Category: Co-Managed IT

A Medical Office’s Journey to the Cloud

Today we tell the story of a medical office’s journey to the cloud. This particular client was facing their server operating system reaching end of support (a HIPAA violation) in the near future. They had begun by looking at their electronic medical records software company’s online offering, which didn’t have all the functionality of their on-premises software and was very expensive (this is typical).

They next decided to look into moving their current on-premises software into the cloud and we were asked to help with the testing. We determined that it would be best to move the file portion of the server to SharePoint / OneDrive to increase their mobility and flexibility. We also determined that it would be best to move them away from on premises Active Directory into Azure Active Directory / Intune to allow authentication and security policies. Finally we began testing the on-premises software hosted on a server in Azure with a VPN connection to their office.

The SharePoint / OneDrive and Azure Active Directory portions went through with little issues. The server, however, was not as we had hoped. The Azure VPN connection was expensive due to it always being on and no way of turning it off outside of business hours. The performance of the SQL database that the on-premises software used was basically unusable. The other option would be to create virtual desktops on Azure for this purpose but the cost and functionality was not what the customer was hoping for.

This has lead them back to searching for an online EMR software that will meet all their requirements. This will be tough because most companies are good at some things, but not all things and compromises usually have to be made. Our hope is that this story is a lesson to other companies. The cloud may sound like the newest and best way to work, but the costs and functionality are often worse than expected.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Automate Your Work, Free Yourself

Worked with a client lately to help them Automate a workflow, but you may be wondering what does that even mean. Let me explain. We all have tasks in our workday that are repetitive and consume little bite size pieces of our time. Depending on the steps needed to accomplish these tasks, they can be “delegated” to a computer process via scripting aka we automate them. In the case of the client we helped, they received emails from an eFax service which included attachments. These attachments had to be manually saved into a shared folder for the rest of the staff to access as needed. This process probably took about 30 to 60 seconds each, but multiply this by the 30+ faxes they received each day you have 15 to 30 minutes of wasted time each day (65-130 hours per year). This does not take into account the time taken to stop doing one thing, accomplish this task, and restart the original thing they were doing.

Automate to Freedom

What if we could automate this little task and keep them employee free to do other more important things? We did. They customer uses Office 365 which includes a service called Power Automate. We scripted this tool to look at incoming messages, find ones from the eFax vendor, strip out the attachment, and save it to a SharePoint folder. This can then be shared with other employees and even synced via OneDrive to their Desktops for viewing, etc. That is just the tip of the iceberg as there is so much more that can be done with this technology.

If your company wasting little bite size pieces of time in repetitive taks, then contact us for assistance.

Cost of Insuring Your “Digital” Employees

We were discussing the price customers paid for their monthly maintenance of computers and the comparison was brought up about insurance costs. As a business owner with employees, it is necessary these days to offer health insurance as part of their compensation package. If the company has vehicles that are used for business, then the government mandates that they be covered by minimum amounts of insurance. These costs are then built into the price the business owner then charges their clients for products or services.

Insurance Statistics:

According to Business.com, the average cost of health insurance for a single employee was $645 per month and $1,850 per month for a family.
According to NerdWallet.com, the average cost of car insurance was $179 per vehicle per month.

Questions:

So what about the “digital” employees of the company, aka the computers and network equipment that make business possible. How much are business owners paying to “insure” these assets? What are businesses willing to pay to make sure that their computers and network don’t have a sick day? Does the cost of insuring them include preventative care? Who does the business call in case of an accident or breakdown in the middle of the day? Does the cost of insuring include on-site service or transport to a service center?

If your company wants to keep their digital employees healthy and insure them from accidents, then contact us for assistance.

Recover a Stuck Windows Service

Recently had an issue with a backup software that would get stuck in START_PENDING status at every startup. This caused it to be unable to be uninstalled, repaired, or forcefully removed and re-installed. Here is how we fixed it:

1. Find out the Service Name of the service by looking for it in the Services control panel:

2. Open command prompt as administrator

3. To get the PID type in – sc queryex [Service Name]

4. To kill the errant process type in – taskkill /f /pid [PID]

5. To remove the process type in – sc delete [Service Name]

One I had removed the process I restarted the server just to make sure then re-installed the software.

