Mark R. Gamache's Random Blog
Here's random stuff related to what I am working on or interested in during my work day or in my personal life. I'm a nerd. The content will be nerdy.
Wednesday, March 28, 2018
If I Can't Reach Active Directory, it's Down
I recently had a customer tell me that my AD servers were broken. They were unable to set SPNs via Setspn.
They were able to run AD queries and were able to do other "AD Stuff". As always, I demanded a packet capture.
In very short order, the issue was clear. Setspn, for reasons I cannot guess, uses RPCs to the domain controller to set SPNs. I have not clue why it doesn't just use LDAP. LDAP is better, it only requires one port, that we know will be open.
RPCs are a pain, they require TCP 135, the end point mapper, then some random high port, named at the time of connection.
Below, we see that the customer hit the EPM in Frame 873 and was assigned a new connection on port 1028. We the SYN to 1028 in 874, then retries in 966 and 1146.
Firewalls and windows RPCs don't mix. Click here for larger.
RPC OPEN ALL THE PORTS!!
Living off the land with Kerberos and netsh interface portproxy

Enjoy!
Monday, August 28, 2017
Keep an Eye on Your Index Fund Dollars. You May be Surprised.
There has been a lot of talk about index funds in the last six months.
Warren Buffett recently said he recommends you, and his wife, don’t pick your own stocks, but simply “buy an S&P 500 low-cost index fund”.
I recently heard on the news that at least 60% of the money in the market is in index funds.
Some Wall Street types are referring to Index fund investors as “dumb money” and worrying that no one is looking a company stats any more.
I am not going to talk about these things. They are for more nuanced investors. I am just a fairly smart guy who is a bit risk averse and likes things that make some sense.
We know we should not pick our own stocks unless we really understand the business sector that a company is in and the performance metrics of the business. Very savvy investors even look at management teams and may even compare them to the management teams of rival companies. Most of us to not have time to do that for more than a company or two. We can’t even look at one whole market sector, let alone the whole market. It really does make sense from this perspective to look at index funds, but wait…
We are also told to diversify our portfolios. All the more reason to use an index fund. Only…
We are also told to not put all our eggs in one basket. We should have a good speared of U.S. and foreign stocks, we should have a lot of different business sectors. There are international index funds, so we are covered there too.
BUT WAIT
You and I probably thought that if we bought an S&P 500 Index fund that we’d be getting a good mix of the S&P 500. WRONG!! All your eggs are in one basket! If we look at just the top 25 holdings, 12.5% of your portfolio in in Tech stocks! That’s right, the index is weighted, usually by market cap or some sort of adjusted market cap. If you go down the list, the top is dominated by Tech, finance, pharmaceuticals, and finance
Breaking down your ownership by sector in the top 50 of the S&P 500.
Sector |
% |
Aerospace |
0.64 |
Consumer Goods |
2.77 |
Finance |
6.13 |
Insurance |
0.87 |
Oil |
3.02 |
Pharma |
4.28 |
Retail |
0.56 |
Soda |
1.61 |
Technology |
16.4 |
Telecom |
2.96 |
Tobacco |
1.44 |
(blank) |
6.8 |
Total |
47.48 |
That’s right, just under 50% of your investment in 500 companies is in only 50 companies, and a very unbalanced 16% is in the tech sector. If we look at the bottom 50 companies, you only have 1.4% in them.
As always, these are just things to consider. I have no useful money advice.
Friday, August 25, 2017
Detecting Attackers in a Windows Active Directory Network
The Pain
Enter BloodHound

Prior Detections
Detecting the Foothold
Looking at the Logs
Call to Arms
Sunday, August 20, 2017
Keep an Eye on Those Bond Investment Fees
While I talk about my Fidelity account, it is almost certain that this issue will be found with most brokerages.
If you use the Brokerage link option to manage your 401K investments, and if you have other Fidelity investment accounts, it is worth taking a look at your “core position”. Depending on the account type, your “un-invested” money is not in cash. When you sell a stock or bond, if you don’t re-invest, it sits in a core position.
If you aren’t leaving your money in the core for long, it doesn’t matter much. If you decide to use it to “pull some money out of the scary market”, this is probably a bad place for it to sit. Your core position is probably mostly bonds, so it may just be your default bond allocation.
If the position is a non-cash position, like in the Brokerage link account or the one you get with an ESPP, then the money is in a super low risk investment. The key here is that they are in a managed investment with fees! Everyone knows how to invest for low risk and low returns, so this should be free or near free. The fees are low for mutual and bond funds in general, but for some default positions, surprisingly high for the lack of value the fund manager has to deliver.
I find 3 possible core positions in my plans:
I don’t like to give investment advice, just things to ponder, but I will point out that there are many Vanguard funds with much lower expense ratios, like 0.07% . Many of these are in super low risk government bonds. Most consider those bonds less risky than cash due to inflation. All three above have about 70% of your money in cash, 25% in government bonds and 5% misc. As far as I can tell, you are paying a higher fee to have your money as cash.
Before you say, “All this is sub 1% stuff, so what”, take a look at the cost of a long term over pay. Take a look at a comparison.
FWIW, if you are using Index Funds for you Stock investments, the expense ratios should be crazy low as well. How hard is it to read the S&P 500 and buy a bunch for your investors???
As always, trust no one…
Monday, August 7, 2017
Copying the NTAuth Enterprise store certificates from one Forest to another
Below is a two liner to copy the NTAuth in one forest to another, assuming the NTAuth object exists and just needs to be populated.
$caLIst = (Get-ADObject -SearchBase "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain1,DC=com" -SearchScope Base -Filter * -Properties * -Server domain1.com).cACertificate
foreach($ca in $caLIst) {Set-ADObject "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain2,DC=com" -add @{cacertificate=$ca}}
Friday, March 24, 2017
I Just Saved $121!!
I have NO IDEA how GoodRX works, but I do know it saved me $121.11 on a single prescription. Usually, when you install an app that get's you something for free, you are the commodity. Most apps want all sorts of crazy access to your phone. GoodRX wanted pretty basic access and gave me s super coupon.
Drug cost was $221. My insurance only covered $48. I was going to pay $173. Enter the GoodRX coupon and I saved $121. I only paid $52!!!!