Loading ...

Category: Active Directory

Using SSO Single Sign-On for Enhanced Security and Convenience

Individuals and organizations rely heavily on various online platforms and services, the need for a secure and convenient way to access these resources is paramount. This is where SSO Single Sign-On comes into play. SSO Single Sign-On is a powerful authentication method that allows users to securely sign in to multiple applications and platforms using just one set of credentials. In this article, we will explore the benefits of SSO Single Sign-On, its implementation, and how it enhances security while streamlining the user experience.


Understanding SSO Single Sign-On

What is SSO Single Sign-On?  SSO Single Sign-On is an authentication process that enables users to access multiple applications and platforms using a single set of login credentials. With SSO Single Sign-On, users only need to remember one username and password, eliminating the hassle of managing multiple credentials for different services. This not only saves time but also enhances convenience for users.

How does SSO Single Sign-On work? SSO Single Sign-On works by establishing a trust relationship between an identity provider (IdP) and the various service providers (SPs). When a user attempts to access a service, the IdP verifies the user’s identity and provides a token to the SP, which grants the user access without requiring additional authentication. This seamless process simplifies the login experience and eliminates the need for users to repeatedly enter their credentials.

Benefits of SSO Single Sign-On

Enhanced Security: One of the key advantages of SSO Single Sign-On is its ability to enhance security. By consolidating login credentials into a single set, users are less likely to resort to weak passwords or reuse passwords across multiple platforms. This reduces the risk of password-related security breaches. Additionally, SSO Single Sign-On allows for stronger authentication methods, such as two-factor authentication, further bolstering security without requiring multiple accounts.

Streamlined User Experience: With SSO Single Sign-On, users no longer have to remember and enter multiple sets of login credentials. This significantly reduces the login friction and streamlines the user experience. Users can seamlessly navigate between different applications and platforms without the need for repetitive logins. This convenience not only saves time but also improves productivity.

Centralized Access Management: SSO Single Sign-On provides organizations with centralized access management capabilities. Administrators can easily control user access to various applications and platforms from a centralized dashboard. This simplifies user provisioning and deprovisioning, ensuring that employees have timely access to the resources they need while maintaining security and compliance.

Cost and Time Savings: Implementing SSO Single Sign-On can lead to cost and time savings for organizations. By reducing the number of password-related support requests, IT teams can focus on more strategic initiatives. Additionally, the streamlined login experience reduces the time spent by employees on authentication, leading to increased productivity and efficiency.

Implementing SSO Single Sign-On

To implement SSO Single Sign-On, organizations need to follow a few key steps:

  1. Evaluate SSO Solutions: Begin by evaluating various SSO solutions available in the market. Consider factors such as compatibility with existing systems, scalability, security features, and ease of integration.
  2. Choose an Identity Provider: Select an identity provider that aligns with your organization’s requirements. The identity provider will be responsible for authenticating users and issuing tokens for accessing service providers. Office 365 and Google Workspace are usually the best, most prolific IdP sources to use. 
  3. Configure Service Providers: Configure the service providers that you want to integrate with SSO Single Sign-On. This involves establishing trust relationships between the identity provider and the service providers.
  4. User Provisioning and Deprovisioning: Implement a user provisioning and deprovisioning process to ensure that users have the necessary access to the applications and platforms they require. This process should be integrated with the SSO Single Sign-On solution to maintain centralized access management.
  5. Test and Monitor: Thoroughly test the SSO Single Sign-On implementation to ensure its functionality and security. Regularly monitor the system to identify and address any potential issues or vulnerabilities.

Best Practices for SSO Single Sign-On Implementation

When implementing SSO Single Sign-On, it is essential to follow best practices to maximize security and usability:

  • Strong Authentication: Implement strong authentication methods such as two-factor authentication or biometric authentication to enhance security.
  • Regular Auditing: Conduct regular audits of user access rights and permissions to ensure compliance and detect any unauthorized access.
  • User Education: Educate users about the benefits of SSO Single Sign-On and best practices for password management to promote secure behavior.
  • Continuous Monitoring: Implement a robust monitoring system to detect and respond to any suspicious activities or potential security threats.
  • Regular Updates: Keep the SSO Single Sign-On solution and all integrated applications up to date with the latest security patches and updates.

