Appleoddity's questions

# Build a list of Adtran AP mac addresses found on directly connected switch ports
- name: PARSE AND FILTER MAC ADDRESS-TABLE
  ansible.builtin.set_fact:
    macs: "{{ macs + [item] }}"
  loop: "{{ macs_raw.stdout[0] | ansible.netcommon.parse_cli_textfsm('templates/cisco_ios_show_mac-address-table.textfsm') }}"
  when:
    - item.DESTINATION_PORT[0] not in neighbors.keys()   # Ignore macs found on neighboring switches
    - item.DESTINATION_ADDRESS is search('^0019\.92.*$')   # Ignore macs that aren't Adtran APs

I get the following deprecation warning:

[DEPRECATION WARNING]: Use 'ansible.utils.hwaddr' module instead. This feature will be removed from ansible.netcommon in a release after 2024-01-01. Deprecation warnings can be disabled by
 setting deprecation_warnings=False in ansible.cfg.

ansible --version

ansible [core 2.16.6]
  config file = /workspaces/git/my-repo/ansible/ansible.cfg
  configured module search path = ['/home/vscode/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/python/3.11.6/lib/python3.11/site-packages/ansible
  ansible collection location = /home/vscode/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/python/current/bin/ansible
  python version = 3.11.6 (main, Dec 19 2023, 21:21:06) [GCC 11.4.0] (/usr/local/python/3.11.6/bin/python)
  jinja version = 3.1.4
  libyaml = True

Why?

To get a computer to update its group memberships without rebooting the computer, you can purge kerberos tickets with the command klist -li 0x3e7 purge. A subsequent gpupdate or gpresult will reflect the new group memberships.

However, this does not seem to work on a domain controller. Why?

The tickets are purged successfully, but a subsequent gpresult /r does not reflect the changes.

Is there a way to change the amount of time the Group Policy Files Preference Policy takes to timeout when the file server is not available? A setting that affects only this preference item is necessary. Perhaps a registry change.

In an isolated backup test lab, we need to start an image of the domain controller first. The domain controller has group policy files preference items applied which refer to a file server that is not yet online. It takes many minutes for the server to move past, "Applying Group Policy Files policy."

FYI, there are likely other policies (such as asynchronous / synchronous) settings contributing to the fact that it won't move past group policy files. I need to know if there is an answer for the question asked, not how to change other contributing factors.

I have some Amazon Linux 2 EC2 instances.

I've installed the Amazon Linux 2 EPEL topic and the EPEL repo:

amazon-linux-extras install epel

I've installed the latest available version of nginx:

yum install nginx

The version I get is 1.20.1.

1.20.2 appears to have been released on November 16th, 2021. If I take a closer look I can see the EPEL repo is pointing at a fedoraproject.org repo:

Partial contents of epel.repo:

[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch
metalink=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

If I navigate to http://download.fedoraproject.org and search through the packages, I can confirm that only 1.20.1 is available.

On my RHEL 7 servers, they all have NGINX 1.20.2. Why does this repo still not have NGINX 1.20.2 available? Am I missing something? I would like to have NGINX 1.20.2 (or whatever latest version is available at the time) installed through an available repo including future updates, on my AMZ Linux 2 instances. I do not plan on building the package or installing the .rpm manually as this sticks me at a certain version without updates.

After two days of troubleshooting, I have figured out why my ESXi NIC teaming is failing.

I have the following network topology (simplified):

vmnic0 is currently set to unused on the ESXi virtual switch. Packet dumps (from the host) show NO outgoing packets on this physical interface.

However, my network connectivity to this host on SW1 is routinely knocked out (every several seconds). I found that the VMKernel MAC address b026.28b5.3b8c keeps appearing on SW1 port Gi1/0/7, which knocks it off of port Gi1/0/22 and causes packets to go towards the inactive ESXi interface. Incidentally, it is known behavior that VMWare grabs the physical MAC address of the NIC and uses it for the first VMKernel network on the first vSwitch.

After setting up a mirroring port on SW1, I found that vmnic0 is sending periodic LLDP packets from the same MAC address. In addition, VMWare tells me LLDP isn't even supported on standard vSwitches.

