Just a quick question with regards to Citrix Delivery Groups.
Is there a way to change the machine catalog assigned to a delivery group without having to create an entirely new delivery group?
The background to this, is that I need to change the SKU size associated with the machines that are spun up automatically in Azure and for that, I need to create a new delivery group.
I'm looking into how I can stop the LinEnum.sh tool from being used to escalate privileges on Linux boxes where I work. This issue was raised as a result of a pen test.
Is there anyone here who can help?
I think that the issue is more to do with the results of running this tool than being able to run it, itself, but security are asking to block it.
Is it possible for a guest account that exists on 365 to have access to a shared mailbox? Can this be done using B2B collaboration?
I have am unable to find an exact answer from the Microsoft docs on this.
In Dynamics 365 we need to be able to authenticate our domain for sending marketing emails. We have followed the advice in the Microsoft article below and now need to add the DNS records.
The TXT record it gives in the configuration is for the top level domain of our organisation. That is the one we want to authenticate. The thing is that our DNS already has a TXT record with the '@' symbol. I understand that this is a shortcut to the top level domain. If I were to add the additional value to that existing record of the key given in Dynamics 365, will that cause any issues? Is it safe to do that?
The text record already has values for SPF and some other keys.
I'm still learning infrastructure stuff and need to ask a question which relates to DMARC. A user in the organisation has an app which is sending marketing messages to staff within the business. The messages leave the network and come back in, but are detected as SPAM.
I have had a look and it seems that we would need to get the IP address of the source to be whitelisted through DMARC.
We have a DMARC record on external DNS and we have a DKIM policy. I can verify this from a combination of using online checker tools, the message headers from an email and looking at the DNS records. Does this mean that in order to allow the messages from the user's app, I will only need to add the IP address of the source to the SPF record?
Is there more steps involved? If so, would someone be king to point me in the right direction please?
UPDATE:
I had a look at the Dynamics 365 Marketing app and it there was a message suggesting to look at the article below:
https://docs.microsoft.com/en-gb/dynamics365/marketing/mkt-settings-authenticate-domains
I got the user to go to "Settings > Advanced settings > Marketing settings > Authenticated domains" in dynamics and they have added the domain for the organisation.
This generated the DNS records that need to be added.
What I am confused about is that the txt record has a host name of the top level domain of the organisation. If I add that to the DNS Zone in Azure will it cause any problems or issues with the mail flow or anything else?
I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the developer said that it needed to be CSP.
After some research, I am led to believe that if I were to base a new template from the code signing default template then that should be the right thing.
This is for an app registration in Azure and the developer is making a powershell script that will import the private key. From what I understand I will be able to import the certificate once it is published into the certificate store and then export the .PKS and the .CER. The cer to upload to the app registration and the PKS for the powershell script.
Please can someone advise me if this will work okay and if not please let me know or point me in the direction of what I should be doing. I am not that experienced with this and I am nervous about creating these on the company network and making a mess of the certificate templates. There is already the previous one which will need to be deleted.
What is the effect of deleting a template? My understanding is that it just removes the template and any certificates based on it are okay as it is only a template and the thing that matters the most is the actual certificate that is issued. Is that a correct interpretation?
I am new to AWS. I am setting up an S3 bucket that I want to use to store media files for a Django App I am developing.
I am logged in as the person who created the AWS account, but when I click on the permissions tab and then try to edit the bucket policy I am getting a message that states "You don't have permissions to edit bucket policy".
I am following a guide which describes the configuration for Django setup, but my understanding is that the purpose of doing this is to allow public read access to the files. I was able to set the CORS policy without any problems.
I created an IAM user logged in as them and it still gives errors. That IAM user has permissions to all S3 Buckets. The error states "After you or your AWS administrator have updated your permissions to allow the s3:PutBucketPolicy action, choose Save changes."
I went to the policy applied to the bucket and it has this permission. Here is the JSON.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": "mybucketARN"
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": "mybucketARN"
}
]
}
We need to create an Azure Application registration for an application which is only being run internally. The requirements are that it uses certificate authentication and we can't use Self Signed.
I have been referring the the document below for the app registration:
[https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal][1]
My question is should we use a certificate purchased from an external CA or one issued by the company's pki? If the internal option what kind of certificate should be issued and how do we go about issuing it.
I am not overly familiar with issuing certificates from the internal CA, but I have access to the certificate templates and one of the issuing servers. If someone could point me in the right direction to some instructions then that would be good as I have been looking online and not quite getting it.
We have multiple computers on the domain which have corruption within the OS. This corruption prevents the install of updates or upgrades.
I know the computers which have issues from the results of the command
DISM /online /cleanup-image /scanhealth
This reports that the component store is repairable. After extensive research online, I found several suggestions on how to repair this. I have tried all of the following, but none of this worked.
sfc /scannow
Dism.exe /online /Cleanup-Image /StartComponentCleanup
Dism.exe /online /Cleanup-Image /AnalyzeComponentStore
With sfc /scannow inbetween.
DISM /online /Cleanup_image /RestoreHealth
Tried targeting an image file with:
DISM /online /Cleanup_Image /RestoreHealth /Source:ESD:D:\sources\Install.esd:6
DISM /online /Cleanup_Image /RestoreHealth /Source:ESD:C:\esd\Install.esd:6
All of these fail, the restore health options always report source files cannot be found.
Eventually, on one of the effected machines, I was able to force the update to install using the Windows Update Assistant tool. This is okay for my individual computer, but we might have to apply this to multiple computers and automate the process.
Can anyone advise how we can do this since the upgrade cannot be deployed using SCCM and the other SCCM option of using a task sequence overwrites everything?
The restore health DISM commands were tried logged in as local admin, domain admin normal user, AV disabled, AV enabled. None of these worked. All I can think of is maybe I need a different source file, but I don't know where to get this from. Generally the computers have Windows 10 1909 installed, I only seem to be able to download the latest ISO for Windows 10.
It is potentially one of these updates that causes the corruption:
KB4580325 KB4580330 KB4578974 KB4577667 KB4577671 KB4580325 KB4577668 KB4579976 KB4580398 KB4580325 KB4577670 KB4578968 KB4578974 KB4579311
We have an SMB share set up in Azure.
Our infrastructure has an on-prem AD which synchronises with Azure AD and then there is an AADDS domain within Azure which has a copy of the user accounts.
If I log onto a computer within the AADDS domain as a user who has IAM read write access to the SMB share then it can be opened. If I try to access from a computer in the on-prem domain as that same user then it gives access denied. I can be logged onto my computer from the on-prem domain and access it as myself so I was assuming it would work for others, but this doesn't seem to be the case.
On the AADDS domain I ran the script like the one below in order to create an account in the Active Directory. I suspect it could be because the account doesn't exist on-prem? The thing is, how would I go about getting both domains to be able to access the SMB share without affecting what is already in place on AADDS?
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
Import-Module -Name AzFilesHybrid
Connect-AzAccount
$subscriptionId = "<SUBID>"
$resourceGroupName = "<RESOURCEGROUP>"
$storageAccountName = "<STORAGEACCT>"
Select-AzSubscription $subscriptionId
Join-AzStorageAccountForAuth -ResourceGroupName $resourceGroupName -StorageAccountName $storageAccountName -DomainAccountType ServiceLogonAccount -OrganizationalUnitDistinguishedName "<OU_DN>" -OverwriteExistingADObject
BACKGROUND:
After more testing, it seems that there isn't a way to have authentication to work on two domains simultaneously against the same storage account. The reason why we require this is that the WVD app references a mapped drive. The users need to be able to transfer files to the same mapping from their local ad on-prem joined computers.
I looked into ways around this such as seeing if there is a way to publish the file explorer as an app, but can't seem to do that. If there were a file browser utility that came with the RD Client it would be perfect.
It has become a requirement for us to have more than one password policy on the same domain. I have been doing some research and it looks like the way to achieve this is through Fine Grained Password Policies. I can see plenty of articles online which explain it and there is a tool for doing this now, rather than use ADSI Edit as for example https://specopssoft.com/blog/create-fine-grained-password-policy-active-directory/. We already have a GPO based password policy.
My question is how to we move from the GPO password policy to Fine-Grained? Will it cause a mess with the security or potentially lock people out? Can you just create a Fine-Grained policy in addition to the GPO one and attach to an OU or will that be overridden? Do we have to completely remove the GPO and create Fine-Grained policies? I can't see anything online which explains how to move from one to the other and what the implications are.
I have set up Windows Virtual Desktop within Azure. Currently I am able to configure the application I have published to use FSLogix to apply a mapping to a VHD file on an Azure share which is great, but what we'd like to also have is a drive mapping for everyone who runs the WVD app.
I have a file share ready in Azure blob storage which is accessible and I can map it manually from the server by the UNC path. I have tried using "net use R: " and adding this to run from the registry (Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) on the computer hosting the virtual app, but that doesn't open for for a user when they have logged on.
