Active Directory synchronization was designed not just to move objects from on-premises AD to Azure AD, but to give administrators precise control over how identities were matched, transformed, and filtered. This is not a new thing. It dates back to very early days of Microsoft cloud hosted email, both commercial and educational orientated. Azure AD Connect evolved from earlier solutions such as… Read the rest “Azure AD Connect Sync Options”
Self Service Password Reset (SSPR) in Microsoft Entra ID is one of those features that often goes unnoticed until it is urgently needed. It gives end users the ability to securely reset or unlock their account without calling the helpdesk, while administrators benefit from reduced support costs and improved security posture. Ideally users will have to use MFA to perform SSPR. This means that lame… Read the rest “SSPR Screenshots – December 2022”
The November 8, 2022 and later Windows updates address a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation.
This update will set AES as the default encryption type for session keys on accounts that are not marked with a default encryption type already.
To help secure your environment, install the Windows update that is dated … Read the rest “Kerberos Issues November 2022”
Active Directory Federation Services (AD FS) uses endpoints to provide access to features. There are a series of different endpoints which each serve a different purpose from password reset, publishing federation metadata or multiple web services protocols. It is important to ensure that only the required features are actually enabled, and also if those features are to be made available internal… Read the rest “Check If AD FS WSTrust Endpoint Enabled”
Having to host, upgrade and manage WordPress is not really my main job. The various posts over the years will provide a small clue that other things take up most of my time and are my day job. Life was certainly easier when TechNet was still around as a dedicated team ran the MSDN and TechNet blog platforms and provided all of the infrastructure support. All I had to do was write the posts.
Alas… Read the rest “WordPress Linux Web App Poor Performance”
Extended Protection (EP) was added to Windows back in 2009 as a new security feature. This feature enhances the protection and handling of credentials when authenticating network connections using Integrated Windows Authentication (IWA).
The update itself does not directly provide protection against specific attacks such as credential forwarding, but allows applications to opt-in to Extended Protect… Read the rest “Updated Guidance On Exchange Server Extended Protection”
Defining Azure governance so that your subscriptions, management groups is correctly built out and deployed is critical. Even with the best planning sometimes it is still necessary to move resources to a new subscription. While Learn documents how this can be done, it does not work for all scenarios.
Bullet point #5 illustrates an issue where subscriptions may belong to different tenants… Read the rest “Migrate Azure VMs To Separate Subscription”
There was a time when every obscure error code, undocumented quirk, and tricky deployment scenario in the Microsoft ecosystem had an answer, and more often than not you would find it on the MSDN or TechNet blogs. Written by Microsoft engineers, product teams, and MVPs who lived and breathed the technology, these posts were not marketing gloss. They were raw, detailed, and practical. The kind of c… Read the rest “Why Can’t I Search For Content In TechNet and MSDN Blogs?”
There are a multitude of online tools that help diagnose issues with various mail services, but understanding what these tools actually check is valuable. One example is around manually checking published DomainKeys Identified Mail (DKIM) records. DKIM is described in RFC 4871. As an interesting piece of history DKIM went through a previous iteration "Domain-Based Email Authentication Using Pub… Read the rest “How to Use NsLookup To Check DKIM Record”
Extended Protection uses service binding and channel binding to help prevent an authentication relay attack. In an authentication relay attack, a client that can perform NTLM authentication (for example, Windows Explorer, Microsoft Outlook, a .NET SqlClient application, etc.), connects to an attacker (for example, a malicious CIFS file server). The attacker uses the client's credentials to masquer… Read the rest “Exchange Server Extended Protection”