Work Archives - Everybody Staze...

PrintNightmare is just the worst…

2026/04/24 By staze Leave a Comment

Just thought I’d throw this up there. Turns out, MS made some interesting choices closing the PrintNightmare (CVE-2021-34527, CVE-2021-1675) hole. We found one of those interesting choices earlier this week when a print server was just slammed at 100% CPU all day. For those that don’t know, I work in higher ed. And much to our dismay, we have a lot of print servers (currently over 20, when it should be like, 3?). Since PrintNightmare, you have to have a list of allowed print servers that computers are allowed to use. Great. So, we have a GPO that does this. What happens is computer is told to map a printer, and if the print server is on the list, it’s mapped, and if it isn’t, it isn’t. Simple, yea? Well here’s the rub: it checks the list AFTER it connects to the print server. Some may see where this is going…

Long ago, we realized GPOs to map printers are inconsistent. Especially on lab machines with lots of turnover. So, we moved to using a login script to do the work. So user logs in, script runs to map printer, if it can’t map the printer, it tries again (just to account for network issues, server outage, etc). This week, that resulted in a DDoS of the print server because someone changed the GPO to not include the print server in the GPO allowed list… and because MS made an odd choice.

Best I can tell, here’s what happens

Computer gets told to map printer on print server
Computer connects to print server to check for printer
Computer checks approved list of print servers and either maps printer, or rejects

So, if you ask me, steps 2 and 3 are wrong. They should be reversed and the computer should check the approved list before it auths to the print server. In our case, with 800+ computers all hitting the print server over and over again, lsass VERY quickly was overwhelmed with auth requests and the print server would start alerting about CPU/memory.

Maybe I’m daft and MS had a reason for doing it this way, but damn does it just seem backward to me.

Employee Scheduling Software

2011/03/28 By staze

At a meeting this last week, a coworker expressed frustration over how labor intensive it is to schedule student employees. You have to ask them to give you a printout of their class schedule, and then manually wade through them all to figure out who can fill what shifts. Then create a “pretty” Excel document that shows the schedule for everyone.

So, during that meeting while everyone was talking about something else, I started looking around for a good solution to this issue. The first thing I came across was Employee Scheduler. Which after setting up and testing, seems pretty cool. Biggest things would be:
Pros:

LDAP access (though, doesn’t handle multiple LDAP uid’s correctly)
Allows students to set preferences (say, they CAN work at 8am, but it’s not preferred).
Self Hosted (php/mysql (AMP))
Designed for scheduling student employees

Cons:

Code hasn’t been touched since 2004
No Timeclock functionality

The second one I came across, that I didn’t bother installing, was Employee Scheduling System (ESS). I attempted to install this, but got errors on the .sql import that I didn’t really want to pursue due to, like the above: the code hasn’t been touched since 2005.

[Read more…]

Food in the labs

2011/03/19 By staze

At work we have 6 computers labs that each consist of 17 or so computers, in a lab type setting. These computers are used for stuff like Final Cut Pro, Photoshop, Indesign, and lots of other random stuff. These labs are shared between several classes, and lots of students. Each computer probably averages 5-10 unique users per day. As such, keeping the computers in decent shape, and “clean” is a bit of a priority. So, like pretty much every non-private computer space I’ve ever used, food/drink are allowed. These rules are, unfortunately, too often ignored. I wouldn’t say it’s the majority (it’s not), but it’s a number larger than zero, which is the problem ((This post is being made in reaction to me having to kick someone out of a lab for eating pizza at a desk that didn’t have a computer on it. While the students were in the lab when I sent out a warning to someone else who was drinking soda, these students did not actually receive the warning from me. Me kicking them out resulted in one of the students losing work, which I felt bad about, but regardless all doors into the lab spaces have signs clearly indicating that food/drink are not allowed. So while I feel bad about the loss of work, I do not feel bad about having to kick them out. And hopefully, they’ll never re-offend.)).

[Read more…]