If your company needs help troubleshooting software issues, then contact us for assistance.

Synology Active Backup Restore to Hyper-V

Prerequisites:

Make sure Hyper-V Host has CPUs than the combined total of CPUs for all servers being restored as these static until after the VMs are completely restored. If there is not enough CPU resources then the VMs will not boot.
Make sure Hyper-V Host has more than the combined total of RAM for all servers being restored as these settings are static until after the VMs are completely restored. If there is not enough memory then the VMs will not boot.
Create a SET NIC Team on the server (if you have multiple NICs)
- Open Powershell as administrator
- User the New-VMSwitch command to setup an external virtual switch to connect to for live connections
  - New-VMSwitch -name “SET team” -NetAdapterName “NIC1″,”NIC2” -AllowManagementOS $True
  - The AllowManagementOS is needed if you are using the same NIC team to access the VM host
Setup secondary Internal vSwitch to allow for testing before deploying
Setup Synology LUN targets for each VM to be restored. Make sure that they are big enough to hold all the full uncompressed size of the entire thick provisioned hard drives for the entire server.
Connect each LUN to the iSCSI Initiator on the VM Host. Make sure to bring them online, initialize them, and give them a drive letter. Synology needs this because it uses the SMB protocol to transfer the files during restore.
Make sure to allow the File and Printer Sharing app through the Windows firewall and open port 5986 to allow HTTP traffic for WinRM to allow Synology to query the Hyper-V settings.
Add the Hyper-V Host to the Active Backup for Business app.

Synology Active Backup Restore to Hyper-V

Open the Active Backup for Business app
Click on the Physical Server tab on the left
Select the server and click the Restore button
Select the point in time to restore from
Choose Restore to Microsoft Hyper-V
Choose Full Virtual Machine Restore
Change the Restore Name
Select a folder on the Hyper-V Host to place the configuration files
Select a folder on the Hyper-V Host to place each of the restore VHD files
Select a Virtual Switch on the Hyper-V Host to connect the VM to
Confirm the settings by clicking on the Done button.

After:

The VMs will boot with a single NIC and no network settings. Keep them offline and add additional NICs as needed to match the original setup. Then configure the NICs as before upon reboot. Make sure to connect to Internal Test Switch for initial steps.
Check hardware configuration of CPUs and RAM to determine if adjustments can be made. In particular, the RAM settings can be changed to startup, minimum, and maximum to allow for distribution of resources to VMs that have heavier workloads.
Boot VM to make sure it is functioning correctly. (first bootup can take upwards of 15 minutes)
Convert the VM from Gen1 to Gen2
- Download Windows 10 ISO – https://www.microsoft.com/en-us/software-download/windows10
- Add Windows ISO to IDE controller as CD
- Set boot to CD in VM Settings
- Boot VM to repair section of CD
- Boot to command prompt
  - diskpart
  - list disk (Make boot disk is in 0 spot)
  - exit
  - X:\>mbr2gpt /validate /disk:0 (select proper disk)
  - X:\>mbr2gpt /convert /disk:0
- Create new VM with Gen2 setting
  - Give the VM a name and Store in appropriate iSCSI LUN drive then Click Next
  - Select Gen 2 and click Next
  - Give the VM as much startup memory as needed and Use Dynamic Memory then Click Next
  - Select the Internal Test Switch and click Next
  - Select an existing hard drive and point to boot drive that was converted to Gen 2 then click Next
  - Click Finish to create
  - Modify to match old VM
    - Check Dynamic RAM settings to make sure the Max / Min is set properly
    - Check Hard drives and add additional as needed
    - Turn off Secure Boot function
Boot new Gen 2 VM and configure static IP address.
If booting successfully then delete Gen 1 VM
Turn of old server as needed
Change Gen 2 VM to use SET Team vSwitch
Test connectivity to network resources.

If your company is looking to migrate from physical to virtual servers, then contact us to make the transition easy.

RMM Automation: Export List of AD Users Last Login Days Ago

As our business continues to grow our focus is on providing white labeled Tier 3 IT support services, RMM as a service, and co-managed IT services. This blog will be highlighting tips for using Powershell to get an Export List of AD Users Last Login was more than 90 Days Ago.