Remember, security should never be compromised, and SSO Single Sign-On provides a robust solution to protect user identities and streamline access to applications and platforms. Embrace the power of SSO Single Sign-On and enjoy the benefits of enhanced security and convenience.

A Medical Office’s Journey to the Cloud

Today we tell the story of a medical office’s journey to the cloud. This particular client was facing their server operating system reaching end of support (a HIPAA violation) in the near future. They had begun by looking at their electronic medical records software company’s online offering, which didn’t have all the functionality of their on-premises software and was very expensive (this is typical).


They next decided to look into moving their current on-premises software into the cloud and we were asked to help with the testing. We determined that it would be best to move the file portion of the server to SharePoint / OneDrive to increase their mobility and flexibility. We also determined that it would be best to move them away from on premises Active Directory into Azure Active Directory / Intune to allow authentication and security policies. Finally we began testing the on-premises software hosted on a server in Azure with a VPN connection to their office.


The SharePoint / OneDrive and Azure Active Directory portions went through with little issues. The server, however, was not as we had hoped. The Azure VPN connection was expensive due to it always being on and no way of turning it off outside of business hours. The performance of the SQL database that the on-premises software used was basically unusable. The other option would be to create virtual desktops on Azure for this purpose but the cost and functionality was not what the customer was hoping for.


This has lead them back to searching for an online EMR software that will meet all their requirements. This will be tough because most companies are good at some things, but not all things and compromises usually have to be made. Our hope is that this story is a lesson to other companies. The cloud may sound like the newest and best way to work, but the costs and functionality are often worse than expected.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

RMM Automation: Export List of AD Users Last Login Days Ago

As our business continues to grow our focus is on providing white labeled Tier 3 IT support services, RMM as a service, and co-managed IT services. This blog will be highlighting tips for using Powershell to get an Export List of AD Users Last Login was more than 90 Days Ago.

Research

You need to find out what the Organizational Unit (OU) path that you are trying to get the count from. The following command will list all OUs in the domain.

Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Format-Table Name, DistinguishedName -A

If you want the entire organization then you will need the top level information which looks like DC=[DomainName],DC=local

Variables

$SearchOU = This is the full DistinguishedName from the above output.

Script Snippet

$InactiveDays = 90
$Days = (Get-Date).Adddays(-($InactiveDays))
  

Get-ADUser -Filter {LastLogonTimeStamp -lt $Days -and enabled -eq $true} -SearchBase $SearchOU -Properties LastLogonTimeStamp,UserPrincipalName |
  
select-object Name,mail,@{Name="Last Login Date"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('MM-dd-yyyy')}} | export-csv C:\support\inactive_Users.csv -notypeinformation

The script will take several seconds to run based on the number of users in the OU being searched. The output is saved to the local c:\support directory and you can modify this script to include the FTP upload based on our previous article – https://www.farmhousenetworking.com/rmm/automation/rmm-automation-export-log-files-to-ftp/ The script can also be easily modified to change the number of days since last login.

If your company is a MSP or wants to become one and automation just seems out of reach, then contact us to run your RMM for you.

RMM Automation: Active Directory User Count

As our business continues to grow our focus is on providing white labeled Tier 3 IT support services, RMM as a service, and co-managed IT services. This blog will be highlighting tips for using Powershell to get an Active Directory User Count.

Research

You need to find out what the Organizational Unit (OU) path that you are trying to get the count from. The following command will list all OUs in the domain. 

Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Format-Table Name, DistinguishedName -A

If you want the entire organization then you will need the top level information which looks like DC=[DomainName],DC=local

Variables


$SearchOU = This is the full DistinguishedName from the above output.

Script Snippet

(Get-ADUser -Filter * -SearchBase $SearchOU).count

The script will take several seconds to run based on the number of users in the OU being searched. The output is an integer number. You can do the same sort of thing for an Active Directory Group Count or Active Directory Computer Count:

(Get-ADgroup -Filter * -SearchBase $SearchOU).count

or

(Get-ADcomputer -Filter * -SearchBase $SearchOU).count

If your company is a MSP or wants to become one and automation just seems out of reach, then contact us to run your RMM for you.

