Peter's questions

I'm having a problems on the network
Some newer Windows 10 PC's (Win10 image from Dell), behave different, then older Dell PC's.
They have the same service pack's and hotfixes, its something in settings.

They don't accept remote administration tasks, such Manage PC by using an MMC to a remote \client
And neither do they accept Sysinternals remote tools like psexec etc.
I've noticed that those machines don't allow RPC connections.

Although those services run :

• RPC Endpoint Mapper
• DCOM Server Process Launcher
• Remote Procedure Call (RPC)

And i made sure the rpc is allowed

netsh advfirewall firewall add rule name="RPC endpoint mapper" dir=in action=allow protocol=TCP localport=135

Any ideas of what this could be ?.

I'm learning to use ELK and have a debian PC that runs as a test client. every 30 sec it logs a message :

021-01-18T08:29:59.656-0500#011INFO#011[monitoring]#011log/log.go:145#011Non-zero metrics in the last 30s#011{"monitoring": {"metrics": {"beat":{"cgroup":{"memory":{"mem":{"usage":{"bytes":4096}}}},"cpu":{"system":{"ticks":171310,"time":{"ms":11}},"total":{"ticks":433770,"time":{"ms":24},"value":433770},"user":{"ticks":262460,"time":{"ms":13}}},"handles":{"limit":{"hard":524288,"soft":1024},"open":13},"info":{"ephemeral_id":"e83bbdd5-2482-4ac4-85b9-5b50f2b64e7c","uptime":{"ms":444690082}},"memstats":{"gc_next":20543200,"memory_alloc":12804128,"memory_total":20951973208},"runtime":{"goroutines":54}},"filebeat":{"events":{"added":2,"done":2},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":2,"batches":2,"total":2},"read":{"bytes":681},"write":{"bytes":4714}},"pipeline":{"clients":3,"events":{"active":0,"published":2,"total":2},"queue":{"acked":2}}},"registrar":{"states":{"current":15,"update":2},"writes":{"success":2,"total":2}},"system":{"load":{"1":0,"15":0,"5":0,"norm":{"1":0,"15":0,"5":0}}}}}}

I dont want to have this every 30 secconds, so i created a filebeat.yml filter it out in filebeat

under path's section i wrote

exclude_lines :['^INFO#011[monitoring]#011log/log.go:145#011Non-zero']

To no effect, how should the line be ?.

I have a few side questions,

• If it wasnt logged every 30sec it be fine to me, can this status be logged every 5 minutes ?
• Well i'm new to ELK, i would think this line shouldnt be in filebeat (as it should do logs not memmory stats of the system, or am i reading tis wrong ?) On the other hand it isnt bad to know those stats, but then why isnt it nicely shown in Gui

Under account settings Outlook2016.
One has the option mail to keep offline in the gui, to cache Email.

Problem: For unknown reasons it stays at 1 month or all time.
One should be able to alter the period by policy or registry:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\xx.0\Outlook\Cached Mode  
 xx.0 =   
  Outlook 2016 is 16.0  
  Outlook 2013 is 15.0  
  Outlook 2010 is 14.0  
  Outlook 2007 is 12.0  
  Outlook 2003 is 11.0  
  
Create a DWORD value of SyncWindowSetting, and then set the desired value:  
0 = All (whole mailbox)  
1 = 1 month of email items  
3 = 3 months of email items  
6 = 6 months of email items  
12 = 1 year of email items  
24 = 2 years of email items  
36 = 3 years of email items (Outlook 2016 only)  
60 = 5 years of email items (Outlook 2016 only)  

I even added the Dword value Enable and set it to 1.

I need to have syncWindowSetting to 12, to keep one year of email cached in the OST, however outlook seams to completely ignore these values, and sticks to one month only or all
Any ideas to get it working for only 1 year are welcome

a registry export of my outlook settings is below:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Cached Mode]
"SyncWindowSetting"=dword:0000000c
"SyncWindowSettingDays"=dword:00000000
"Enable"=dword:00000001

However whatever i do inside outlook 2016 it stays at 1 month.
As for registry permissions, the user and system can read above entries.

I would like to have a spamassasin rule that by default disables all external Emails to groups with exclusion of only a few groups. Thus [email protected] should not be able to [email protected]. While internal users should be able to those groups.

Only some group address should be possible for external usage [email protected] is allowed to email [email protected].

I have a background in Exchange, but I am looking into a Kopano solution hosted on a freenas.
As i prefer ISCSI for the MySQL DB (for speed) and am noting the company growth which will be a lot in the future.

I wonder if kopano can handle multiple DB's. (so i could simply add ISCSI devices in the future).
In Exchange this would be a normal thing to do, but i'm not sure if kopano can handle this, or maybe we just then have to add another VM kopano 'brother' to handle the more mailboxes in the future.