The fact those packets are not seen by the HOST OS, tells me this is a hardware level issue. It's worth mentioning that vmnic2 does not exhibit that behavior and it is a different type of NIC card.

vmnic0 is listed as a Broadcom BCM57416 NetXtreme-E 10GBASE-T RDMA Ethernet Controller in VMWare. This is on a Dell Poweredge R740.

How do I disable the hardware level LLDP agent on this NIC?

And, what issues might this cause if I do so?

I have the below, simplified configuration:

Essentially, I have an ESXi host with two physical network adapters. Each adapter plugs in to a different switch. Each switch is connected via a trunk port. A PC is connected to one of the switches. A vSwitch with a VMKernel port and VM ports is configured to use both physical NICs in an Active/Active configuration:

I have run esxtop and can see that the ESXi host has chosen the physical NIC connected to Switch 2 for the VMKernel port. From the PC, if I ping the management IP address of the ESXi host the pings are intermittent. They go up and down.

If I show the mac address-table on each switch, I see that Switch 2 always has the VMKernel's MAC address assigned to the switch port connected to the ESXi host. But, Switch 1 continually adds and removes the VMKernel's MAC address on it's respective physical port. Anytime Switch 1 has the VMKernel's MAC assigned to its physical port, the pings fail.

The reason for the failure is obvious. The reason why Switch 1 is routinely picking up the MAC address of the ESXi VMKernel port is the question. The ESXi host has chosen the interface connected to Switch 2 to be the active port. The interface connected to Switch 1 should be inactive. But, it would appear that it is possibly responding to ARP requests?

It's worth noting that none of the VMs on this host have this problem. They are all reachable and are present in only one MAC table at a time. This problem specifically affects the VMKernel port.

What about this configuration is wrong? I am looking for some type of documentation or explanation on top of a solution to this issue. I know that setting the VMKernel port to be Active/Standby mode will probably solve the issue. But, I can't find anything documented why this current configuration is a problem.

UPDATES:

• I disabled CDP on the vSwitch thinking that it might be causing communication over the inactive NIC.
• I overrode the vSwitch settings for the VMKernel port and set it to use explicit failover and Active/Standby. I also placed the standby NIC in the unused pool. None of it helped. What did solve the issue was changing the port order around. So, when the port connected to Switch 1 becomes active, I do not see the issue. The MAC address does not become active on Switch 2 at all. These are two significantly different NIC cards, and I'm wondering if this isn't some kind of driver issue.

Something has to be causing the VMKernel MAC address to be seen on Switch 1's port, but it comes and goes every several seconds.

Switch configs for STP and ports: Switch 1

!
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
!
interface Port-channel1
 switchport access vlan 11
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/7
 switchport access vlan 11
 switchport mode access
!
interface GigabitEthernet1/0/23
 switchport access vlan 11
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode desirable
!
interface GigabitEthernet1/0/24
 switchport access vlan 11
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode desirable

Switch 2

!
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
!
interface Port-channel1
 switchport access vlan 11
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/3
 switchport access vlan 11
 switchport mode access
!
interface GigabitEthernet1/0/23
 switchport access vlan 11
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode desirable
!
interface GigabitEthernet1/0/24
 switchport access vlan 11
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode desirable

We are utilizing Windows 2016+ DNS servers. We rely on LocalNetPriority on our DNS servers. We have several Active Directory DNS servers across multiple sites. The expected behavior is that when a particular query is made to the DNS server, it will return an IP address that is in the same subnet as the query originated, if multiple A records exist for the same host. This works fine in most cases.

However, for requests originating from the DNS server itself, it does not work. First, the DNS server (or Active Directory), by default, configures it's network interface to use itself as the DNS server of choice via localhost (127.0.0.1 and ::1). This causes the LocalNetPriority selection to fail as the originating IP address is not in one of our subnets.

Second, the server is preferring IPv6 over IPv4. We don't use IPv6 but also don't want to disable it as it has clearly caused problems in the past in different scenarios, and Microsoft claims it is mandatory and does not support or recommend disabling it. Using IPv6 is out of the question.

