Below are a series of links to the main Microsoft Defender for Office 365 blog. Shortcuts added here as this is one of my shared bookmarks.
Note that some links have KQL queries and IOCs related to that specific attack.
12-July-2022
Planning to deploy Office 365 and integrate with your on-premises Exchange infrastructure? Great! While running the Exchange Hybrid Configuration Wizard (HCW) will be one of the highlights it should be a boring and uneventful portion of the project. That will be true if all of the required planning, remediation and preparation was done. If not you’ll be finding out about those issues pretty so… Read the rest “Microsoft Teams Source IP Address Used Connecting to On-Premises Exchange”
Rather than kicking it old school and using the classic tools such as AD Users & Computers (dsa.msc) to move FSMO roles, PowerShell makes it nice and easy to get this done rapidly.
In this example we are moving the roles gracefully, but there is also the -Force option.
To start with, let's confirm where the FSMO roles currently reside:
Note that server DC-1.wingtiptoys.ca… Read the rest “Move FSMO Roles Using PowerShell”
When deploying or migrating Microsoft Exchange Server, one critical yet often overlooked component is the Alternate Service Account (ASA). The ASA is used by Exchange to support Kerberos authentication for services such as Outlook Anywhere and MAPI over HTTP, providing a secure and efficient alternative to NTLM. Without a properly configured ASA, Exchange falls back to NTLM. NTLM is an older prot… Read the rest “ASA OOPS – What Happens When It Is Overlooked”
Install the Microsoft Defender for Identity (MDI) sensor onto a newly built DC? Easy you say, and that should only take 5 minutes. Well, if that was the case there would be no need for this post, and as my Dad would say, there is no such thing as a 5 minute job.
The below is a brand new Windows Server 2019 DC. It was built, fully patched and then promoted. Next up is to install the standard Mi… Read the rest “MDI Install Error 0x80070643 Windows Server 2019”
When discussing network configuration for Office 365, there will be a series of issues and challenges that need to be addressed. Ideally this is all done in a proactive manner, with the final items addressed in the POC phase.
One of the cornerstone issues is around how access to and from Office 365 will be managed. This has to address end user access from workstations and publishing your on-premi… Read the rest “The Way Things Were–EOP IP Ranges October 2018”
Back in the year 2014 the post How To Request Certificate Without Using IIS or Exchange was released to help create TLS certificates. One of the main use cases was Active Directory Federation Services (AD FS) as in 2014 it was pretty much a requirement for enterprise migration to Office 365. Password Hash Sync (PHS) and Pass Through Authentication (PTA) were still a twinkle in a developer’s eye….
I… Read the rest “How To Request Certificate Without Using IIS or Exchange–Updated 2022”
Welcome to 2022 and a new release of Remote Desktop Connection Manager (RDCMan) version 2.90!
The Sysinternals blog lists the following changes to RDCMan which are well worth reviewing from a security standpoint.
Receives support for Restricted Admin (/restrictedAdmin from mstsc) and Remote Credential Guard (/remoteGuard from mstsc) and bug fixes.
Below you can see the Security Settings tab with these… Read the rest “Remote Desktop Connection Manager Download (RDCMan) 2.90”
As part of your regular security and operations review, it is important to check and verify the configuration of Azure AD Connect. Ensuring the OS and Azure AD Connect are up to date is one aspect. In this post we want to look at the scope of objects which connect is synchronising. This is valuable for a few reasons. For example:
The below is a reproduction of a customer situation where they moved from a SAN certificate to a wildcard cert thinking that it would be “easy”. The certificate in question was issued from their internal Windows CA and was installed onto Exchange. No issues were noted until they tried to then bind the certificate to Exchange and users immediately started to get errors in their browser. In Chr… Read the rest “Wildcard Certificate ERR_CERT_COMMON_NAME_INVALID”