Patrick's questions

This is a pure M365 environment. No hybrid, 5 of 6 users are working as expected.

1 of 6 is unable to sign in via Outlook for Windows Desktop. MS Mail/Andoird Outlook/Outlook for Web are all OK and work as expected.

In Windows Desktop Outlook 365 (up to date) we set up a mail profile as normal and the sign in box pops up, we enter the user and pass and... nothing. Just loops back to requiring user/pass. We are stuck at this point.

Whats happening, and this is across multiple machines/versions of Outlook/networks, is that the authentication request doesn't even appear to hit Exchange Online.

If I look at the AzureAD sign in logs there's just no entry for the attempts to log in with Outlook for this account.

To demonstrate this I've attempted a login from a mobile hotspot with a unique IP. After half an hour or so of sporadic sign-in attempts the AzureAD Sign-Ins page shows no attempts for this IP. The moment I try to login to Outlook for Web an entry appears for this IP (and sign in to OfW is successful). I tested this with a different account on a different tenant and it worked immediately over this hotspot.

I've tried from the users system, my own system, several networks and with a new profile in a known working version of Outlook. All other users in the same tenant are fine.

So there's something in this users configuration that is preventing Outlook from even attempting to connect to Exchange Online. There's a bunch of history for this user which I'm not privy too and won't be able to find out, at some point there have been application passwords and MFA but these have been deleted / disabled. This was working up until recently, then their Windows desktop was re-installed and now we have this issue. I suspect that there may have been some attempts to fix an issue that isn't being relayed but I don't understand what.

Microsoft Connectivity Analyzer passes without issue, and as I say other users of the same tenant are working fine.

Any thoughts on why this user may not be able to authenticate?

I've got a 3rd party who host a system for us, it has a function to send a small number of emails for us, less than 100 a day, so we simply supplied an Office365 user to them which has been working for ages.

Last night this stopped working. The interface I can see is simply returning Message could not be sent. Mailer Error: SMTP connect() failed. (PHPMail)

The third party is massively dragging it's heels with regards to investigating from their side and I would like to be able to help them by supplying more information, however I'm unable to see any detail.

I want to see whats happening from my side, assuming it isn't an issue that means they are completely failing to hit the Microsoft IPs (like DNS config or similar) is there any way I can view a trace of their incoming connection attempts?

For ther record the user account that they are using isn't blocked, is able to sign on, password is not expired, I am able to send as them from a remote location.

Back in the day of exchange on-prem i'd dig into the SMTP logs which would give a fairly clear indication of whats happening but there doesn't appear to be an equivelent in Office365.

I have run a custom SMTP CS Report and a Message Trace based on the inbound IP Address, both only show successful connections and sent emails, both of which i have validated.

Is there any way I can see a log of or any detail of failed connection attempts from a third party to our Office365 tenant?

I have just SeaFile running in Docker, scanning the public interface I can see SSLv3 and TLS1.0 are enabled. I'd like to disable them but I'm at a loss as to where that would be configured in this setup.

I launched the container with

docker run -d --name seafile \
  -e SEAFILE_SERVER_LETSENCRYPT=true \
  -e SEAFILE_SERVER_HOSTNAME=seafile.example.com \
  -e [email protected] \
  -e SEAFILE_ADMIN_PASSWORD=a_very_secret_password \
  -v /opt/seafile-data:/shared \
  -p 8080:80 \
  -p 8443:443 \
  seafileltd/seafile:latest

It's running nginx as the webserver, i have the nginx configuration in the docker merged folder, effectively /etc/nginx, but I can't find anywhere the options for configuring the available ciphers.

grep -i -r "ssl_protocols" /etc/nginx/ returns zero results and after a bunch of digging through google results and bits of documentation I'm no further forward.

Any thoughts?

About 6 hours ago I removed an SMTP address from one of our users using the Office365 admin portal. I want to attach this address to a new shared mailbox.

Trying to create the new mailbox with the address is just giving me

Email addresses need to be unique and this one is already being used by the pgreen.

I understand that there is a time period for the removal of the address from the original recipient to propagate but I thought that was measured in minutes, not hours. Certainly after 6 hours I'd expect it to be clear, so now I'm wondering if I've done something wrong.

Checking the recipient from the O365 powershell module show the address is no longer associated.

The address removed was [email protected] from the recipient pgreen.

PS> (get-recipient pgreen).EmailAddresses    smtp:[email protected]
SMTP:[email protected]
SIP:[email protected]
smtp:[email protected]
smtp:[email protected]
smtp:[email protected]

Email sent to the removed address [[email protected]] is returned undeliverable pgreen wasn't found at somethinggroup.com

I can't think of any other way to identify if/what/where is going on. Is it just a case of waiting it out?