Your roaming profile was not completely synchronized error on Windows 10

Had a client receive the message “There was a problem with your roaming profile…” after logging into another computer on the domain. Research and found that a simple registry fix was available, but most fixes wanted admins to export a key from another working profile then import it into the broken one. Here is the actual registry key that was used to fix the profile:

Registry Fix for roaming profile was not completely synchronized

  1. Open Registry Editor as the broken user and NOT administrator
  2. Navigate to HKCU > SOFTWARE > Microsoft > Windows NT > CurrentVersion > Winlogon
  3. Right click and choose New > String Value and give it the name ExcludeProfileDirs
  4. Enter the following – AppData\Local;AppData\LocalLow;$Recycle.Bin;OneDrive;Work Folders
  5. Logout and back in to test.

FBI Cyber Defense Best Practices

A recent briefing from the FBI’s Internet Internet Crime Complaint Center (IC3) detailed current best practices and industry standards for cyber defense. Here is a summation:

Cyber Defense Best Practices

  • Backups – Regularly back up data and verify its integrity. Backups are critical in ransomware; if you are infected, backups may be the only way to recover your critical data.
  • Training – Employees should be made aware of the threat of ransomware, how it is delivered, and trained on information security principles and techniques.
  • Patching – All endpoints should be patched as vulnerabilities are discovered. This can be made easier through a centralized patch management system.
  • Antivirus – Ensure anti-virus and anti-malware solutions are set to automatically update and that regular scans are conducted. Centrally managed is even better.
  • File Permissions – If a user only needs to read specific files, they should not have write-access to those files, directories, or shares. Configure access controls with least privilege in mind.
  • Macros – Disable macro scripts from Office files transmitted via email.
  • Program Execution Restrictions – Implement software restriction policies or other controls to prevent the execution of programs in common ransomware locations, such as temporary folders supporting popular internet browsers, and compression/decompression programs.
  • Remote Desktop Protocol – Employ best practices for use of RDP, including use of VPN, auditing your network for systems using RDP, closing unused RDP ports, applying two-factor authentication wherever possible, and logging RDP login attempts.
  • Software Whitelisting – Implement application whitelisting. Only allow systems to execute programs known and permitted by security policy. This one takes careful planning.
  • Virtualization – Use virtualized environments to execute operating system environments or specific programs. No physical access to servers makes hacking harder.
  • Network Segmentation – Implement physical and logical separation of networks and data for different organizational units. Keep guest traffic out of your business network.
  • No Saved Passwords – Require users to type information or enter a password when their system communicates with a website. Better yet use a password management tool.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Synology Active Directory Server

Recently provided some assistance to a local IT company that exclusively uses Synology devices instead of servers for their clients. They approached us to create Group Policy objects based on this new feature of the Synology. The Synology Active Directory Server app is based on the Samba 4 Protocol, here are some details of available features:

  • Support for Windows RSAT
  • Support for TLS domain controller certification
  • Support for custom NetBIOS domain names
  • DNS auto registration
  • Support for single domain controllers

Account & Privileges

  • Group membership and policies
  • Roaming user profiles
  • Account single sign-on
  • Home folder support

Security & Access Control

  • Kerberos-based authentication
  • Password reset via email
  • Password strength policies
  • Account lockout policies

Domain Clients

  • Microsoft Windows 7 and above
  • Linux

Take Aways

Here are some basic take-aways from our experience creating these Group Policy Objects (GPO) on the Synology Active Directory Server.

  1. Need to install Remote Server Administration Tools (RSAT) on the most up-to-date desktop or server OS version in the organization to allow for best compatibility with all earlier OSs when creating GPOs
  2. Need to modify Synology Active Directory Server control panel Domain Options to allow Domain Admins to have admin access – without this you will get Access Denied every time a GPO is attempted to be added
  3. Windows Servers, Active Directory and domains are not dead, they are just becoming a “Container” which makes them much cheaper for small businesses to adopt.

If your company is utilizing a Synology Network Attached Storage device and would like the functionality of an Active Directory domain, then contact us for assistance.

Oregon Cyber Task Force – Cyber Attack Mitigation

During a recent briefing from the FBI’s Oregon Cyber Task Force in Medford, OR they detailed best practices and industry standards for cyber attack mitigation. FBI special agents started with information and statistics about the most recent threats giving specifics of how the attacks were executed. Security Architect from the State of Oregon then outlined the specifics of how to mitigate these threats properly. Here is a summation:

Current Threat Landscape

Business Email Compromise (CEO Fraud): Involves cyber criminals posing as business executives at companies that regularly perform wire transfers. After compromising the executive’s email, the criminal requests employees to perform wire transfers to the criminal’s bank account. FBI Internet Crime Complaint Center (IC3) has reported over $3 billion of losses worldwide due to this threat.

