u/pidge_nz

I came across SMTP2Graph, for relaying via Exchange Online where a SMTP client can't do SMTP authentication itself, let alone get an OAUTH token from Entra ID. I've not had a chance to give it a spin.

Update the RemoteIPRanges property of the "Default Frontend" Receive Connector of each Exchange server to just be the Exchange Online SMTP ranges, 127.0.0.1 and the IP addresses of the Exchange servers.

And a binding for TCP 25 to the Client Front End connectors

e.g.

# Get the current remote ranges of the Defaulf Front End connectors
$OldDefaultFrontEndRemoteRanges = Get-ReceiveConnector | ?{$_.name -like "Default Frontend *"} | Select Identity, RemoteIPRanges
$OldDefaultFrontEndRemoteRanges

#Get IP Addresses of Exchange Servers
[string[]]$ExchangeServerIPs = (get-exchangeserver | %{resolve-dnsname $_.name -ErrorAction SilentyContinue}).IPAddress

#Get the Exchange Online Protection IP Addresses from the M365 Endpoints JSON file download
$EXOProtectionIPs = ((invoke-webrequest https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7).content | convertfrom-JSON)|%{$_}|?{$_.tcpports -eq "25"}|select -ExpandProperty IPs

#Build the new remote IP Ranges and review
$NewRemoteIPRanges=$ExchangeServerIPs + "127.0.0.1" + $EXOProtestionIPs
$NewRemoteIPRanges

#Set the new Remote IP Ranges
Get-ReceiveConnector | ?{$_.name -like "Default Frontend *"}|%{Set-ReceiveConnector $_.Identity -RemoteIPranges $NewRemoteIPRanges

#Update the bindings of the Client Front End Connectors
$OldClientFrontEndBindings= Get-ReceiveConnector | ?{$_.name -like "Client Frontend *"} | Select Identity, RemoteIPRanges
$OldClientFrontEndBindings

$NewClientFrontEndBindings=$OldClientFrontEndBindings+"0.0.0.0:25"+"[::]:25"
$NewClientFrontEndBindings

Get-ReceiveConnector | ?{$_.name -like "Client Frontend *"}|%{Set-ReceiveConnector $_.Identity -Bindings $NewClientFrontEndBindings

Synched accounts don't have the Entra ID Password policies applied by default.

But there's this to flag the user to change their password at next sign in, and revoke their current sign in sessions to make it happen:

$User = Get-MGUser -Filter "userprinciplanename eq '[email protected]'"
$PasswordProfile = @{ForceChangePasswordNextSignIn = $True}
Update-MGUser -UserID $User.Id -PasswordProfile $PasswordProfile
Revoke-MgUserSignInSession -UserID $User.Id

Note: User who use Password-less sign to sign in don't get prompted to change their password, as they don't use their password to sign in.

A Scheduled Task running as local system is the way I would do this for the changes that need to performed by an an administrator of the computer.

If the devices are AD Domain joined. you can push the scheduled task using a GPO Preference, but you need to edit the XML for the Scheduled task in the GPO to alter the mention of the "interactive" logon type. Have the script set a registry entry or add file that the GPO Preference filtering can check for to add the scheduled tasks if it's missing, and to remove the scheduled task if it's present.

A EXO Mailbox of 70GB indicates the use has EXO Plan 2, which comes with the 1.5TB Archive Mailbox.

Discuss with the user about enabling the Exchange Online Archive for them, and the Retention Policy applied to the mailbox - the default is to Archive email older than 2 years old (move it to the Archive Mailbox).

The Managed Folder Assistant will eventually move the old items to the Online Archive once the archive mailbox is created. Give it a hurry up with "Start-ManagedFolderAssistant <email address>".

In a pinch, if the drive to be wiped is attached as an additional drive (not the OS drive) to a computer running Windows 10 or later (maybe Windows 7 or later). Maybe able to do this with the Command Prompt recovery options in a Windows Install USB if you are wanting to wipe the SSD with the OS.

1. If the drive is not partitioned with a single partition, create a single partition that occupies the entire drive and assign a drive letter.
2. Quick Format the partition with NTFS.
3. In an Admin Command Prompt, run defrag to perform Slab consolidation (/K) and ReTrim free Slabs: (/L)

​

defrag <drive>: /K /L

Retrim will mark all the physical blocks in the free slabs on the partition as free. Leave the computer on to allow the SSD to actually erase the freed blocks.

The only blocks that will not be erased will be the blocks that are in the same slab of the partition table of the drive, and the slabs with the directory, journal and other structures of the empty NTFS volume.

"If it's stupid and it works, it's still stupid and you're lucky" - Maxim 43 of The Seventy Maxims of Maximally Effective Mercenaries

If the Entra ID Connect or Cloud Connect is in Exchange Online Hybrid, but Exchange was uninstalled from all the Exchange Servers, you are probably in an unsupported state - once in Exchange Online Hybrid, the AD Forest must keep the Exchange On Prem Org configuration. Uninstalling Exchange server from the last Exchange server removes the Exchange Org from the AD Forest, but you also lose the ability to manage recipients in AD.

