Todd Wilcox's questions

I'm managing a bunch of IIS 8.5 servers and I'm working on complying with security baselines.

My question is this: If I run a specific appcmd query on one of our IIS servers, I get the following:

C:\>appcmd list config -section:system.web/authentication
<system.web>
  <authentication mode="Forms">
    <forms requireSSL="true">
      <credentials>
      </credentials>
    </forms>
    <passport />
  </authentication>
</system.web>

C:\>

What I need to do is find the actual configuration file that appcmd is reading from here, so I can update the relevant section manually (updating using appcmd itself causes all kinds of problems). I can't find it. I've checked the following files so far:

• %SYSTEMROOT%\System32\inetsrv\config\applicationHost.config
• %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
• %SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\Config\web.config
• %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
• %SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config
• %WEBROOT%\web.config
• %WEBROOT%\old application path\web.config
• new application path\web.config

I can't think of any other places to look. Most of those files don't even have a <system.web> section and none of them have the word "credentials" in them anywhere.

Where is appcmd reading from to generate the output above?

Edit:

I'm still looking into this, and just found the following here, which might be the answer:

Default Configuration

The following default credentials element is not explicitly configured in the Machine.config or root Web.config file. However, it is the default configuration that is returned by the application. <credentials passwordFormat="SHA1" />

We have set up one Spam Filter policy in Exchange Online Protection with our allow and block sender and domain lists and we have created a second policy that we want to have the same allow and block lists.

Is there a way to basically copy or import/export the allow and block lists from one policy to the other using powershell?

We have a guest wifi network that is in a DMZ-like zone on the firewall. Our Exchange 2010 servers are in the "inside" zone of the firewall, with 1-1 NAT to public IP addresses in the "outside" zone.

Autodiscover and Activesync work just fine in all situations from "outside" (note that this means the Microsoft Remote Connectivity analyzer passes all tests).

Going from the guest wifi zone to the inside zone where the Exchange servers are involves "hairpinning" or a "u-turn" on the external interface of the firewall because the guest wifi clients use public DNS for Autodiscover and Activesync (we don't want guests to be able to see our internal DNS, of course). The firewall manufacturer (Palo Alto) has a configuration guide for u-turn configurations which I have followed and which works, except with one quirk:

An iOS device on the guest wifi can connect to Exchange for both Autodiscover and Activesync using the Microsoft Outlook app for iOS, but cannot use Autodiscover or Activesync using the built-in iOS Mail app.

I can't figure out why those two would behave or work differently. So far I have suspected that Apple is trying to use different ports or something to synchronize, even though my expectation is only HTTPS 443 and (possibly) HTTP 80 would be needed. Currently the ports I have open to the Exchange servers from the guest wifi zone are 80, 443, and 143 (for IMAP as a stab in the dark).

What's the difference between Outlook for iOS and iOS Mail in terms of Activesync?

Edit - more information

I've done a couple things to try to get to the bottom of this. First, I opened up all the ports between the guest wifi zone and the Exchange servers, and nothing changed. This makes me think somehow the u-turn configuration might not be working but somehow the Outlook for iOS app is working around that.

Second, I filtered the firewall logs for connections from the guest wifi zone to the Exchange servers and there is nothing logged, even when the Outlook for iOS app is retrieving mail.

So my current theory is that Microsoft has built some resilience into their Outlook for iOS app by allowing it to use a kind of Activesync proxy service to help it reach destination servers in all situations, or something like that.

We are in the middle of hybrid coexistence migration from Exchange 2010 on-premise to Office 365. That means we have ADFS and "Dirsync" (now called Windows Azure AD Sync) running. We are more than halfway through migrating mailbox, so about 60% of our users' mailboxes are in the cloud and the remaining 40% or so are still in on-premise Exchange 2010 databases.

Today we discovered that one of our users has both an on-premise and an Office 365 mailbox linked to his one AD account. That means that if he opens Outlook on a domain-joined computer and goes through the initial configuration, it uses autodiscover to connect him to his on-premise mailbox, but if he logs on to the Office 365 portal, it shows his cloud mailbox.

Even worse, when a user whose mailbox is in the cloud sends him an e-mail, it goes only to his cloud mailbox, and when a user whose mailbox is still on-premise, it goes only to his on-premise mailbox. So he can't see all his mail all in one place.

How can we "merge" his mail data (final destination: Office 365) and make sure his Outlook "autodiscovers" the Office 365 mailbox and all mail is routed to that mailbox?

We have a Windows domain where I used GPOs to enable remote management and monitoring of all of our workstations using WMI. I can also connect to all of our computers with Computer Management and start and stop services and look at event logs, etc. All of that works great.

Except:

We have one computer that was running Windows 8.1 Pro and all of the above remote management, etc. was working; and then we ugpraded it to Windows 10 Pro for testing. It seems like all GPOs have applied to Windows 10 also, but WMI is not accessible remotely, and (maybe related, maybe not) if I connect (successfully) with Computer Management, I can access all the usual things except the Event Viewer (and WMI security settings).

I've re-run winrm quickconfig, I've checked and allowed DCOM permissions and WMI permissions, and then re-started the WMI service, and I still can't connect to WMI remotely. Web searches for any Windows 10 problems are still not turning up good results, in general, and nothing for this problem that I've found.

Has anyone gotten remote access to WMI to work on a Windows 10 computer? If so, how?

Addenda:

• WinRM service is set to automatic and is running.
• Windows Firewall is disabled. Windows Firewall services is stopped and disabled.