Research

You need to find out what the Organizational Unit (OU) path that you are trying to get the count from. The following command will list all OUs in the domain.

Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Format-Table Name, DistinguishedName -A

If you want the entire organization then you will need the top level information which looks like DC=[DomainName],DC=local

Variables

$SearchOU = This is the full DistinguishedName from the above output.

Script Snippet

$InactiveDays = 90
$Days = (Get-Date).Adddays(-($InactiveDays))
  

Get-ADUser -Filter {LastLogonTimeStamp -lt $Days -and enabled -eq $true} -SearchBase $SearchOU -Properties LastLogonTimeStamp,UserPrincipalName |
  
select-object Name,mail,@{Name="Last Login Date"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('MM-dd-yyyy')}} | export-csv C:\support\inactive_Users.csv -notypeinformation

The script will take several seconds to run based on the number of users in the OU being searched. The output is saved to the local c:\support directory and you can modify this script to include the FTP upload based on our previous article – https://www.farmhousenetworking.com/rmm/automation/rmm-automation-export-log-files-to-ftp/ The script can also be easily modified to change the number of days since last login.

If your company is a MSP or wants to become one and automation just seems out of reach, then contact us to run your RMM for you.

RMM Automation: Active Directory User Count

Research

You need to find out what the Organizational Unit (OU) path that you are trying to get the count from. The following command will list all OUs in the domain.

Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Format-Table Name, DistinguishedName -A

If you want the entire organization then you will need the top level information which looks like DC=[DomainName],DC=local

Variables

$SearchOU = This is the full DistinguishedName from the above output.

Script Snippet

(Get-ADUser -Filter * -SearchBase $SearchOU).count

The script will take several seconds to run based on the number of users in the OU being searched. The output is an integer number. You can do the same sort of thing for an Active Directory Group Count or Active Directory Computer Count:

(Get-ADgroup -Filter * -SearchBase $SearchOU).count

or

(Get-ADcomputer -Filter * -SearchBase $SearchOU).count

If your company is a MSP or wants to become one and automation just seems out of reach, then contact us to run your RMM for you.

Zero Trust – Cyber Security Audit

This is the tenth and finale in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on Cyber Security Audit.

Cyber Security Audit

Cyber Security Audit is a process where both internal and external systems are tested for their ability and susceptibility to being successfully attacked by hackers. This usually involves an inventory of current systems, research into known vulnerabilities, and testing of those found to see what information can be accessed. Once this process is complete a report is generated to detail both what is found and how those vulnerabilities can be addressed to protect the business’ most valuable commodity – information (intellectual property and client data). Here are some questions to ask:

Do you have an inventory of all assets in your organization? Is it up to date?
Have you tested your internal network for vulnerabilities?
Have you had a penetration test performed on your external network?
Do you know what compliance standards apply?
How do you document policies and procedures? Who oversees that?

If your company is wanting to have a free cyber security audit, then contact us for assistance.

Setup Azure to Araknis IPSec VPN

Had a local medial office want to move their current server into the cloud and because they are already an Office 365 customer, I chose to use Azure for their Virtual Machine. I helped them setup Azure to Araknis IPSec VPN to connect their headquarters to the hosted server. This tutorial will go into detail about the creation of this tunnel starting with the Microsoft Azure side first using Resource Manager. It will be using the following parameters:

VNet Name: TestNetwork
Address Space: 10.10.0.0/16
Subnets:
- Primary: 10.10.10.0/24
- GatewaySubnet: 10.10.0.0/24
Resource Group: TestResourceGroup
Location: West US
DNS Server: Azure Default
Gateway Name: TestVPNGateway
Public IP: TestVPNGatewayIP
VPN Type: Route-based
Connection Type: Site-to-site (IPsec)
Gateway Type: VPN
Local Network Gateway Name: TestSite
Local Subnet: 10.20.20.0/24
Connection Name: VPNtoTestSite

Configure an Azure VPN gateway

This part takes the longest, so it should be done first:

Click on the “+” icon at the top left hand side of the Resource Manager, then search for “Virtual Network Gateway” and click on the “Create” button.
Give the Virtual Network Gateway a name
Select matching Region to where Azure resources are located
Leave Gateway & VPN type the defaults
Choose a SKU <- These have changed since the article was created, so my “standard” now is WpnGw1 with Active / Active turned off (this is a good balance of performance and cost)
Choose or create a local network (not covered here, but must contain Gateway Subnet) that matches internal resources
Choose or create a Public IP Address
Leave the remaining values as their defaults and then click the “Create” button. (Please note the reminder that this takes 45 minutes to create!)