Online, I can only find information on the shared VHDs, but can't find anything on drive mappings in this scenario. Does anyone know where I can find this information or can you advise how it is done?
We are planning on configuring Windows Virtual Desktop within our existing Azure Infrastructure as we want to test an application in that environment and roll out to staff if the performance is satisfactory.
On reading the documentation and watching the videos, one of the stages involves creating a Windows Virtual Desktop tenant. Can we just use our existing Azure tenant or is this a separate thing?
I apologize for this really noob question, but I am being asked. I'm sure there is something online explaining this, but I am unable to find it so please point me to the documentation if so.
Our current infrastructure uses on-prem active directory which synchronizes to Azure using AD Connect. The plan is to also add Azure Active Directory Domain Services in addition to this.
From what I have looked into, it seems that when this is configured we will have a separate domain which we ideally need to name as a subdomain of our current one. We are then going to deploy Microsoft Virtual Desktop to this domain and the user's will be authenticating with their on-prem credentials when they access the virtual computers which I understand should work if on-prem syncs to Azure AD and then Azure AD to Azure ADDS.
In this scenario what if the virtual desktop sessions need access to resources in the on-prem domain? Would we need to set up a trust or would it automatically be able to reach them?
Thanks and sorry for this noob question as I'm new to infrastructure.
I need to migrate our Certificate Services from one server to a new one.
I am following a guide and there is the stage where you backup the old CA. How do you test that backup? I want to be able to check that backup is going to work before uninstalling the CA on the old server.
UPDATE:
In the screen shot below I have tested restoring to a test VM, the distinguished name when importing the certificate shows the name of the existing server while the destination server is different.
Can anyone advise if there is a way to migrate on-prem AD groups to pure Office 365.
In our environment we have a hybrid configuration which uses AD Sync to synchronize ad objects to Azure. So we have DL groups which exist in both places. What we want to be able to do is to sever the connection of the on-prem group from 365 and remove it from on-prem AD.
The reason for doing this is that we want to be able to achieve the ability of being able to delegate 365 users the ability to manage the groups. We want to avoid removing and recreating them because of the issues this causes for users with the groups cached in their suggested contacts.
Can anyone advise if this is possible and how it is done? I have searched online, but can't find anything.
My line manager wants us to push out the 1903 feature upgrade to computers, but he wants them to have a notification about the restart which looks as below and allows the user to delay the restart. He also expects the user to be able to restart the computer without the update installing until they have selected this in software centre.
The screen he is talking about looks as below:
Our client settings look as below:
The deployment options are as below:
I’d be very grateful if anyone is able to advise on what we would need to change in order to get the desired effect. Sorry to ask about this as I am really stuck.
I have looked on Microsoft's documentation about the hardware requirements for a distribution point server to have at every site in the company.
Is the following spec adequate from people's experience?
I am trying to configure peer authentication for root on Postgres v9.5. My aim is to allow the cron jobs to run pgdump to create backups.
My pg_hba.conf file looks as follows:
local all postgres md5
local all root peer map=mymap
My pg_ident.conf file looks like below:
# MAPNAME SYSTEM-USERNAME PG-USERNAME
mymap root dbadmin
The error when running psql to test as root user is:
psql: FATAL: Peer authentication failed for user "root"
I have seen things like this on here, but they suggest the settings I am already trying, but it doesn't work. Is anyone able to help or advise on a different solution?
I have tried creating a 'backup' user with the commands below on postgres:
CREATE ROLE backup WITH LOGIN PASSWORD 'backuppasswd';
GRANT CONNECT ON DATABASE mydb To backup;
GRANT USAGE ON SCHEMA public TO backup;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO backup;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO backup;
I then have run below:
export PGPASSWORD="backuppasswd"
I have then created a crontask with the entry below:
14 11 * * * pg_dump -U backup -h localhost mydb > /<mypath>
If I run "pg_dump -U backup -h localhost mydb > /<mypath>" from the command line then it creates the backup, but if I let the cron job run then it creates an empty file.
Can someone help?
I am using DISM to capture a Windows image. I have successfully captured an image from the reference computer after running sysprep and booting from Windows PE. This was done manually using the DISM /Capture-Image command with the verify argument.
It created an image which I want to deploy through WDS.
Before we even get there, I try to deploy the image manually to test that it works using the DISM /Deploy-Image command. If I do this then it fails with error 13.
The thing is that if I copy this image file to my laptop locally, I am able to mount it successfully to an empty directory and browse the files.
Can anyone help me get the image to apply?