Ransomware: Ransomware is a form of malware that targets weaknesses in networks to deny the availability of critical data by encrypting it and demanding a ransom for the encryption keys to decrypt the data. Ransomware is frequently delivered through spear phishing emails to end users.

Point of Sale (PoS) Malware: Cyber criminal steals payment card data by remotely infecting PoS systems with malware without the need to physically access the cards or the devices used to process them. This allows criminals to compromise PoS systems on a large scale with larger victim base.

Insider Threat: An insider is a current or former employee who has access to an organization’s network and intentionally misuses that access to negatively affect the company. IC3 has recorded business losses from insider threat to be between $5,000 to $3 million.

Internet Extortion: Victims are threatened by cyber criminal with Distributed Denial of Service (DDoS) attack that will make access to their e-commerce site severely degraded or impossible if they victim does not pay to appease them. These can be real or fake with price tags in the neighborhood of 50 bitcoin or about $30,000.

Cyber Attack Mitigation

Here is a list of items that will need to be addressed to comprise a complete mitigation plan:

  • Create company policy in regards to how wire transfers are handled that require verbal or in-person authorization from multiple company executives
  • Create company policy restricting details that can be shared  about job duties and company hierarchy on social media
  • Review National Institute of Standards and Technology (NIST) Cybersecurity Framework and  adopt risk management processes
  • Create, implement and keep up-to-date an incident response plan
  • Create company policy and implement lawful network monitoring
  • Have proactive relationships with law enforcement agencies – silence is letting cyber criminals win

Practical Security Best Practices

  • Network Segmentation – keep the guest wireless separate from the local network, keep payment processing in its own network and keep web servers in the Demilitarized Zone (DMZ) of the network.
  • Use firewall access rules, Active Directory Group Policy and physical security measures to limit unsecure access to every segment of your network.
  • Restrict usage of administrator level access by creating alternative accounts for these purposes that are not used for local login. Keep these accounts monitored.
  • Implement automated patching and managed virus scanning on all systems. Remove any unsupported / non-updateable software or sytems on the network.
  • Restrict remote access to the network to specific users and use only secure protocols like RDP through VPN
  • Conduct periodic testing of all security measures to identify weakness or failing procedures and adjust systems accordingly

Advanced Mitigation Processes

  • Use multi-factor authentication wherever possible
  • Establish baseline of applications used then implement application whitelisting
  • Standardize encryption for data both at-rest and in-transit
  • Conduct perimeter filtering via Intrusion Detection System (IDS)
  • Regularly backup system logs in a segregated portion of the network to prevent tampering

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

ADPREP Windows 2008 R2 Server into 2003 Domain

After finishing the migration of a client to their new cloud-based Line of Business SaaS application, it was time to finally get rid of the last Windows 2003 Small Business Server that we manage. The client had a Windows Server 2008 R2 Standard server that used to be the database server for the on-premise application which was being re-purposed as the new Primary Domain Controller (PDC) for the domain. After installing the Active Directory Domain Services (ADDS) role on the new server, I went to run DCPROMO on the new server and found that it asked me to run ADPREP /FORESTPREP on the domain. Took me a little bit of searching to find the Windows 2003 Server media and ran the command successfully, but this did not do the trick – turns out I needed the Windows 2008 R2 Server media and run the ADPREP32 command several times to complete the domain preparation for the new server to be DCPROMO successfully. Extracted the support directory from the media ISO to a folder on the root of the old Windows 2003 Small Business Server and then ran the following commands in order:

ADPREP32 /FORESTPREP

This one took a long time as the server was going from Schema 31 to Schema 47.

ADPREP32 /DOMAINPREP

This one stated that I needed to run the next command, so I did.

ADPREP32 /DOMAINPREP /GPPREP

The command actually stated that the update was already applied. So went back to the Windows 2008 R2 Standard server and ran DCPROMO again which told me that I needed to run one more command.

ADPREP32 /RODCPREP

Ran this one even though I had no plans of having a Read-Only Domain Controller (RODC) in the domain. After all these commands the new server was able to be DCPROMO into the domain controller role. Now all that is left is FSMO roles, DNS, DHCP, printers and file shares.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2024- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Error: Contact form not found.

And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10