a major contributor
to a lot of the
large
system management and application
packages so whatever he gives away for
free is actually probably worth
thousands of dollars and you'd pay
thousands of dollars if you bought it
through one of his
collaborators
a couple of things at the bottom here
these are
these are free tools
that are marked with an asterisk because
um
they
kind of have a
they might make try to make you sign up
for their email list
i actually still think they're really
good
this one here wmix
is very useful so if you're just getting
into
wmi and what you can do
this is actually a really nice tool
because it essentially lets you browse
everything so you can define locally
remotely you can browse what the wm mi
objects are get an idea
of what you want to put in the script or
export what you find
they do make you
put your name and information in here
that's why
i marked it with an asterisk but
i use a burner account for that i have a
spam account that uh i'm sure a lot of
people do you just sign up and then
download the tool they don't
they don't make you verify anything
after you put your information in
recast right click tools
another one you have to
sign up before they remove the wall but
uh this is a free tool essentially adds
more actions to your right-click menus
so you can customize these on your own
you can
you can go to registry and customize
what shows up when you right-click but
this adds a lot of other useful
functions that may extend the
functionality of tools like
system center
they've packaged all together to make it
a little bit of a
slicker experience or quicker to get to
things so you don't have to click
through a bunch of extra links
windows tweaker tool
it's
there's something fixing permissions
fixing windows updater
sometimes things happen that you just
can't figure out this is
something i've used before their
their page is just packed with ads
so
the tool itself is free once you get it
there's no pop-ups or advertisements or
anything
does have a banner but the
making sure you find out which download
link to click on that's a tricky part so
that's why i put it with an asterisk and
it's
it's a good tool though that's
i put the wrong link though but
let's see if there's anything else i i
mean that about summarizes it i
have a few minutes left
i apologize for going so fast i signed
up for the one hour presentation
imagining it was gonna seem like it took
forever and then when i realized the
content it
that i had and how much there is out
there
yeah it seemed like i should have signed
up for two or three hours but the i want
to ask if anybody has any questions or
[Music]
wants to see anything know anything
i'm going to actually
provide just a list with all the stuff
the links to all the sites
um
and talk to
chris afterwards and they're going to
put it up somewhere on the saintcon site
so that anybody that's interested in
these can go back and and look at them
in more detail and
yeah it's a lot of useful things in here
but any any questions
oh endpoint management
um
let's see
the
i'm trying to think without i so i've
got one right now i use called
governland
which i really like the um try not to
give an endorsement because when i
signed up for it i said you know not
gonna
promote anything but
the
i mean system center configuration
manager
has some endpoint management stuff if
you're using windows defender
i mean we we have crowdstrike
and rapid7 and we have so many things
that just work together
um oh my gosh it's hard to pick out one
in particular because we use all of the
stuff
i mean but but governland i think is one
that i
have used a lot and liked a lot
and um i mean there's there's lots out
there
just depends on what your needs are if
you need compliance if you need fips
compliance
there's not a whole lot so
if you need
certain levels of compliance that's one
thing that really you need to look at
when you're doing your endpoint
management like if it supports
like mf mfa authentication
that's really important because if
you're doing any type of remote
administration in an environment that
requires
high level of security
um some example i used was the fips so
if you're working in the federal
government anywhere that requires
clearance
you have to have you know their cards
and
the any endpoint management solution you
have would be need to be
fixed fips compliant it's hard to say
what i like because it's
more applicable to what you need but
yeah the
there's a lot of options
is it is there anything else
all right well thank you guys i think
this is the last presentation of the day
so
if you want to come up and talk to me
about anything
i'll be here all week
i appreciate your time
[Applause]