Quest Migration Migration Manager Unable to migrate SID history

One of my colleagues Mark Doyle highlighted an issue with QMMA for Windows Server 2019 and 2022 domain controllers. Without these commands run on the 2019 and 2022 domain controllers the DSA agent server could not successfully migrate user accounts and SID history.

So my colleague Mark Doyle stuck at it , and even the Windows Server 2019 or 2022 firewall may state that it is off, it kind of isn’t.

So to resolve this issue we had run a couple of commands on the new 2919\2022 domain controllers and the problem was solved , so here are the commands.

1.netsh advfirewall firewall add rule name=”Quest Migration Manager Agent” dir=in action=allow program=”%SystemRoot%\System32\AelAgentMS.exe”

2.netsh advfirewall firewall add rule name=”Quest Migration Manager Agent” dir=in action=allow program=”%SystemRoot%\System32\AelAgentMS64.exe”

Now we can migrate SID history with user accounts,

Using the location condition in a Conditional Access Policy

Microsoft have released a new feature in Conditional Access where named locations can be defined by country GPS coordinates. The Microsoft Article can be referenced HERE

Conceptual Conditional signal plus decision to get enforcement

This is a great improvement in protecting against bad actors. A lot of my customers’ often ask me to create a conditional access policy to block access for all countries except Europe, Ireland and the UK. Bad actors could simply use a vpn and then specify what country they are connecting from which can then by-pass the conditional access blocking bad actors based on country IP, where they cannot by pass GPS coordinates

Microsoft Authenticator Password less Authentication

Microsoft are consistently adding new features to Microsoft Authenticator, which have been very well received by organizations that use their cloud services. One of the new features that Microsoft has released is a feature called ‘Password less’

A lot of my pharmaceutical and financial customers love this feature as it improves their security posture. This blog will provide a high level guide on how to enable ‘Password less’

1:The following technical steps describe how to set up password less authentication. To successfully roll out password less in any organization, I would recommend running a pilot, with the IT department and some additional departments, when the pilot phase has successfully come to conclusion, and all feedback from the pilot users has been addressed and remediated, the next step, is a production roll out.

2:When logged into Azure Active Directory, browse to user settings \ user features \ manage external collaboration settings. This feature may be automatically enabled if it is a new M365 tenant

3:Select All in the ‘Users can use the combined security information registration experience

4:It is also possible to use the Microsoft Graph to manage users’ authentication methods to enforce global policies for large organizations’ which will reduce help desk calls and can accelerate the roll out of this new authentication method.

5:Users must register the Microsoft Authenticator app as an authentication method before they can use password less sign-in. If users have already registered Microsoft Authenticator for use with multifactor authenticator, they won’t need to re-register the app for use with password less sign-in.

I always provide easy to follow user guides with screenshots for my customers and my customer’s IT department or communications department to submit to their users’ well in advance of going live with the new password less authentication method.

6:A really important step is to enforce MFA registration policy which is a component of Azure Identity Protection. MFA registration policy is a feature of Azure Active Directory Premium Plan 2 – Identity Protection.

Not all customers can afford the additional cost of Azure Active Directory Plan 2, M365 E5 or M365 A5. An alternative to using Azure Active Directory  Plan 2 is Azure Active Directory Plan 1, Which can be configured to use conditional access policies to enforce the user to register their security information, if they have not signed in previously or before, the new conditional access policies have been applied.

7:In the Azure Portal select Authentication methods in the Security section of Azure Active Directory.

8:Click Microsoft Authenticator in the list of methods.

9:Select a security group that contains your pilot users, When the pilot has successfully concluded, Then the password less configuration can be applied to ‘ALL users’

10:For a single user: Select the …

11:Then click config

12:For the end user and pilot users , they can browse to this location https://mysignins.microsoft.com/security-info  if the ICT admins of the M365 tenant have not already set up Microsoft Authenticator as the as the default sign in method, the end user can select Microsoft Authenticator as the default authentication method.

13:Select Passwordless

14: Next step is to sign into https://aka.ms/mfasetup

15:Set up Microsoft Authenticator

16: Continue setup

17:Within the Microsoft Authenticator application, select add a Work or School account and choose the option to ‘Scan the QR code’

18:The next step is to hit continue as per image below

19:So how does password less work, when an end user wants to authenticate a six digit code is sent to the Microsoft Authenticator application, and the end user must enter the six digit code, and then authenticate via bio metric thumb print or pattern.

20:The end user may receive the error displayed below, if they have multiple organizations’ set up with MFA hosted on their Microsoft Authenticator application. Like myself working in IT, I have many customers registered in my Microsoft Authenticator application.

21:Didier Van Hoye describes the issue perfectly in his blog post

22:In a green field site, Password less is a very well received as a new method of authentication and to protect organizations’ identity. It takes end users a little bit of time to become familiar with password less authentication, but once they are familiar with this authentication method, they find it a lot easier than traditional passwords and it improves an organizations’ security posture.




How to assign Microsoft Defender for EndPoint Policies

The first task is to assign a security group with all users in scope for Microsoft Defender for Endpoint via Azure Licensing Mnagement.

The second part is to apply the policies to a group of users. The syntax below can be used to create an Azure Dynamic user group which will auto populate based on whether a user has a license for Microsoft Defender for Endpoint.

user.assignedPlans -any (assignedPlan.servicePlanId -eq “111046dd-295b-4d6d-9724-d52ac90bd1f2” -and assignedPlan.capabilityStatus -eq “Enabled”)

How to begin your data classification journey

The container and content classification graphical representation above represents a high-level starting point around formalizing your data classification requirements. Microsoft have created an innovative solutions suite around data protection that is scalable for small, medium and enterprise requirements.

In some Sectors data classification has already been implemented and applied as part of the general operational procedures to support regulatory compliance (i.e., Pharma and Finance).

Since data classification has been established, it has been expanded to 204 different sensitive information types as defined by Microsoft in compliance.microsoft.com

Policy creation can be created easily to protect personally identifiable information via DLP (data loss prevention), classification and retention policies by using these sensitive information types that Microsoft provide as part of their Office365 platform.

Regex101.com is a free utility that provides the ability to create regular expressions (regex) and test the regex against input of a sensitive information types.

As an example, to implement – within the Office365 platform, Microsoft only provide three sensitive information types applicable to Ireland:

  • Ireland Driver’s License Number
  • Ireland Passport Number
  • Ireland Personal Public Service (PPS) Number

There is however some more common sensitive information type unique to Ireland as follows:

  • Eircode
  • Mobile phone number
  • Landline phone number

Regex101 also provides a regex library to cater for a particular sensitive information type.

The European Union caused quite considerable anxiety when the GDPR regulation was released during 2018.

The GDPR regulation’s primary purpose is to provide individuals control over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

Regrettably, this regulation does not protect an organization’s intellectual property.

Use cases listed below could however enable organisations to protect their intellectual property more effectively:

  • Food Industry: Using document fingerprinting and if working for Coca Cola or Guinness and an employee attempts to leak the secret recipe. Office365 can prevent this.
  • Manufacturing Industry: If a patent or manufacturing process were attempted to be shared outside the organization to that organizations’ competitors, it could cause the source organization to lose market share or cease to exist. If an employee sends an email with 100 mobile phone numbers or 100 land line phone numbers, this could be classed as data exfiltration and the employee is leaking their employers’ customers information to a competitor.
  • Technology Industry (Nokia, Ericsson or Huawei): may invent the next Wi-Fi standard and before the company that invents the technology registers the patent for this new technology and the information is leaked to one of their competitors, it could cause billions in lost revenue.
  • Legal industry: GDPR in certain scenarios can mandate that data is deleted after 7 years. This can really suit legal organization’s as they are no longer liable if the data has been permanently destroyed via a retention policy.
  • Pharmaceutical Industry: The first company that manufactures a permanent vaccine for Covid 19 and all Covid variants that successfully patents the solution would not like their intellectual property falling into the hands of their competitors.

AIP (Azure Information Protection) scanner is generally the initiation point of data classification as it can scan file shares and on-premises SharePoint farms. To prove the benefit of data classification, define some sensitive information types for an organization. Use AIP scanner to integrate with an Azure Log Analytics workspace and then demonstrate to an organization, how much of their critical intellectual property is not protected.

The basic overall implementation approach to enable data classification is as follows:

  • Monitor
  • Provide Tips
  • Protect.

AIP scanner can auto classify data, depending on the organization’s Office365 license plan, but this is all useless unless the organization has begun their data classification journey. Obviously sharing a credit card number is the most common instance of data loss prevention, but what about protecting critical intellectual property for an organization.