Finally, this has to work when there are network interruptions. This specific requirement demands that localnetpriority work properly when the satellite location is severed from the rest of the network. Therefore, using peer DNS resolvers as the primary server does not fulfill this requirement alone.

It seems like settings IPv4 to be the priority over IPv6, and configuring the server's actual IP address as the DNS server of choice, may be the only solution. However, I learned a long time ago that using 127.0.0.1 is the best choice because during a reboot or if a network cable is unplugged, active directory can completely fall apart.

What am I missing? Is there a more direct way to solve this problem? Maybe I should just add a HOSTS file entry for the specific host that we're having trouble with.

I am creating an AWS distributor package to modify the syslog configuration on different flavors of Linux servers. I wrote a few simple bash scripts to handle the install, uninstall, and update. I thought this would be universal. However, today I found out that AWS uses sh to execute the script (i.e. sh install.sh) and on Ubuntu/Debian this defaults to DASH and not BASH. For that reason my scripts fail with:

update errors: update.sh: 3: update.sh: function: not found

update.sh: 9: update.sh: Syntax error: "}" unexpected

failed to run commands: exit status 2

Failed to install package; install status Failed

I can't change the AWS behavior. And I don't want to modify any configurations on the server. So, it would appear my only options are that which modify the script file itself?

The first preference would be to make the script universal so it can run on any flavor of Linux. The second preference would be to create a different script for Debian that is DASH compatible.

Unfortunately, I don't find much information about dash programming. Any suggestions?

The 3 scripts in question are....

install.sh

#!/bin/bash

function isInstalled {
  if sudo ls /etc/rsyslog.d/xdr.conf >/dev/null 2>&1; then
    true
  else
    false
  fi
}

if isInstalled; then
  exit 0
else
  sudo cp xdr.conf /etc/rsyslog.d/xdr.conf
  sudo service rsyslog restart
fi

uninstall.sh

#!/bin/bash

function isInstalled {
  if sudo ls /etc/rsyslog.d/xdr.conf >/dev/null 2>&1; then
    true
  else
    false
  fi
}

if isInstalled; then
  sudo rm /etc/rsyslog.d/xdr.conf
  sudo service rsyslog restart
else
  exit 0
fi

update.sh

#!/bin/bash

function isDiff {
  if sudo diff xdr.conf /etc/rsyslog.d/xdr.conf >/dev/null 2>&1; then
    false
  else
    true
  fi
}

if isDiff; then
  sudo cp xdr.conf /etc/rsyslog.d/xdr.conf
  sudo service rsyslog restart
else
  exit 0
fi

I am following the instructions for NXLog here: https://nxlog.co/documentation/nxlog-user-guide/linux-logs.html#linux_logs_forwarding_socket_example under 80.2 about forwarding syslog messages to NXLog.

It specifically states to restart NXLog and then rsyslog so that NXlog can create the socket before rsyslog tries to write to it.

My question is, during a reboot, and across different versions of Linux, it is ambiguous as to which service will start first, and my guess is that syslog may start first. What will happen if rsyslog starts before nxlog? Will rsyslog recover and start writing to the socket after nxlog starts and creates it?

I created an AWS Systems Manager Distributor package in one AWS account that will install an application on Windows, Ubuntu, Amazon Linux, or Redhat. The manifest and associated packages are stored in an S3 bucket owned by the same account. I modified the permissions of the bucket to allow read access from my other AWS accounts.

I logged in to a secondary AWS account with EC2 instances I want to install the application on using the distributor package. I created a new distributor package by pointing it to the S3 bucket in the other account. The package is created and the software is installed successfully on all 4 instance types mentioned above during my testing.

Now, the problem. I log back in to the AWS account with the original Distributor package and I share it with the other AWS account that has the EC2 instances. I log back in to the other AWS account with EC2 instances, I find the shared distributor package, and I again run it on some instances. This time, it works on all instance types EXCEPT for the Amazon Linux systems. Now, I get

failed to find platform: no manifest found for platform: amazon, version 2, architecture x86_64.

Yet, above, I already used this exact same manifest/package to install. The only difference is that it is now shared from another account instead of directly created in the account.