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange

Use Entra ID Connect or Entra ID Cloud Synch to sync from the multiple domains / forests to the one Entra ID Tenant.

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync

Entra ID Connect is more flexible, excepting the need for the server running the sync needs line of site to a writeable domain controller for each domain (that's the "Connect to multiple disconnected on-premises AD forests" item). And having two or three servers - one performing the sync, the others just keep track of the changes, ready to become an active server if necessary.

I am running an environment of two forests with ~6,200 staff split across the two, with Entra ID Connect for the sync with Entra ID, soon to be one after I manage to move the last 2 or 3 applications using service accounts from the AD forest to be binned. I have the following additional attribute transformations in Entra ID Connect
* AD "Country" is projected to "Usage Location"
* AD "Country" is projected to "Prefered Data location" for staff (account has employeeID) in a specific country.

Started at 7:27am NZST for some user of our users:
* AD FS/Admin log, event ID 364, "The selected authentication method is not available"
* AD FS Tracing/Debug log, event 200, "GetAvailableAuthenticationMethods, authenticationMethod:WasNull") (you need to make the Analytics and debug logs, then enable the ADFS Debug log)
* (Windows Server 2022)

Then all failed from shortly after 10:13:30am NZST
* Time of last successful auth for Resource Id = adfs in Entra ID User Sign in log

There was a gap in adfs sign in events until 12:29:53pm NZST in Entra ID User Sign in log

Move all the Domain FSMO roles to the designated last DC early on in the process.

Check for use of accounts from the childdomains on directly on computers in rootdomain.corp - any reference to an account on a child domain will cause delays in resolving when you shutdown the DCs for the childdomains before completing the demotion, and some applications that follow trusts for whatever reasone will stall due to needing to wait for the TCP timeouts to contact the DCs that are discoverable via DNS, and without DNS, timeouts due to waiting for broadcast name resolution to timeout. Prevnting DNS discovery by removing the A records for the childdomains name, and the DNS service records in in _msdcs and _tcp, _udp child zones of those zones might eliminate that delay.

Check applications are not referencing the domains directly (e.g. performing LDAP queries against the domains), and be wary of ones that leverage the trusts. Check the DomainLocal groups in rootdomain.corp, and where they might be used.

The user account running the demotion of the Last DC will need to be a Enterprise Admins to do that change, as Forest information needs to be updated.

Demoting the last domain controller for each of the domains will remove the transitive trusts between the child domain the root domain. If an External (shortcut) Trust had been manually added between the two child domains, you will likely need to remove that.

DNS - if the DNS zones for domainDecom1.rootdomain.corp and domainDecom2.rootdomain.corp are going to remain e.g. preserve access to resources using those names, I'd make sure to remove the _msdcs child zones and review the _tcp and _udp zones service records that refer to domain controllers e.g. _ldap, _kerberos, perhaps.

I've removed one Tree Root domain from a forest, the main problme was that it wasn't possible to just shutdown all the DCs for the domain and see what broke, something just ended up being really slow as specific applications insist on checking all trusted domains, or domains they are aware of, and the TCP connect timeouts accounted for the delays. Removing the DNS records (A records for the bare domain name, _msdcs, and _ldap, _kerberos), and making sure NBT Broadcasts are not being used to resolve names may help reduce the dealy with those trusts references being followed. Insist the application owners check their applications for references to the individual domains.

My process for DCs:
1. Schema Prep, Domain Prep in advance
2. Build servers/VMs in preparation to have be promoted to DCs
3. Promote the new DCs.
4. Prepare for swaps for IP addresses for services like NPS (copy config from the DC to be replaced) or DHCP (Scope Replication, or DHCP backup / restore) etc.
5. Swap IP addresses between old and new in an orderly manner. For FSMO role holder(s), move the FSMO roles to a new DC that has had the IP address swap completed.

To swap the IP addresses between old and new:
1. On the old server, update its DNS Client settings to use other DCs for DNS
2. Add a new IP address to the old server.
3. Reconnect via RDP to the old server on its new IP Address, and remove the old IP address
4. Wait for DNS to settle (this can take some time). If the old server is a DHCP server, backup the DHCP database at this point.
5. DNS sync can be forced by "Update DNS Server files" in DNS admin on the server which is the DNS server for the old server, and then repadmin to force cross-site replication of the appropriate AD Partition with the DNS zone.
6. Repeat the DNS change on the new server, with the new IP added being the IP address removed from the old server.
7. Once the two servers have the DNS records consistent on the DNS servers, update their DNS client settings to point to themselves and a sufficent selection of other DCs (I'm assuming DNS server is on the DCs)

Finally move FSMO roles to the desired new DC, if the one used during the IP address swaps is not the intended long term holder.

Check the model label on the bottom of the Deco units. IIRC, the version printed on the label is the hardware version / revision, not a firmware version.

Create a "Service account", assign it SharePoint Online Plan 2 licence, provision the OneDrive for it, set the quota for the OneDrive for the Account to 4.5TB, copy the offboarded users' OneDrive content to it, purge the offboarded OneDrives.

For annual leave, sick leave or public holidays, you are not working in any capacity.

If you are on call, you are working, even if there's nothing to do during the normal work hours.