Another use case is when an organization has already begun their data classification journey with another vendor like Forcepoint, Symantec or McAffee. If Office365 is in the organization’s roadmap then it is easy to transfer all the custom sensitive information types and regexs’ into Office365. Regex is a universal standard and works across all vendors.

Cyber Attacks are most commonly associated with phishing attacks and most commonly performed by BOTs on the dark web, however in a targeted attack and when the bad actor’s are trying to specify the exact information they are trying to steal from an organization, if this information is classified then there is a very strong chance the bad actors attempt to steal the information will be unsuccessful and the attack will generate alerts and notify the security admins of an organization.

Microsoft have also introduced some new technology: trainable classifiers. Trainable classifiers introduce the power of Azure and AI (artificial intelligence). An organization can choose not to classify their data but let a trainable classifier analyze their data and then report on all the known sensitive information types defined in an organisation’s Office365 tenant.

A Microsoft 365 trainable classifier is a useful tool you can train to recognize various types of content by giving it samples to look at. Once trained, you can use it to identify information for the application of Office sensitivity labels, Communications compliance policies, and retention label policies.

Source: Get started with trainable classifiers – Microsoft 365 Compliance | Microsoft Docs

The security component to complete the overall Microsoft suite was lacking but has been resolved by Microsoft releasing Microsoft Defender for EndPoint. Microsoft Defender for Endpoint integrates seamlessly with MCASB (Microsoft cloud app security broker) and enforces corporate security policies for devices that are not connected to the corporate LAN – which is a likely scenario, during the current Covid-19 Pandemic.

Exchange 2016 CU20 ECP\OWA not available

After a clean successful installation of Exchange 2016 CU20 and reboot on completion of the installation. I was presented with the following error when trying to login to the ECP and OWA.

###########################################################

Now this was a unique scenario. There were two Exchange 2013 production servers patched to the highest level and each Exchange 2013 server had a certificate issued from an internal certificate authority, the certificate included all of the required subject alternate names, but the certificate was also acting as the Microsoft Exchange Server Auth server on the Exchange 2013 servers and included .local domain names.

The design decision to introduce Exchange 2016 to the environment was purely to act as an Exchange Hybrid and not touch the production Exchange 2013 servers.

I installed Exchange 2016 CU20 with April 2021 security patches and got the errors listed above. Exchange Management Shell access was fine. I decided to install an additional Exchange 2016 CU19 server to see if CU20 was buggy. But unfortunately I received the same error on the fresh build of Exchange 2016 CU19 server.

The Exchange 2016 servers did not have rights to the private key of the certificate issued by the internal certificate authority that was in use by the Exchange 2013 servers as the Microsoft Auth Server certificate and the Exchange 2016 servers picked up this cert by default as it was in use in the existing Exchange organisation.

So how did i resolve this issue??

Firstly I created a new Microsoft Server Auth certificate with the following commands

New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName “CN= Microsoft Exchange Server Auth Certificate” -DomainName “*.contoso.com” -FriendlyName “Microsoft Exchange Server Auth Certificate” -Services SMTP

$date = Get-Date

Set-AuthConfig -NewCertificateThumbprint <certificate_thumbprint> –NewCertificateEffectiveDate $date

Set-AuthConfig –PublishCertificate

Set-AuthConfig -ClearPreviousCertificate

IISRESET

Powershell Commands Ref this article

The next thing was to export the newly created certificate and import the certificate into the computer trusted root certification authorities location on each Exchange server.

Next we need to review and run the commands described in this Microsoft KB

Next we rename the sharedwebconfig file in the following directories to sharedwebconfig.bak.
C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy

Then follow the steps in this Microsoft KB

But replace the environmental variable in the two commands specified in the article ‘%ExchangeInstallPath%’ with the actual install path as the install path can change from the default locations defending on the Exchange build and the environmental variable ‘%ExchangeInstallPath%’ may not resolve in the Exchange management shell.

Run the commands and then restart the server and all should be fine , at this point you can import a trusted certificate like DigiCert and assign IIS & SMTP services to the certificate.

And run a health check on the Exchange 2016 server and – Get-ServerComponentState

Phishing Email

Quite a nasty phishing email that sailed past Mimecast and Microsoft Defender for ATP.
It brings the user to a site and the the end user clicks on another link to listen to their voicemail and this is when the payload is delivered and it can perform the following malicious acts

Copy cached credentials
Modify Outlook Rules
Infect the entire global address list
Attempt data exfiltration via One Drive for Business

Phishing email displayed below , Careful folks. End user security awareness training is the best defense against the phishing emails that get through and breach your message hygiene services.


Conditional Access Insights and Reporting

Conditional Access Schematic

One of the most desirable Conditional Access policy controls is to only grant access to cloud applications if the Windows 10 devices are Azure AD Hybrid joined.

To ensure all Windows 10 devices are Azure AD Hybrid joined can be quite tricky , It is not as simple as enabling Azure AD Hybrid join in the AD connect wizard and simply synching an organizational unit that contains all of the Window 10 machines

The Windows 10 devices must be able to communicate with the Microsoft Office365 and Intune endpoints.

Microsoft Azure AD Conditional Access Policy – Report Mode only has been available for some time, however trying to demonstrate and analyze the impact of enabling the new conditional access policy was quite difficult when trying to review the activity for the new policy in the Azure AD sign in logs or even via a csv export of the policy activity.

Microsoft released Conditional Access Insights and Reporting : Overview and setup available HERE Power BI can also connect to the Log Analytics workspace to create custom dashboards if required.

Now when attempting to review conditional access policies in report mode only and in this example the policy is a report mode only if devices were blocked from signing in unless they were Azure AD Hybrid joined.

The impact summary is simple to read and break down

The next page summarizes user sign in details and which users would be impacted most by enabling the policy and then allow IT administrators to take action and get the users \ devices compliant before enabling the policy.

How to migrate Teams Sites from Office365 tenant to another Office365 Tenant using Migration Wiz

This image has an empty alt attribute; its file name is image.png

I have been working very closely with BitTitan for a number of years and BitTitan have been working very closely with Microsoft with the development of their Teams migration service.

The service was updated towards the end of August and this update brought a large number of enhancements which can be reviewed HERE

For years I have been migrating Office365 Tenants to other Office365 tenants and the problem still remains whereby a custom domain like contoso.com cannot exist in two Office365 tenants at once. So during acquisition or merger migration projects at what point do you migrate the Microsoft Teams sites. My recommendation is to take care of the following data sources first with the Migration Wiz user migration bundle.

Primary Mailbox
Archive Mailbox
OneDrive for Business
Outlook switch over via deployment pro.

Once the data sources above have been migrated , I would recommend that Outlook Web App access to the legacy source tenant mailboxes is blocked via running the following command

Get-Mailbox -resultsize unlimited | Set-CASMailbox -OWAEnabled $false
Get-Mailbox -resultsize unlimited | Set-CasMailbox -ActiveSyncEnabled $False

The official MigrationWiz migration guide is available HERE
Also follow this ARTICLE and setup the  Teams-FullControlApp in each source tenant.
I recommend that you use the autodiscover method to populate the project as this will also identify any incompatible items in Teams sites or channels

First step is to create the teams site in the target tenant , and do this 24 hours in advance

What_will_be_migrated_Teams.png

Next Step is to do the data migration

Validate the data and then remove the Teams licenses from the users in the source tenants with the following powershell commands. Create a new variable for each Offfice365 licensing sku that contains Teams.

Get-MsolAccountSku

$acctSKU=”contoso:O365_BUSINESS_PREMIUM”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

$acctSKU2=”contoso:TEAMS_EXPLORATORY”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

$acctSKU3=”contoso:O365_BUSINESS_ESSETIALS”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

$acctSKU4=”contoso:O365_BUSINESS_ESSENTIALS”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

Get-MsolUser | Where-Object {$_.licenses[0].AccountSku.SkuPartNumber -eq ($acctSKU).Substring($acctSKU.IndexOf(“:”)+1, $acctSKU.Length-$acctSKU.IndexOf(“:”)-1) -and $_.IsLicensed -eq $True} | Set-MsolUserLicense -LicenseOptions $x

And now all the Teams sites have been migrated and there is no chance of split brain because the Teams license has been removed from the source tenanat.

One really important point to note: MigrationWiz match users from the source to the destination based on the user prefix which is so useful when you are moving one domain from an Office365 tenant to another for example in a merger or aquistion.


How to delete Teams Chats and Meeting Chat Moderation Settings

A customer recently asked me how can we delete chat history in Microsoft Teams and the answer was really simple. Provided the tenant has the correct Office365 licensing. The solution was to create a retention policy and delete all chat history older than 1 day.

How to delete Teams Chats and Meeting Chat Moderation Settings

https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=67175