Why does the distributor package work when I add it directly in to another AWS account, but fail to work only on Amazon Linux instances, when I share it across accounts?

This is my manifest:

{
    "schemaVersion": "2.0",
    "version": "Auto-Generated-1639173022560",
    "packages": {
        "windows": {
            "_any": {
                "_any": {
                    "file": "redcloak-2.8.4.0.msi.zip"
                }
            }
        },
        "ubuntu": {
            "_any": {
                "_any": {
                    "file": "redcloak-1.2.15.0.deb.zip"
                }
            }
        },
        "redhat": {
            "_any": {
                "_any": {
                    "file": "redcloak-1.2.15.0-0.x86_64.rpm.zip"
                }
            }
        },
        "amazon": {
            "_any": {
                "_any": {
                    "file": "redcloak-1.2.15.0-0.x86_64.rpm.zip"
                }
            }
        }               
    },
    "files": {
        "redcloak-2.8.4.0.msi.zip": {
            "checksums": {
                "sha256": "90d6c7e2a37be8da08010763a913644861d1e1e606fb31fad2f5cd3a73ec6d39"
            }
        },
        "redcloak-1.2.15.0.deb.zip": {
            "checksums": {
                "sha256": "6cfbc2731116ae5c07221f2978c19b80829da7c8fa66cffbe1c9c466ece1e135"
            }
        },
        "redcloak-1.2.15.0-0.x86_64.rpm.zip": {
            "checksums": {
                "sha256": "db01f0fcd624512c9c873893518b83238d1f56c4b948ad4e1bf901d6022fa0ef"
            }
        }
    }
}

I'm really struggling with this. The command is similar to what is confirmed here, and on numerous other sites.

I want to add a custom logging field to IIS via the Add-WebConfigurationProperty Powershell command. The custom field name is X-Forwarded-For. However, I have resorted to also trying to add a test field. I'm using IIS v10 on Windows Server 2019.

I use this:

Add-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile/customFields" -name "." -value @{logFieldName='test';sourceName='X-Forwarded-For';sourceType='RequestHeader'}

The first time I run it, I get this:

Add-WebConfigurationProperty : Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Error: Cannot commit configuration changes because the file has changed on disk

The second time I run it, I get this:

Add-WebConfigurationProperty : Filename: 
Error: Cannot add duplicate collection entry of type 'add' with unique key attribute 'logFieldName' set to 'test'

And, at no time does it ever modify the applicationHost.config file at all:

    <siteDefaults>
        <logFile logExtFileFlags="Date, Time, ClientIP, UserName, ServerIP, Method, UriStem, UriQuery, HttpStatus, Win32Status, BytesSent, BytesRecv, TimeTaken, ServerPort, UserAgent, Referer, HttpSubStatus" logFormat="W3C" directory="D:\inetpub\logs\logfiles">
            <customFields>
                <clear />
            </customFields>
        </logFile>
        <traceFailedRequestsLogging directory="D:\inetpub\logs" />
        <ftpServer>
            <logFile directory="D:\inetpub\logs\logfiles" />
        </ftpServer>
    </siteDefaults>

Nor does the field ever show up in IIS Manager. Nor does it show up with Get-WebConfigurationProperty.

In addition, I manually added the X-Forwarded-For through the IIS Manager GUI (which immediately modified the applicationHost.config properly and shows up via Get-WebConfigurationProperty), and then tried adding it through Powershell and I again get the can't add "duplicate" field error. Then, when I delete the field through the GUI and run the command again, I get the cannot commit changes error. If I run the command again, I get the cannot add duplicate error. Yet, the applicationHost.config still doesn't get modified. So clearly the command IS affecting the same area I am changing in the GUI, and it appears to do something because I can't add duplicates, but the changes never appear in applicationHost.config or in the GUI. I've tried closing and re-opening IIS Manager and restarting IIS.

What am I missing?

According to this article SMB Multichannel can provide the following capability:

• Increased Throughput - The file server can simultaneously transmit additional data by using multiple connections for high-speed network adapters or multiple network adapters.

A key requirement is:

• One or more network adapters that support Receive Side Scaling (RSS)

This differentiates between multiple network adapters, and multiple connections over a single network adapter, from my interpretation. This makes sense because most clients will NOT have multiple network adapters..

