I recently assisted a customer with missing OU's in Active Directory. We found that the OU's were not deleted (thanks to the AD Recycle Bin), but were actually moved to another OU instead. These occurrences can easily be prevented by using a feature that was introduced with Active Directory on Windows Server 2008. Now this is nothing new, but since we are still finding occurrences of this at our customers, I decided to publish this post as a reminder to review all OU's in your Active Directory forest, and ensure they are protected from accidental deletion.
Author: Johan Heyneke
Senior Customer Engineer at Microsoft
Collect and export SMBv1 audit events using Azure Log Analytics
In this blog I will demonstrate how to collect the SMBv1 audit events in Azure Log Analytics. I will also show a simple query to extract the IP information from these events which can be exported to a CSV file if needed.
Microsoft Edge: Configure IE Mode (Part 2)
IE Mode on Microsoft Edge provides compatibility for legacy sites that require Internet Explorer 11. IE Mode enables users to access modern and legacy sites using a single browser. Users no longer need to switch between browsers to access legacy intranet sites. IE mode supports ActiveX controls such as Java and Silverlight, and it also supports Internet Explorer settings and group policies that affect Protected Mode and security zone settings. In this final post of the two-part series, I will create the Enterprise Site Mode List XML file and test the configured sites to confirm that the specified sites can be successfully opened in IE Mode on Microsoft Edge.
Roll over Kerberos decryption key for Seamless SSO computer account
Updating the Kerberos decryption key for the Azure AD SSO computer account is a fairly simple process. In this blog post I walk through the steps to perform an update of the Kerberos decryption key.
Microsoft Edge: Configure IE Mode (Part 1)
IE Mode on Microsoft Edge provides compatibility for legacy sites that require Internet Explorer 11. IE Mode enables users to access modern and legacy sites using a single browser. Users no longer need to switch between browsers to access legacy intranet sites. IE mode supports ActiveX controls such as Java and Silverlight, and it also supports Internet Explorer settings and group policies that affect Protected Mode and security zone settings. In part one of this two-part series, I will configure IE Mode using Group Policy and Microsoft Intune.
How to reset the Directory Service Restore Mode (DSRM) password
The Directory Services Restore Mode (DSRM) password is first set when promoting a new Domain Controller. I have encountered many Active Directory environments where the DSRM password for the Domain Controllers is not known or safely stored for retrieval when needed. In this article I revisit the options to reset the DSRM password.
Microsoft Edge: Deploy with Intune
COVID-19 has in many ways changed the way we work and how IT departments manage users and devices. With remote work continuing for the unforeseeable future, I decided to write this article to demonstrate how easy it is to deploy the new Microsoft Edge browser on Windows 10 and macOS using Microsoft Intune.
Machine account password expiry while working remotely
Due to the COVID-19 outbreak, most employees are now working from home. Many of these employees are not making use of any VPN solutions to connect to the corporate network. Some of the most frequent questions we receive since the shift to remote work are related to secure channel / machine account password changes.
Deploy Azure Advanced Threat Protection (ATP)
In this post I will take you through the steps to deploy Azure ATP in your on-premise Active Directory to detect and investigate threats in your environment.
Create a Group Managed Service Account (gMSA)
I have been using Group Managed Service Accounts (gMSA) more frequently and decided to post a refresher on the creation of gMSA accounts. I still find that customers are not making use of these service accounts and use standard accounts with fixed passwords instead. In this blog I will highlight the benefits of using a gMSA account and show the steps to create and update a gMSA account