I've got a new Azure instance up and running. I've got a few services running in it and I've decided I need a Azure AD environment too.

On opening up the Azure AD Admin panel I immediately get told I don't have some rights to view the dashboard elements and I need a global admin to configure that for me.

On navigating to the users panel (more services > Users and Groups > All Users) all my configured users (Everyone in my 365 subscription) are listed as 'member', including both administrator accounts I have configured on 365 (one of which I am currently logging into azure as).

If I got to the 'directory role' option under any of my user accounts (including the one I'm pretty sure I started the Azure account under) the three options are greyed out and only member is selected.

The first line in the Microsoft Docs 'Assign a user to an admin role' is simply 'login with a global admin account'.

Doc here : https://docs.microsoft.com/en-us/azure/active-directory/active-directory-users-assign-role-azure-portal

Catch 22, I can't get a global admin without already having a global admin.

How am I able to elevate a user to the global admin role from this position?

I've got two SQL servers, I need to mirror a database from one to the other.

Should be straight forward, two servers no witness.

• Both servers are running the same edition of MS SQL Std 2014
• The SQL services are all running under the same domain account
• Domain Account is Local Admin on the SQL Server OSs
• Domain Account is SysAdmin and Public roles on SQL servers
• DB has been backed up and restored from primary to secondary, DB is running on Secondary
• Folder paths are identical on both servers. SQL Instance is installed on D: on both
• Windows Firewall (for the purpose of testing) has a rule to unblock all TCP ports in both directions on both servers.
• Both Databases are in Full recovery model, an compatibility level is 110 (SQL Server 2012)

Mirroring Endpoint has been created on both the principle and the secondary server with t-sql as follows :

CREATE ENDPOINT [Mirror]
STATE = STARTED
AS TCP (LISTENER_PORT = 5022, LISTENER_IP = ALL )
FOR DATABASE_MIRRORING(ROLE = ALL, AUTHENTICATION = WINDOWS NEGOTIATE, ENCRYPTION = DISABLED)
GO

I have tried altering the following switches

ROLE = PARTNER
ENCRYPTION = REQUIRED ALGORITHM RC4

All produce the same result.

A message on the Principle server [CRM-2016-SQL-W] that is identical to this

The server address that is crossed out is TCP://CRM-2016-SQL-W:5022. So the principle server is complaining that it is unable to communicate with the local Mirror Endpoint (as I understand it).

Telnet from all locations (Principle SQL/secondary SQL and elsewhere on the network) all show that port 5022 is accessible on both servers.

If you delete the endpoint port 5022 rejects connections.

I have tested this with port 7022 on both ends and get the same results.

SQL server logs from Secondary show :

Database mirroring connection error 2 'Connection attempt failed with error: '10060(A connection attempt failed because the connected party did not properly respond after a period of time<c/> or established connection failed because connected host has failed to respond.)'.' for 'TCP://CRM-2016-SQL-W.ncp.co.uk:5022'.

Logs from the primary at the same time simply show:

The database Mirroring endpoint has stopped listening for connections
The database Mirroring endpoint is now listening for connections
Service is listening on ['any' <ipv4>5022]
Service is listening on ['any' <ipv6>5022]

I have followed instructions covered here : https://stackoverflow.com/questions/11032937/how-to-resolve-error-1418-in-sql-server-while-mirroring to no avail.

I've left this bit of work to rather the last minute as i had no trouble doing this the last time I did it and now I'm at risk of a slightly embarrassing project meeting tomorrow! All thoughts appreciated.

I have two standalone SQL boxes in a 2 host ESX cluster. At the moment they are running on the same host.

We take nightly backups using Veeam. One of these servers spikes to 90-100% CPU for the duration of the backup. The other doesn't.

I built both boxes, admittedly some time apart, but I'm pretty sure I'd set them up identically. The base disks are running on the same array, separate LUN provisioned as a dedicated SQL vmfs datastore and both are backing up to the same destination. The Veeam proxy is the same for each. Veeam is configured for Direct SAN (and it looks like it's working).

The server that doesn't have poor performance is the box that works the hardest. During the day with nothing special going on it is at a constant 30% CPU. The server we are having problems with will normally sit at a few % of CPU use at equivalent times.

• Both are Server 2012 running SQL 2012 Std
• Both are 8 core
• One has 16GB, one has 24GB RAM (pretty sure this isn't related, we're not seeing swapping/paging issues).
• Both have updated tools running

I'm at a bit of a loss as to how to progress this, I don't really understand what first needs investigating at this point. I've ruled out (in my mind) storage, hardware, network and I can't see what at OS level would be the cause of the issues I see.

