Christopher Galpin's questions

Recently had an Office 365 account compromised from a phishing website, which then sent out a mass-mail. Their email otherwise continued to function. Seeing the spam mail, I blocked the phishing site and reset the user's password. When they logged back in they weren't able to receive or send email, presumably because they were automatically added to "Restricted Users" in Office 365 Security & Compliance.

I removed them from this list by selecting to "Unblock" their account, but mail flow has not been restored several hours later.

I've been checking wherever I can think of in Microsoft 365 admin center, Security & Compliance and Exchange admin center, (including Get-BlockedSenderAddress through the Exchange Online PowerShell as suggested on Removing a user from the Restricted Users portal after sending spam email) for something I've missed but I can't seem to find the issue.

Any suggestions on where I should look? I haven't found indication of an error, although there's probably one somewhere. For instance mail sent from the account appears in "Sent" although goes nowhere. Outlook and web-based mail are behaving the same. I feel like I'm missing something obvious?

I'd like to move some emails from one mailbox to another. I have both mailboxes accessible in Outlook 2010. All emails have moved successfully except a couple that are >20mB, for those I receive:

Cannot move the items. The item cannot be moved. It was either already moved or deleted, or access was denied.

Since it's just the larger emails that won't move I keep looking toward limits as being a culprit, except there aren't any set. The recipient mailboxes are set to use database defaults, and the database storage limits remain off. (Since they're off I haven't changed them, but I'm aware it can take up to 2 hours for changes to apply unless the Information Store service is restarted.)

I'm not even sure if I'm looking in the right area. Since all the other emails from the same folder continue to move perfectly fine I can't imagine it's a permission issue. What could it be, where should I look?

I'm not an Exchange expert, if you need more information ask and I will provide. This is Exchange 2010 SP2. Other emails with similar attachments (in number and type) moved correctly but weren't as large, it really does seem to be size-related.

Although my XP workstations are connected to the domain, after booting firewall.cpl reports they're "using non-domain settings".

Official literature tells me it's an issue with the DNS suffix of its connection not matching the DNS name on the last group policy update, however this doesn't seem right as applying gpupdate /force correctly fixes it to "using domain settings".

How can I get the firewall to correctly detect it's on a domain upon boot?

1. Is it possible for S.M.A.R.T. to give false readings (say I was fiddling with lots of recovery programs, transfers, so on and so forth) or is it absolutely a read-only direct correlation to the physical status of a drive?

2. Does SpinRite level 5 "recover bad sectors" operate on those marked at the factory? Are they on the same level as your generic bad sector, with SpinRite thus having full access?

3. The main firmware of (many?) drives, like a WD Passport is stored on the platter. How is it protected? Might SpinRite's sector recovery corrupt it?

4. Is the failure of a drive to report valid identity information (hdparm -I /dev/xx) consistent with corrupted firmware, or just general disk failure? I may be misunderstanding the role of firmware here. I feel I've read a drive's identity information is on the platter, just like the partition tables and so on. Is this true?

All in the title. I'm looking for how to reference a local, not network, path, as a virtual drive letter. An innocuous example: C:\Storage as G: