1

How To Request Certificate Without Using IIS or Exchange–Updated 2022

Posted on by Rhoderick Milne [MSFT]

Back in the year 2014 the post How To Request Certificate Without Using IIS or Exchange was released to help create TLS certificates. One of the main use cases was Active Directory Federation Services (AD FS) as in 2014 it was pretty much a requirement for enterprise migration to Office 365.  Password Hash Sync (PHS) and Pass Through Authentication (PTA) were still a twinkle in a developer’s eye….

I… Read the rest “How To Request Certificate Without Using IIS or Exchange–Updated 2022”

0

Remote Desktop Connection Manager Download (RDCMan) 2.90

Posted on by Rhoderick Milne [MSFT]
RDCMan 2.90

Welcome to 2022 and a new release of Remote Desktop Connection Manager (RDCMan) version 2.90!

The Sysinternals blog lists the following changes to RDCMan which are well worth reviewing from a security standpoint.

Receives support for Restricted Admin (/restrictedAdmin from mstsc) and Remote Credential Guard (/remoteGuard from mstsc) and bug fixes.

RDCMan Version 2.90

Below you can see the Security Settings tab with these… Read the rest “Remote Desktop Connection Manager Download (RDCMan) 2.90”

0

Review Azure AD Connect Synchronisation Scope

Posted on by Rhoderick Milne [MSFT]
Review Azure AD Connect Synchronisation Scope

As part of your regular security and operations review, it is important to check and verify the configuration of Azure AD Connect.  Ensuring the OS and Azure AD Connect are up to date is one aspect.  In this post we want to look at the scope of objects which connect is synchronising.  This is valuable for a few reasons. For example:

  • Many folks have installed Azure AD Connect did configured any filt
… Read the rest “Review Azure AD Connect Synchronisation Scope”
1

Office 365 Autodiscover Lookup Process–Revisited

Posted on by Rhoderick Milne [MSFT]

Previously we looked at the Office 2010 client and how it used Autodiscover to detect Exchange Online (EXO) mailbox settings.  Outlook 2010 is no longer supported, so it is worth updating these notes for a current build of Outlook.

As with the previous post, this is intended as a point in time reference as I personally find it handy as an ongoing reference.  In the updated example below a fully patc… Read the rest “Office 365 Autodiscover Lookup Process–Revisited”

0

Change Certificate Friendly Name To Unique Value

Posted on by Rhoderick Milne [MSFT]

Imagine that you have two certificates installed, but for whatever reason the same friendly name was used for both of them.  You can certainly identity each of them by comparing the valid from/valid to dates or the thumbprint.  That adds just a little extra overhead that you may not want to deal with.

As an alternative, you can modify the friendly name  to a more suitable value.  This allows you to… Read the rest “Change Certificate Friendly Name To Unique Value”

1

IIS SMTP Virtual Server Component No Longer Supported

Posted on by Rhoderick Milne [MSFT]
IIS SMTP Component Not Supported

Please consider this a quick PSA (Public Service Announcement) as it is still common that I run into environments with the IIS SMTP service still running and processing mail.

While the component has had a long and interesting life, it is now unsupported as it is tied to the support lifecycle of Windows Server 2003.

For more details and information please see:

How to: Install and Configure SMTP Virtua… Read the rest “IIS SMTP Virtual Server Component No Longer Supported”

10

Sign-In Error 5000811 — Unable to verify token signature. The signing key Identifier Does Not Match Any Valid Registered Keys

Posted on by Rhoderick Milne [MSFT]

The error message "Sorry, that didn’t work. Please go back to office.com and try again” is probably one of the most vague that I've seen.  It's up there with "please contact your administrator", which is fine unless you are the administrator...

The below is a repro of a case where all users were unable to sign into Office 365.  They would receive the aforementioned "Sorry, that didn't work" message… Read the rest “Sign-In Error 5000811 — Unable to verify token signature. The signing key Identifier Does Not Match Any Valid Registered Keys”

0

Why Is The Exchange Security Update Not Installed?

Posted on by Rhoderick Milne [MSFT]

The issue of "Why is the Exchange Security Update not installed?" has popped up frequently over the last few months due to the number of security releases for on-premises Exchange.

Due to Hafnium, security teams have increased the monitoring of Exchange to make sure that it is fully patched.  In some of these cases, the Exchange and server admins think that they are all good as they run Windows Upd… Read the rest “Why Is The Exchange Security Update Not Installed?”

0

Does Manually Running Azure AD Connect Change Schedule?

Posted on by Rhoderick Milne [MSFT]

Despite the current versions of Azure AD Connect running the main synchronisation task every 30 minutes, there are still times when we want to force the task.  As a result of this, a question was floated if that changed the existing schedule.  If the next scheduled instance is in 10 minutes, and we run a manual task right now does that mean that another task will execute in 10 minutes?

TL;DR

In shor… Read the rest “Does Manually Running Azure AD Connect Change Schedule?”

9

AD FS Web Application Proxy Re-Establish Proxy Trust

Posted on by Rhoderick Milne [MSFT]
WAP Re-Establish Trust

In the Tailspintoys environment the AD FS Proxy was offline for month.  It was unable to contact the AD FS server on the internal network, and this allowed the short lived authentication certificate to expire.  At this point the AD FS Proxy was "dead to me" as far as the AD FS server was concerned.  The internal AD FS server was OK, the issue was just with the proxy.

Bummer....

How do we fix this?  … Read the rest “AD FS Web Application Proxy Re-Establish Proxy Trust”