7 ms·
Can't you just redirect all that stuff it sends to 127.0.0.1 by editing your hosts file?
by Kenji 11y ago
Can't you just redirect all that stuff it sends to 127.0.0.1 by editing your hosts file?
- blackbeard 11y agoYou can, but we have 450 workstations and about 600 servers. That somewhat multiplies the problems.
- pc86 11y ago> somewhat Yes I can see how that would complicate things a little :)
- EvanAnderson 11y agoIf they're using DNS to resolve the name of the "mothership" just put a bogus record (or zone) in your DNS. If they're not using any name resolution protocol and you can isolate the IP addresses they're talking to just blackhole them at your border.
- blackbeard 11y agoWe're already doing that but it's hard work keeping up with it all.
- a3n 11y agoAnd then Microsoft will fix that, ...
- EvanAnderson 11y agoDefault deny is the only viable strategy. (It's also completely impractical...)
- drdaeman 11y ago1000+ machines and no way to update a file with a few commands/clicks/whatever-your-configuration-management-system-uses? (Ok, at worst, making a batch file and scheduling its launch.) If so, I suppose you have big issues with your system administration team.
- blackbeard 11y agoYes they're factory pressed Windows administrators who are to be honest fucking useless unless it comes to pointing at someone else but that's another story...they're being replaced piecemeal by bits of Ansible and Linux machines. Realistically we don't want to deploy a host file and AFAIK it doesn't work anyway; we want to control the network itself which we do via firewalls and DNS but it's a compromise between flexibility (our users still need to use the internet) and security.
- zippzom 11y agoI've read somewhere that it ignores the hosts file for its microsoft communication.
- Bjartr 11y agoI've read somewhere it respects the hosts file for its microsoft communication.
- imglorp 11y agoWhat do you do about getting updates? You have to connect to hq sometime, and when you do, it will upload its intel.