This seems to indicate that SMB Multichannel WILL create multiple connections over a single network adapter to improve throughput. With so many people working remotely, and with SMB performing so poorly over VPN, how do I make SMB use multiple channels over VPN? If I can't, why not?

I researched this months ago, and came to the conclusion that it was either not possible, or would have no benefit. But, the topic has come up again today, and I realize just how little information there is about this apparent performance solution over VPN and how conflicting a lot of the information is.

If I run get-netadapter I see the Cisco AnyConnect:

Name                      InterfaceDescription                    ifIndex Status       MacAddress             LinkSpeed
----                      --------------------                    ------- ------       ----------             ---------
Ethernet 2                Cisco AnyConnect Secure Mobility Cli...      22 Up           00-05-9A-3C-7A-00       995 Mbps
Bluetooth Network Con...2 Bluetooth Device (Personal Area Ne...#2      18 Disconnected 48-F1-7F-B8-15-4A         3 Mbps
Ethernet                  Realtek USB GbE Family Controller            17 Up           C8-F7-50-BD-BE-B2         1 Gbps
Ethernet 3                Intel(R) Ethernet Connection (7) I21...      16 Disconnected C8-F7-50-40-7F-AF          0 bps
Wi-Fi 2                   Intel(R) Wireless-AC 9560 160MHz             13 Disconnected 48-F1-7F-B8-15-46       702 Mbps

If I run get-smbclientnetworkinterface I see RSS Capable is False:

Interface Index RSS Capable RDMA Capable Speed    IpAddresses
--------------- ----------- ------------ -----    -----------
22              False       False        995 Mbps {fe80::7462:e71e:9881:4acd, fe80::b2f5:b0a1:835c:2c59, 10.100.20.141}
16              False       False        0  bps   {fe80::8464:d8a6:5624:de65}
17              False       False        1 Gbps   {fe80::e4ad:bb1b:5cdc:7dd7, 192.168.1.103}
13              False       False        702 Mbps {fe80::a9ce:6710:5904:a673, 192.168.1.195}
9               False       False        0  bps   {fe80::bc98:252c:7c3f:acec}
11              False       False        0  bps   {fe80::b035:347f:91cb:d7f}
18              False       False        3 Mbps   {fe80::490b:e922:3662:a942}

On the server side, the network adapter is RSS capable, and SMB Multichannel is enabled.

In previous network diagnostics I was able to determine SMB v3.1.1 is in use and SMB multichannel was not in use.

If it means anything, we use Cisco AnyConnect connecting to Cisco ASAs.

EDIT: I think it is coming from HKEY_USERS\.DEFAULT\Printers\ConvertUserDevModesCount. I see all of the original and new printer connections listed in here as well as a ton of repeating \\CSR|<ServerName>\{<long GUID>} entries. I found this article in a round about way which led me to look in this area.

I have a set of printers which deploy to computers via GPO. Today, I tried to change that printer mapping. The new printer mappings show up on the workstation, but the old ones are still being displayed.

However, prior to login, the user profile does not exist on the computer. Nothing in C:\Users, nothing in Advanced System Settings. Yes, I have a lot of computers to test on. Even if I remove the GPO which deploys printers, the original printers continue to show up in the "Devices and Printers" window.

If I delete the user from AD, and re-add a new user with same username and password, the original/old printers no longer show up.

Additionally, if I use powershell's get-printer or wmic printer list brief these original/old printers do NOT show up. They also do NOT show up in the registry under HKCU\Printers\Connections but ALL of the proper / new printer mappings do. Yet, these old connections continue to show in the 'Devices and Printers' window. And, they continue to work properly.

These are hybrid Azure AD joined PCs. But, we do not have AD premium and there is no enterprise state roaming configured. We are not using roaming profiles. We are not redirecting folders to any network shares. No other settings seem to roam or appear. Files saved are gone. This seems to effect all or several users on the same machines including a 'guest' user who's profile is 'temporary' and deleted on every logoff.