Configure an Azure Local Network Gateway

This is a reference to your on-premise network so that subnets can pass traffic:

Click on the “+” icon at the top left hand side of the Resource Manager, then search for “Local Network Gateway” and click on the “Create” button.
Give the Local Network Gateway a name
Select matching Region to where Azure resources are located
Specify the external IP address of the local on-premise site
Specify the on-premise address space (subnet)
Leave the remaining values as their defaults and then click the “Create” button.

Configure an Azure VPN Connection

This will create the tunnel from Azure to the on-premise site:

Click on the “+” icon at the top left hand side of the Resource Manager, then search for “Connection” and click on the “Create” button.
Choose “Site-to-site (IPSec)” as the connection type
Give the Connection a name
Select matching Region to where Azure resources are located
Leave the remaining values as their defaults and then click the “OK” button. On the summary screen click on the “OK” button to create the connection.
Choose the newly created Virtual Network Gateway
Choose the newly created Local Network Gateway
Specify a shared key
Leave the remaining values as their defaults and click the “Create” button.

This completes the setup of the Azure side of the VPN tunnel. Now to work on the Ubiquiti USG side.

Configuring an Araknis IPSec VPN Network

Connect to Araknis router (need at least a 310 for this to work)
Click on Advanced > VPN
Scroll down to IPSec and click add new tunnel
Fill in the Remote IP address of the Azure VPN Gateway
Fill in the Remote Subnet Mask
Make the following changes to IPSec Setup

That is all there is to it. If your company is currently using either Microsoft Azure or Araknis routers and would like a VPN created, then contact us for assistance.

Zero Trust – Network Security

This is the ninth in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on Network Security.

Network Security

Network Security is having the proper hardware and configuration of that hardware in place to protect the business network. This configuration includes segmenting network traffic to keep specific types of traffic, like guest devices, separate from traffic of business devices. It also includes keeping outsiders out of the network and detecting when they have breached security measures. Here are some questions to ask:

Do you have a business class router / firewall?
Do you have business class switches and access points that support segmentation?
Is your network configured to segment business traffic from guest traffic?
Are devices like VoIP phones and network cameras on their own network?
Is geo-location blocking turned on for non-essential countries?
Is network traffic being analyzed for suspicious activity?
Do you filter internet traffic?
Can your network detect and respond to a breach?

If your company is wanting to lock down network security, then contact us for assistance.

Category: Co-Managed IT

A Medical Office’s Journey to the Cloud

Automate Your Work, Free Yourself

Automate to Freedom

Cost of Insuring Your “Digital” Employees

Insurance Statistics:

Questions:

Recover a Stuck Windows Service

Synology Active Backup Restore to Hyper-V

Prerequisites:

Synology Active Backup Restore to Hyper-V

After:

RMM Automation: Export List of AD Users Last Login Days Ago

Research

Variables

Script Snippet

RMM Automation: Active Directory User Count

Research

Variables

Script Snippet

Zero Trust – Cyber Security Audit

Cyber Security Audit

Setup Azure to Araknis IPSec VPN

Configure an Azure VPN gateway

Configure an Azure Local Network Gateway

Configure an Azure VPN Connection

Configuring an Araknis IPSec VPN Network

Zero Trust – Network Security

Network Security

Recent Posts

Archives

Categories

Category: Co-Managed IT

Automate to Freedom

Insurance Statistics:

Questions:

Prerequisites:

Synology Active Backup Restore to Hyper-V

After:

Research

Variables

Script Snippet

Research

Variables

Script Snippet

Cyber Security Audit

Configure an Azure VPN gateway

Configure an Azure Local Network Gateway

Configure an Azure VPN Connection

Configuring an Araknis IPSec VPN Network

Network Security

Recent Posts

Archives

Categories

Evaluation Signup