Security related items and thoughts
When delivering Copilot for Security engagements to customers, we frequently want to reference external articles, content and news. There is also the occasional squirrel moment due to how my brain operates.
This post is a collection of the various artifacts that we typically discuss. They are all collected into one spot so that it is easier to send out as a curated resource after the engagement h… Read the rest “Copilot for Security Workshop Links”
Starting a setup of Copilot for Security in a demo tenant led to an interesting issue where the expected bootstrap process was not launched. As an eligible administrator, when you navigate to https://securitycopilot.microsoft.com you will either access the previously deployed Copilot for Security (CfS) instance or be prompted to create it. This assumes that you are logged on as either a Global Ad… Read the rest “Unable to Setup Copilot for Security – Can’t get account information”
In a previous post the recommended Copilot for Security setup process was covered. While that is the generally the recommended method, there will be scenarios where the second option will be required. This could be applicable at intial setup and also post-deployment. For example, if the Security Compute Units (SCU) were to be recreated in a different Azure subscription, they can be pre-created … Read the rest “Copilot for Security Setup – Using Azure Portal”
Copilot for Security became Generally Available on the 1st of April 2024 and now everyone is able to spin up an instance of the AI that is designed from the ground up to be used for security tasks!
There are two ways that an administrator can provision and setup Copilot for Security ( CfS ):
Want some updates to go with your updates? That’s pretty much what you are getting with the April 2024 Exchange updates. We can split the features which are part of the April 2024 release into two main areas:
The April 2024 HU is available for the following builds of Exchange Server:
This post was created as I have to rebuild multiple test environments, some of which use AD FS and Web Application Proxy (WAP) to publish Exchange services to the Internet. WAP allows you to publish only the specific Exchange virtual directories required for external access, for example /owa & /ecp along with the others. This means that only those particular paths are then available external… Read the rest “Commands to Publish Exchange Using WAP”
Below is a repro of a customer situation where the Exchange Healthcheck script was unable to connect to a remote Exchange server. The Healthcheck script would run locally with no issues, and reported a clean bill of health. The ability to run the health verification checks against multiple severs is an important aspect of the healthcheck tool, and means that we do not have to RDP to many servers.… Read the rest “Exchange Healthcheck Script– Unable to Connect to Remote Server”
It is possible to add a Domain Based Message Authentication Reporting and Conformance (DMARC) record for your onmicrosoft.com domain in M365.
Is that a good thing?
Well, your viewpoint may depend on your experiences with this domain. If you actually use the onmicrosoft.com domain to send email, then yes! Adding the DMARC record enables the DMARC alignment check to pass and the mail to be successfu… Read the rest “Enable DMARC For OnMicrosoft.com Domains”
Windows has the ability to easily generate a hash for a given file using the Certutil.exe utility. Administrators may have previously used to this tool when they need to generate TLS certificates or to perform other tasks against AD Certificate Services. As an example of the former, this was a common task for AD FS certificates as described in this post.
To generate the file hash we will use the … Read the rest “How To Generate File Hash Using Certutil”
Windows Server 2008 R2 Active Directory added the AD Recycle Bin feature. This allowed for an easier way to recover from an “oops” moment when a small number of objects were mistakenly deleted. The option to perform an authoritative restored remains to recover from mass deletion events. The AD Recycle Bin can be enabled via the AD Admin Centre or AD PowerShell using the Enable-ADOptionalFeature… Read the rest “Quick Tip – How Do I View The Deleted Objects Container”