HOW are these printers continuing to appear on computers that the user does not have a profile on and no GPO or script is deploying. Why do they show only in 'Devices and Printers' but not in wmic, powershell, or the registry? The user logged on to this computer and others in the past within our organization.

I am trying to delegate permissions for a service account to modify a single extended property on active directory user accounts. The property is msDS_CloudExtensionAttribute1.

Our AD user objects have this property, and so it is easy to delegate the proper permissions at the OU level. However, protected user accounts (such as domain admins) keep having their permissions reset by the SDPropagator task.

To fix this, I need to correct the permissions that are applied to protected accounts by modifying the AdminSDHolder object in active directory. This object does not have the msDS_CloudExtensionAttribute1 property. Therefore, I have been unable to provide write permissions to this property on this object.

How do I add the missing property to this specific AD object, so I can set permissions on it, and it can be copied to protected user accounts?

I previously asked a similar question about doing this in Azure AD. However, I've come to the conclusion that it is probably too limited to do this and I received no answers.

However, in ADFS there is a lot more flexibility.

I want to convert an active directory user's group membership to a single : delimited/enclosed string. So, if the AD user is a member of Group1 and Group2, then a claim will be issued with a string value of :Group1:Group2:. Or, preferably, it would use the SID of the group which is immutable.

I don't think there is any built in way to do this based on my research, but maybe someone is more familiar with the claims rule language that can provide a method? Otherwise, it looks like I might be able to create a custom attribute store which can pretty much utilize any .NET code I want to process claims, as described here.

Before I go down the road of creating my own custom attribute store, is anyone aware of a way to do what I am trying to do either using built-in ADFS functionality, or by utilizing a publicly provided custom attribute store similar to this one here?

I am running ADFS 4.0.

I don't install Ubuntu often. However, I'm now having this issue twice.

The first time, I ignored it, continued my installation with DHCP enabled, then manually configured the network adapter after install.

Now, I'm on a completely different network, completely different hardware, etc. and trying to do a basic installation of Ubuntu server 18.04 again.

I get to the initial stages, the install finds a DHCP address for the network adapter and gives me the ability to reconfigure it at that time. I edit the settings, and specify the network info I want to use for IPv4 after choosing "Manual" for IPv4 Method:

When I choose to "Save" the settings, the installation immediately restarts back at the first screen and the settings are erased.

This is now the second time I've installed Ubuntu 18.04 with the exact same problem on completely different networks and hardware. I'm 0 for 2 and can't find even a hint of it on the internet about this problem.

Why is this happening?

EDIT: I found this post with no answer: https://askubuntu.com/questions/1124742/ubuntu-18-04-2-lts-server-network-configuration-problem-during-setup?newreg=444bcbeb65ab498b92298f80ad9427dc

Using user scoped group policy preferences, we are creating a home folder for new users on the server. This home folder inherits "CREATOR OWNER" permissions from the root home share. Now, we want to create a second folder under the Home folder called Scans. But, we want to change the permissions of that folder so that the user has full control over the subfolders and files - we do not want to just inherit "CREATOR OWNER" permissions. The problem is that the scanner drops files in to that folder and it becomes the owner of the file causing the user to lose access to it.

I'm curious of what ideas are out there on how to do this?

I think I know what options I have, and none of them are optimal. First of all, I am not aware of a group policy preference item for users that can set file/folder permissions - they are all computer scoped, which does not work in this case. In addition, login script execution order comes before group policy preference folder items which would require at least 2 GPOs to work around and I hate login scripts in this day and age.

So, the goal would be to NOT use login scripts, to use a single GPO item, and to have it fully configured during the first logon (without having to logon twice, or wait for gp refresh, etc.)

For the time being the only solution I can come up with would use a single GPO with a login script to set permissions at the user level. So, ultimately, it's looking like the best way is to just create a login script that creates the home folder, creates the scans folder, then sets the permissions. But, that is SO ugly and it is also a pain because our GPOs are using item level targeting for several different reasons and login scripts don't support item-level targeting.

Strangely, there doesn't appear to be a whole lot of direction on this and it doesn't seem that even the backup vendors can provide a straight answer.

