Exchange 2016 CU15 -> CU17 update error

August 3, 2020August 3, 2020 Mark GerlowLeave a comment

Hi there,

So, I’m back from vacation, well rested and ready to write 😁

This is just af quick one about a problem I had at a customers Onprem Exchange 2016 installtion (That I actually build for them a while ago)

I recently had to patch a customers Exchange 2016 DAG (3 nodes), from CU15 to CU17. Normally thats not a big deal, but for some reason, I got in to trouble on the last Node. (Why is it always the last one, late at night? 🤔)

First 2 Nodes, went smoothly, but just took a looong time 😴

When I started the CU17 update on the last Node, this was its answer 😲

I could see that the whole \BIN library was missing, and it was there on the other 2 servers 🤔, just couldnt figure out what was going on, and why it wasent there.

Well instead of boring you with all the resaerch I did, I’m just gonna jump to the solution👍.

The Solution…

I mounted the CU15 update .ISO and, it went on saying, that there was an ufinished installation of Exchange on the Server, and that it was gonna try and fix it for me.

(Sorry for the really bad pic, but something went wrong😒)

After that was done, copying files, i rebooted the server, just to be safe, and went on, mounting and running the CU17 update succesfully and problem solved.

Launch Teams app when clicking “Join Microsoft Teams Meeting” link in Meeting invite

April 30, 2020 Mark GerlowLeave a comment

I’ll start of by saying that I really love Teams, I do, BUT there is definitely room for improvement!

One of the things that really annoyed me lately is when joining an online meeting, the default web browser opens up and you need to click the “Open” button in the popup…. Why Microsoft….. Just Why??

Luckily (For you😁) it annoyed me enough to do some research and figure out how to get around it. Unfortunately I cant suppress the opening of the web browser, but I can get it to open the Teams app automatically 👍

So here we go. Oh, and by the way, this guide will work with Google Chrome and Edge Chromium.

So you get an invite to a Teams meeting, and when you want to join, you click the “Join Microsoft Teams Meeting”

It opens your web browser, and that box, where you have to press “Open” (If you have the desktop app installed),

it launches you’re Teams app, and you’re ready to go. But why? Why not just open you’re Teams app right away?

Here is how in Edge Chromium

Open your registry and navigate to

[HKEY_CURRENT_USER\Software\Policies\Microsoft

Now, most likely you don’t have much in there, so you need to add the following key’s

HKEY_CURRENT_USER\Software\Policies\Microsoft\Edge\URLAllowlist

Now add a new STRING value, name it 1, open it up and add the value

msteams://*

and that’s it😳, from now on when you click the “Join Microsoft Teams Meeting”, it opens your default browser and then the Teams meeting👍

If you want to do it with a Commandline, this should do it (Remember to run CMD as Administrator 😉)

REG ADD HKCU\Software\Policies\Microsoft\Edge\URLAllowlist /v “1” /d “msteams://*” /t REG_SZ

Here is how in Google Chrome

HKEY_CURRENT_USER\Software\Policies\Google\Chrome\URLWhitelist

Now add a new STRING value, name it 1, open it up and add the value

msteams://*

Again, if you want to do it with a Commandline, this should do it (Remember to run CMD as Administrator 😉)

REG ADD HKCU\Software\Policies\Google\Chrome\URLWhitelist /v “1” /d “msteams://*” /t REG_SZ

You can double check that the policy works correctly, if you open Google Chrome or Edge Chromium and go to:

chrome://policy/

Or for Edge

edge://policy/

Happy Teaming 😊

Teams – now in Lock-down – Limit creations

April 15, 2020 Mark GerlowLeave a comment

So, in these times, Teams are becoming extremely popular and valuable for company’s with everybody working from home, and Microsoft giving away 6-months of free Teams licenses for new Tenants, it’s growing crazy fast. Its easy to get started, and users can create teams out-of-the-box🙈.

But for a few Administrators it can (In my own humble opinion, anyways) turn into a Wild West with out any form of control, with users creating new teams, as they like. (Why this isn’t a build in feature, and enabled by default, I don’t understand?🙄)

It might be an “old school” kind of thinking, but I would like some control over who does what in “my environment”.

I figured that others would be in the same situation, so I started my little adventure, in to figuring out how to “Lock-down” Teams, so that normal users wont be able to create what ever they want. You can do this in various ways, but the one I liked the most, is where you can control access to Teams creation through Group access. Fortunately for us, Microsoft has released an article on how to. You can read the original MS article HERE.