I assume there is some interaction between the problematic SQL box and ESXi that isn't happy, but I just don't know where to start.

Any thoughts?

Last weekend a server crashed, during the investigation I noticed that in the immediate run up to the failure we saw a large number of a specific event in the application log. In an attempt to understand what was occurring I attached a task to that event to send me an email if it occurred again.

I've been receiving emails all weekend, some 200 emails received since Friday evening, and they are still arriving.

This morning I've logged onto the server and opened event viewer and I cannot see any new instances of that event in the log viewer.

If i filter by event ID I can see the series of events from last week but nothing since then.

Get-Eventlog shows the same as the GUI viewer, ie no record of these events, and yet I am still getting the emails generated.

Everything else seems to be being logged as expected, as far as I can tell.

This is a Server 2008 R2 box runnin in an ESXi cluster, latest updates etc. Tools is up to date with ESXi (although I am going to move to 10.0.5 I think).

EDIT: WEVTUTIL qe APPLICATION >>ApplicationLog.log

I can now see the logs triggering hte event. Still no idea why these are not showing in the viewer.

A client has a hosted MS CRM 2011 solution, currently running on ~200 workstations within the organisation.

We are currently working through a project to inhouse this version of CRM.

We have an issue in that CRM was previously hosted at

• http://instance1.externalproviderCRM.com/
• http://instance2.externalproviderCRM.com/

and we will soon be presenting it as

• http://crm.ourdomain.co.uk/instance1
• http://crm.ourdomain.co.uk/instance2

I'm hoping (hope for the best...) that a bit of DNS hackery (CNAME) will seamlessly redirect clients from one to the other AND/OR a hosts file entry will do the same.

Its worth noting that the in house version is a standard CRM2011 install with databases imported from the hosting provider. It should be effectively identical.

What I'm worried about (...prepare for the worst) is that this won't work and we will need a method to reconfigure some 200 workstations.

• I understand that an XML file can be used during install to configure the Dynamics CRM client. Is it possible that something similar can be used to do the same on an existing install?

• Is there any other way to mass change a group of CRM clients configuration?

I've got a Server 2012 R2 server with the RDS roles installed.

When attempting to add a new app I'm getting told that the server 'isn't online', despite the fact I am on that same server and am able to launch other applications.

I've narrowed it down to the environment variables not resolving correctly - as per this example:

C:\>ECHO %path%
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\Sybase\SQL;C:\Program Files (x86)\Sybase\Shared\win32;C:\Program Files (x86)\sybase Central 4.0\java;N:\Autoauto\programs\common;N:\Autoauto\


C:\>ECHO %SYSTEMROOT%
C:\Windows

C:\>cd %Systemroot%\system32

C:\Windows\System32>cmd
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\System32>exit

C:\Windows\System32>cd\

C:\>cmd
'cmd' is not recognized as an internal or external command,
operable program or batch file.

I can replace %systemroot% with C:\Windows\ in PATH but I'm not happy that I should have too, why this is happening and that it won't mysteriously come back in the future.

Given that this prevents me deploying new applications and tha tI have deployed a new application in the last 2 months this is a new issue. Google turns nothing up (except someone who had hte same issue with regards to RDS).

Anyone have any thoughts on how this is happening?

A client has an old MSL6030 Tape Library with a pair of LTO4 Ultrium 1840 tape drives in the back. Both have failed.

We have procured identical replacements (same part # anyway) and have been unable to get the library to recognise them. I've installed LTT and everything looked great until a colleague pointed out that the firmware for the new drives is 'B63D/Standalone' compared to the failed drives which are 'B63W/MSL Library'.

I've got a copy of the B63W firmware but I cannot get any of HP's firmware tools to recognise that this firmware needs to be installed on this drive.

Further reading suggested that this drive needs installing into the library, and the library needs to push the updated firware, however I cannot get the library to recognise the drive (probably because of the standalone firmware!?).

I've since created firmware tape but I don't understand the mechanism for writing that firmware back to the drive once the tape is created... HP have this detailed and useful page but that doesn't help.

Anyone know if I can do this or am I wasting my time.

A client of our uses a hosted phone solution for his 50 agent call centre. They use a hosted dialer who make the out going calls, once the connection is made the call is passed to my clients user where they pickup the connection on a 3CX phone interface.

Pretty standard stuff.

The hosting company are claiming that they are seeing 100-200ms latency for all the phones.