In a Windows DFS replication group, each server maintains a folder DfsrPrivate under each replicated folder to track ConflictAndDeleted files, Staging files, etc. This folder is an NTFS junction to a separate folder under System Volume Information\DFSR\Private.

During the course of the day, DFS produces quite a bit of file system changes under these folders for what is essentially un-needed data. This can cause larger than normal incremental backups.

My question - Is it important to backup this folder?

What will happen during a restore if the root "Private" folder, or a subset of folders are not restored? What about the relationship with the Junction points?

Note - These specific folders do NOT contain the DFS database and configuration files. That information will be backed up and restored.

For some reason I'm having trouble connecting the dots on how to do what seems pretty simple.

How do I log all e-mail sent through the AWS Simple Email Service with specific message details?

That log, at the very minimum, needs to contain the IP address of the sending server. But, I really need the TO address as well. Backstory - we have several servers that utilize this service, and when one of them acts up and starts sending thousands of e-mails we get alerts through Cloudwatch monitoring - but no way to find out what server is actually sending them.

Immediately, upon research, you find evidence of people really wanting this feature and it not being available. However, newer articles suggest this is possible.

Ideally, I have tried to use Event Publishing to Cloudwatch as described in these two articles: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/monitor-using-event-publishing.html https://docs.aws.amazon.com/ses/latest/DeveloperGuide/event-publishing-add-event-destination-cloudwatch.html

• I created a new SES configuration set.
• I added a cloudwatch destination to this configuration set.
• I specified Event Types of Sends; Rejects; Bounces; Complaints; Deliveries; Rendering Failures
• I chose Value Source of Message Tag with Name of ses:source-ip and Default Value of source-ip.

After some time, no events are published to Cloud Watch.

The documentation just isn't very clear on this whole process, and never gets down the actual details with examples.

There is some suggestion that I might have to add headers to our outgoing e-mail to track, but other suggestions that there are defaults, and that I don't actually have to modify our sending behavior.

Fine-grained – These metrics are categorized by email characteristics that you define using message tags. To publish these metrics to CloudWatch, you must set up event publishing with a CloudWatch event destination and specify a configuration set when you send an email. You can also specify message tags or use auto-tags that Amazon SES automatically provides.

There is also some documentation about using Kinesis Firehose as a destination and it shows examples of very detailed message info - which is exactly what I would love to have: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/event-publishing-retrieving-firehose-examples.html#event-publishing-retrieving-firehose-send

I just don't know which direction to go here and how to set this up.

I need the simplest way to log what seems like basic SES diagnostic information and use it for troubleshooting purposes later. It's hard to believe this information isn't just readily available in the AWS console somewhere.

I know this is probably not the best place to ask this question. But, after days of working on this, and having posted in the Microsoft Forum, I'm at my wits end.

We are utilizing a hybrid ADFS 4.0 (Server 2016) / Azure AD / Office 365 setup with device registration and SSO working.

We are attempting to enable multi-factor authentication with device based access policies. We don't want "recognized" devices seeing additional MFA prompts. We are evaluating the claims being returned by ADFS using the Microsoft Claims Xray.

We have successfully enabled MFA and configured ADFS to only prompt for MFA if a device is unrecognized. This works because devices that are recognized have additional properties in active directory (isRegisteredUser; isManaged; isKnown; trustType; etc) and we can take action on those properties. We've tested with IE, Firefox, Chrome, and Safari on an iPad. However, the "DeviceContext" claims only come through when the authentication is done from IE or Safari on the iPad.

For some reason, it appears no device authentication occurs when the request is made from Chrome or Firefox. Authentication works, we just can't see any of the devicecontext claims that allow us to make a decision based on if the device is registered or not. So, these browsers get an additional MFA prompt.

I simply cannot find any posts online matching my exact problem. There are a few threads that are similar, but turn out to be different issues, or end up at a dead end. I'm hoping someone has this similar setup and knows why Chrome and Firefox would not perform the additional device based authentication, but safari on an iPad would. All the devices have valid certificates to perform the authentication.

I don't get any errors to go on in any event logs. The browser simply doesn't make a device authentication request, and no devicecontext claims are issued. It's possible this isn't supported, but I can't find any information indicating one way or another.