If you are on call on a public holiday, you are paid for the day, get the day in lieu, and can claim the extra 0.5 time for any actual time worked during hours, and 1.5 time for time outside of hours.

Or at least that's how it's been where I work.

The Docsis 3.0 modem has a maximum throughput of 343Mbps, the limiting factor for throughput is likely conjestion and signal quality. A better modem could improve the maximum throughput, but your will still be competing with others for bandwidth on the cable.

The Archer c54 ac1200 only has 100Mbps ethernet ports, so that's going to cap the hardwired throughput to 100Mbps, and if you have the c54 operating in router mode, that could explain the 45Mbps throughput on wired.

I'd replace the c54 with a wifi access point with gigabit ethernet ports. If you are looking for a mesh system, I'd pick one that can use a wired link between the nodes.

A wired connection from the xbox to your router (not the Deco) to confirm it's the Decom being the problem. If it is the Deco causing the problems, and you were using a wifi connection with the XBox, stay with a wired connection. if you need to use a wifi connection, change the Deco to Access Point mode, and make sure the Xbox is using 5Ghz.

Just spent a hour helping a friend troubleshoot this.

The problem started after he'd installed the October 2024 Windows 11 Updates on his HP Victus Laptop.

I finally tried plugging in a external monitor and closing the laptop lid - and then Unreal Editor would launch without crashing.

I then tried disabling the Intel UHD Graphics Display Device in device manager, and Unreal Editor would launch with just the Laptop display.

Reviewing Windows Updates, I saw that the Intel UHD Graphics driver (from August 2024) had been installed by Windows Update.

TL;DR: Use an external monitor with the laptop lid closed, or disable the Intel UHD Graphics driver to use the laptop display.

RGBI is useful for a C128

Odd. I've never had an issue on Orcon, ADSL or Fibre. 2degrees Mobile for anything other than a cheap plan for calling and text? Nope!

I know of a "hold my beer" for that one: someone relocated a DEC Alpha between nearby offices while it was running by putting into the back of station wagon with its UPS.

The update came to late for my i7-13700K, it's replacement is currently on it's way to me from Intel - my RMA request sailed through without fuss.

I suggest using Entra ID Domain Services, and a Site-to-Site VPN so the on Prem servers can be joined to a domain, but leave all of the domain bits to Entra ID.

I agree, it's the one thing you need to get right. I listed options, my preference is to use the a registered alternate TLD variation of the organisation domain name, then than the subdomain of the domain used for your email addresses, to avoid needing to finagle split DNS to support Trusts. It should be unlikely that there will ever be a need for a AD Forest Trust, so .local, .ad etc. can work if you understand the restrictions, and there's a business acceptance of the constraints that places on the AD Trusts - thank you for expanding on that.

UPN Suffix = email address suffix = less confusion for users - Entra ID prompts users for "Email, phone or Skype", but it's actually asking for "UPN". OneDrive URL is built from UPN by SharePoint, but some apps seem to use email to generate the user's OneDrive URL some reason - it was a problem we had early on in shifting to M365, some users had UPN and primary email address mismatches (to the point that one account had a UPN with a specific localpart, and a different account had it for the email address!). Remote Desktop Gateway explicitly asks for NetBIOS Domain\username, though UPN may work. UPN with different domain than AD needs split DNS for _tcp.domain and _msdcs.domain zones and records creating with the SRV records pointing to the appropriate servers for the AD Domain, though CNAME records seem to work to avoid needing to maintain the SRV records in the UPN domain. Mostly just tedious to set up and maintain through DC replacement.

The org I work for uses .local for the Forest Root, then a .net.<country> for the "tree root" User and Resource Domain. One subsidiary of the company in a different country built a different .com.<country> single domain forest, but used the same NetBIOS name as the parent company's User and Resource domain :| . I'd fixed that with a Intra-forest migration in the parent company domain over a decade ago, and now we're in the end game of emptying out the subsidary's domain after acquiring the actual .com domain and adding that as a UPN suffix to the parent company's UPN suffixes, so staff no longer have a country specific primary email address. Bugger migrating AD domain just to use a new UPN suffix!

If it's a non-profit, they can probably get Microsoft 365 Business plans very inexpensively, which includes subscriptions for desktop MS Office Professional, 1TB OneDrive per user, Teams, Mailboxes, etc, and the Premium plan includes Intune Device management. Lots to get your head around.
https://www.microsoft.com/en-us/microsoft-365/enterprise/nonprofit-plans-and-pricing

AD only helps if there are applications that only work with AD, but the AD and the hardware it is running on needs locking up well away from meddling fingers.

With an AD domain, the DNS and NetBIOS name of the AD domain is one item you can't change easily (and if you have Exchange servers, you can't change it). Nearly everything else is just configuration you can change.

Don't use the public DNS name, use a subdomain, or an alternative name (e.g. if you can register the .net name, use that), or use "<org name>.local" or "<org name>.ad", and then add your "<org name>.org" registered public DNS name as an "additional UPN suffix"

You will need two servers / VMs being the AD Domain Controllers, one per site minimum. If a site will have an Exchange Server, you will need two Domain Controllers in that site.