On testing a TCP round trip [tcping.exe] I'm getting sub 10ms times. They block ICMP. The hosting provider are saying that this isn't a valid test as the VOIP data is UDP.

I understand that UDP could be being shaped differently or routed differently but it seems pretty unlikely. The hosting IT team are very much 'we have hundreds of customers and their latency is ok, this is your problem' which I can understand but it doesn't help me much. Given that I can't control a UDP listener on their side I don't know how to demonstrate how and where the UDP lag might be coming in.

Equipment on site is a pair of Cisco 2960's connecting to a Draytek Vigor. The Draytek connects to the ISP provided/managed Cisco p887.

Bandwidth use sits at roughly 20% throughout the calling period. All the ICMP tests to external systems show good round trips, generally not beyond 5ms-30ms depending where I'm going to.

Thoughts on how to move this forward?

We have a single standalone 2008 R2 server, running on ESXi 5.5, that provides file shares to clients.

Last night it mysteriously stopped allowing inbound share access. I'm assuming it was blocking/dropping SMB but the problem is, and what concerns me, is that there is no record of what was happening.

As the calls started to come in, I was able to ping and RDP to the server successfully. At the same time attempting \\SERVER\Share as a domain administrator simply hung before coming back that the share was unavailable.

Once I'd connected over RDPto the server, everything appeared normal: RAM & CPU use were low, all expected services were running. Event viewer showed literally nothing of use, no errors just the usual informational entries and a few errors where my RDP session had attempted to map unknown printers.

The security log, where I expected to see a load of 'windows filtering platform dropped packet', which is something we've seen before was clear, just the usual logon events and audit logs.

Connections outbound to other shares were fine, in short I couldn't see anything to fix.

Out of desperation I tried to restart the Server service, at which point the whole box froze and I had to press the (virtual) power button until it powered off. It came back up fine (thank god) but I'm confused.

My client is asking the obvious questions and so far I have, embarrassingly, not been able to provide an answer.

Any thoughts? I have little hope of going back in time and locating a root cause for this issue but is there anything else could be doing as far as logging or future tests for these kinds of issues?

In attempting to answer this question I came up against something that has bugged me for a while, and I have not been able to find an answer for.

The following script block will list the names of all members of the local administrators group.

$group = [ADSI]"WinNT://./Administrators"
@($group.Invoke("Members")) | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}

However it will list only the names, and no other properties.

I'm fairly sure that there are other properties of Members that I could extract but I don't understand how I would go about identifying what those other properties are.

I don't necessarily need to know the additional properties of that item, this is more a question of how I would go about finding them.

(I apologise if this is all a bit vague, I'm very much self taught at all of this and I'm well aware that I might be barking up the wrong tree and/or making regular horrible mistakes.)

I have a windows box that we use for outgoing SFTP transfers. They're all scripted and I use PSFTP with PAGEANT to hold the private keys.

My problem is that over the last 12 months a new partner of this client has added a significant number of new connections each of which they insist upon having a new key pair for.

My problem is that now the connection that uses the last key in pageant gets 8 failed login attempts before finding the correct key on the ninth attempt. The admins at the other end of this have phoned us up and are asking what the problem is as their logs are flagging this as a failed hacking attempt every fifteen minutes, and they will automatically block the connection on the tenth failure.

I've read the putty/pageant documentation but can't see any way to force PSFTP to use only one key in pageant (a switch like -keyno x was what I was expecting to find)

I'm on the verge of re-creating the 'problem' connection and dropping its need for pageant entirely but that requires removing the passphrase from the keypair/including the pass phrase in the script. Whilst this is only sensitive rather than confidential data, we do make certain claims to our clients about security of connections and it includes language that suggests we follow best practice in these kinds of situations, so I'd like to not have to do that.

A client wants a new bit of software. Typically they are on the cusp of signing a contract before they happen to mention it to IT in passing.

A skim through the technical requirements show nothing extraordinary, except that all users of the client/agent software need 'power user' rights to their local machine. This is to be deployed in a call centre where I wouldn't consider the usres to be 'trusted' in the same way as in other parts of the business.

Therefore I immediately baulked at this, however it seems that in Windows 7 power users doesn't do anything.

On XP it gave you 'a bunch of access' and I don't think I know anywhere that its ever been used. I have to admit I haven't even given it a thought since Vista onwards.

Checking secpol.msc on a Win 7 machine, the user rights assignment doesn't show anything associated with power users. However its description would have you believe that "Power Users are included for backwards compatibility and possess limited administrative powers"

Does anyone know what these 'limited administrative powers' actually are?