Lets get into it

First of, you need to log in to your Office 365 Tenant, with your Global Admin and create the security groupIn my Example I created the group “Office 365 group limitation” Copy the below PowerShell script to your favorite editor, like Notepad, PowerShell ISE or Visual Studio Code. Name the script how you like, I kept it like MS suggested, GroupCreators.ps1

$GroupName = "Office 365 group limitation"
$AllowGroupCreation = "False"

Connect-AzureAD

$settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
if(!$settingsObjectID)
{
	  $template = Get-AzureADDirectorySettingTemplate | Where-object {$_.displayname -eq "group.unified"}
    $settingsCopy = $template.CreateDirectorySetting()
    New-AzureADDirectorySetting -DirectorySetting $settingsCopy
    $settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
}

$settingsCopy = Get-AzureADDirectorySetting -Id $settingsObjectID
$settingsCopy["EnableGroupCreation"] = $AllowGroupCreation

if($GroupName)
{
	$settingsCopy["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString $GroupName).objectid
}
 else {
$settingsCopy["GroupCreationAllowedGroupId"] = $GroupName
}
Set-AzureADDirectorySetting -Id $settingsObjectID -DirectorySetting $settingsCopy

(Get-AzureADDirectorySetting -Id $settingsObjectID).Values

Change the Group name in the script, to the group name you created in the beginning. You will need your O365 Global admin, to run the script. Also if you haven’t already, you need to install the Azure AD module for PowerShell.

Install-Module AzureADPreview

If you have the used the module before or maybe have the general availability version (2.0), make sure you either remove and reinstall or update it before continuing.

And you’re ready 👍 If you have a handful of users that you trust, you add them to the group, or maybe your Helpdesk workers, so that they can create Teams for the users.

This is what it looks like now for the users!

Without group membership…

With group membership…

From now on, when users go to Teams and click the “Join or Create a team”, the only options is to join a team with a code or they can search for the Team, if they know the name. Here’s a few options:

You as an admin, add them.
You tell the newly appointed owner to add users themselves 👍
The users search for the Team and join 👍
Or you send them a Code, that they can use to join the Team with (Team owner can do this) 👍

That’s it, you’re done and have just a little more control with what’s going on again 😊

Oops, I deleted AZUREADSSOACC – What now – How to fix

October 8, 2019March 19, 2020 Mark Gerlow3 Comments

Accidents happen, we are only human and sometimes we accidently delete something that we shouldnt have. In most cases its no big deal, we can restore . When it comes to Active Directory, it actually can be an issue. AD restores can be a nightmare (in my humble oppinion, anyways).

On a quick sidenote, enable AD recycle Bin, it can really save you some time.

Open Active Directory Administrative Center

After enabling it, you can’t disable it (but why would you?)

BUT, in this case we “act” like, we havent enabled it

So somebody accidently deleted the AZUREADSSOACC computer account . This is the “virtual” computer account, used with Azure AADConnect when you enable SSO. (You can read more about it in a previous articel HERE.

Normally its placed In the Computers container

But, in this case we deleted it ( And just to prove to you, that I’m not cheating )

It’s gone

First you need to log on the computer on which you have AADConnect running.

Right click, and choose run as Admin (If you have UAC enabled, click yes ) on the “Azure AD Connect” icon, placed, must likly on your desktop (Thats default)

Click “Configure”

Choose “Change user sign-in”, and click next. Logon with your Office 365 Global Admin account

Remove the option for “Enable single sign-on” and click next

And then, Configure

Now, if the next screenshot is what you get, you are got to go. If it comes with a warning, saying something like “Single sign-on could not be disabled”, have no fear, it did for me when I did some test the first time. Run the wizard to the end, wait 5-10 min. and try again. You should end up with it being succesfully disabled.

Status: For now, we have diabled SSO. Now we need to enable it again, because its an awesome feature and we really want it……

Run the Wizard again (As an admin), and make sure you set the tick (or what ever you call it) in “Enable single sign-on”

Click next – In the “Enter credentials” box, you need to provide your local Domain Admin

Click OK, and next

Click “Configure” and let the wizard do its magic

Dont be alarmed, if it throws an error, it did for me a couple of times, just hit retry.

Yay…success… and look, AZUREADSSOACC is back where it belongs in AD

Give it time to run a sync (or force one with PowerShell Start-ADSyncSyncCycle -PolicyType Delta ), but eventually it will sync back up, and work like it did before.

Happy Clouding

AADConnect password sync error

August 7, 2019October 8, 2019 Mark Gerlow6 Comments

So, long time since the last post. Its been a long an very hot summer, and things are starting to turn back to Business as usual .

I started up my lap environment, after a good long vacation, and wow and behold…. AADConnect errors I needed the lab for some testing…. Oh well, time for an article then.

After booting up, and some time to sync, this messages appeared in the O365 portal

….. Didn’t make much sense to me… “Last synced 31 minutes ago”, but “warning no recent synchronization” ???

Didn’t spend to much time investigating, figured it had something to do with the whole environment being shutdown for a month, so went straight to try and fix it…My thoughts where, that trying to disable, do a sync and then re-enable password sync, would be a good place to start.

Here we go

Started the AADConnect wizard

Choose “Configure”, and then “Change user sign-in”

So, log on with your Tenant global admin cred’s

Set the option to “Do not configure”

And then “Configure”. Just to make sure it actually was synchronizing, I ran the PowerShell sync cmdlet

Start-ADSyncSyncCycle -PolicyType delta

After it was successful (Had to run it a couple of times, since the reconfiguration of AADConnect, initiates a Complete sync, which takes some time) I reconfigured AADConnect to again allow password hash sync.