Microsoft don't appear to have produced any document (i couldn't find one anyway) that details exactly what this group does, and the only detailed technical descriptions I could find all date back to 2003/xp and before.

One of our clients is a Tier 1 PCI company, and their auditors have made a suggestion with regards to us as System Administrators and our access rights.

We administer their entirely Windows based infrastructure of roughly 700 Desktops/80 servers/10 Domain Controllers.

They are suggesting that we move to a system where we have three separate accounts:

DOMAIN.CO.UK\UserWS  
DOMAIN.CO.UK\UserSRV  
DOMAIN.CO.UK\UserDC  

• Where WS is the account that logs on to only WorkStations, is a Local Administrator on WorkStations
• Where SRV is the account that logs on to only Non DC Servers, is Local Administrator on Servers
• Where DC is the account that logs on to only Domain Controllers, effectively a domain administrator account

Policies are then in place to prevent logon to the wrong type of system from the wrong account (that includes removing interactive logon for domain administrator accounts on non DC machines)

This is to prevent the situation where a compromised workstation can expose a Domain Administrators logon token and re-use that against the Domain Controller.

This appears to not only be a very intrusive policy for our day to day operations but also a considerable amount of work, to address what is a relatively unlikely attack/exploit (this is my understanding anyway, perhaps I misunderstand the feasibility of this exploit).

I am interested to hear other administrators views, especially those here who have been involved in a PCI registered company and you experiences with similar recommendations. What are your policies regarding administrator logons.

For the record, we currently have a Domain User account that we use normally, with a Domain Administrator account that we elevate too when we need the additional rights. In all honesty we are all a bit lazy and often just use the Domain Admin account for day to day operations, although this is technically against our company policies (I'm sure you understand!).

Our corporate laptops are restricted to only allow internet access through our proxy (connection profile in Internet Explorer pushed through a GPO). On a remote/3rd party connection this is allowed by creating a VPN back to the corporate network (Cisco VPN Client -> Cisco ASA), at which point the proxy is available and we route all internet traffic through that.

We have recently had the question raised by one of our users who was attempting to use a Wireless connection on a train. The train company requires that the user fills in a form hosted on their own network.

The problem we had was that the user wasn't able to get to the train companies internal page as the proxy wasn't available. They couldn't connect the VPN as they hadn't completed the train companies logon page.

We considered that we could specify this page in the 'bypass proxy for this address...' which would allow a connection to only that page, this was rejected as we would then have to start adding every train company, hotel, public hotspot that works in this way (which must be a list of thousands)

Second suggestion was to allow connections to any local network range (10.* or 192.*) but the implications with regards to security seemed to dangerous. Plus the page offered up by the train company would be http://virginrailwifisignup page and not http://192.168.1.1

At which point we were stumped. The now familiar cry went up in the office "we can't be the only ones who have had this problem" but I haven't been able to find anyone who has mentioned a useful solution.

So I ask you, Server Fault, how have you managed this?

Worth noting, we provide all our mobile users with 3G connections for when they are out and about, they VPN back in over that but its flaky as hell on a train.

I've just noticed that one of our clients SQL servers are syncing against time.microsoft.com, the rest of the domain is looking at ntp.[clients.domain].co.uk, so our SQL servers are about 3 minutes fast.

My argument is that we need to stop all SQL services, on both servers at the same time, update the time service to the domain one and then restart all the SQL services >no less< than 3 minutes later to avoid duplication of timestamps in the databases.

the other argument I've had is 'go on, I'm sure it will be fine'.

Am I being over cautions here? I'm not the SQL admin and in fact the clients SQL servers host a variety of third party DB's so getting reliable answers from them could take some time. Unfortunately this is knocking off the reporting for the call centre out as the DB entries no longer ties up with the phone system, so I'm getting heat from the Call Centre manager and her boss.

I realise that this might be a case of 'it entirely depends on the nature of the databases that you are using' but if thats the case, just some friendly advice?

Thanks, Patrick

So we took over a new client and their file server is frankly a mess.

We have migrated their old file server from a 2k box to a 2k8 DFS cluster and now I'm looking at rebuilding both the folder structure and their permissions. Unfortunately its been half done with AD groups (poorly named/no description/notes) and half with individuals named in security on the folders themselves.

What I'm looking to do is to dump a complete list of all the folders with their security permissions (ideally I'd like to ignore files but not essential).

CACLS got me half way there but fails with an odd error message and its output isn't particularly user friendly and I'm working with roughly 2Tb/250,000 files here so I really need something that gives me a bit more functionality.

Question : does anyone have any experience of something similar/know of a bit of software that might help me out?