Enter your O365 tenant credentials if prompted!

After id was done, I waited a good 5 minutes for the initial sync, and then ran the PowerShell cmdlet again

And the waiting game started. It can take some time for O365 to realize that you actually did something, so after about 15 minutes everything looked fine again.

Pretty easy fix

Skype for Business online – Hide some users from the adressebook – Notes from the field

December 10, 2018December 10, 2018 Mark GerlowLeave a comment

Its been a while since my last post, but I’ve been busy at customers…. I know, booooring, but unfortunately I’m not filthy rich .

At one of my recent jobs, I came a cross a “weird” question from a customer. They have ALOT (+200.000 object) of none licensed users in their tenant, and they where all visible in their SfB (Skype For Business). Meaning, when you searched for, lets say, Thomas….. They would get way more then they asked for. So what to do?

All the non licensed users where synchronized from a different tenant (a customer tenant), and needed to be there.

Exchange Online wasn’t a problem. Since they don’t have a license, they don’t get to go in the GAL. SfB, a whole other thing.

So after doing a whole lot of research we came up with this solution, which worked, and that i would like to share with you guys. I will be using my test tenant for this, show and tell .

Find the user in your local AD (And quickly set the “Advanced view”, so you can see “Attribute editor”, within the user.)

Find the attribute MailNickName, and set it to the users account name

Next, find msExchHideFromAddressLists and set it to true

Sit back and let nature, or in this case, AADConnect and the Managed Folder Assistant, take action. Seriously, have a little patients, in this particular tenant, it took about 48 hours for the changes to take effect.

So knowing this, you should be able to do a short script to add this information to the users attributes.

Good luck

Seamless Sign On, Kerberos roll over–Wait what??

June 8, 2018December 10, 2018 Mark Gerlow7 Comments

UPDATE: So happy to see that Microsoft has heard our prayers. They are working on a solution to automate the rollover in Azure. Read more about it HERE.

So, you’ve installed Seamless Sign On, and its been running awesome, by chance you logon to your Azure tenant, just nosy browsing around, improving your Azure skills, and suddenly you find this……. Kerberos Roll Over, wait what? erhm… What?…..

First of, when I saw this, I thought it was a joke, but after thinking it over, it made sense….in a weird kind of way.

First of, when you install AADConnect and enable Seamless Sign On and Single Sign On, you get an extra auto generated Computer object in your AD called AZUAREADSSOACC.

This is the object in charge of handling / generating the shared Kerberos key needed between local AD and Azure AD. (best leave that one alone )

Since this is a “dead, virtual” object, it is not able to create new keys automatically, so for at best practice, MS recommends to do a manual “Roll-Over” every 30 days. I will explain how to do this in a short while, first of, cast your vote HERE, for the feature of AADConnect to do automatic Roll-Overs….Awesome, Thanks.

First of, connect your Powershell ISE to your Tenant.

(You got to know that one by now )

Next you run these simple Cmdlets. (NOTE: These Cmdlets and the text is copied from the official MS documentation. Explanations where great, so no need to convert them )

(I’m really sorry, but for some reason i didn’t get the steps in, where you have to import the powershell script AzureADSSO.psd1. This script has the CMDlets you need.)

You have to run this from the server, where you run AADConnect. So, dive down to the install dir, and import this

cd “C:\Program Files\Microsoft Azure Active Directory Connect”

Import-Module .\AzureADSSO.psd1

New-AzureADSSOAuthenticationContext

#This command should give you a popup to enter your tenant’s Global Administrator credentials.

Get-AzureADSSOStatus | fl

#This command provides you the list of AD forests (look at the “Domains” list) on which this feature has been enabled.

#Step 2. Update the Kerberos decryption key on each AD forest that it was set it up on

$O365Cred = Get-Credential

# When prompted, enter the Domain Administrator credentials for the intended AD forest.

Update-AzureADSSOForest -OnPremCredentials $O365Cred

#This command updates the Kerberos decryption key for the AZUREADSSOACC computer account in this specific AD forest and updates it in Azure AD.

#Repeat the preceding steps for each AD forest that you’ve set up the feature on

And you’re done…. AADConnect welcomes you back in 30 days . Seriously, save it in a .psd1 file, for easy running, next time.

THATS why I use PowerShell ISE for everything (and the fact that my memory is really bad )

I’ve seen some bloggers doing articles where they save Global Tenant admin’s and corresponding passwords in text files, encrypted, not encrypted and so on, in an attempt to automate this. Needles to say, this is a MAJOR SECURITY RISK, and cannot be recommended. Better yet, go cast your vote, so that MS puts this feature inside AADConnect.

Until next time, happy cloud computing

Office 365 update – apps seeking pension

April 24, 2018April 24, 2018 Mark GerlowLeave a comment

Just a quickie

A few, well used App’s are on the path to retirement.

SfB (Skype for Business) for the Windows Phone is retiring May 20th 2018. Microsoft has decided not to develop the Skype app for windows phones anymore.

OWA app for IOS and Android The much used, and loved mail app, is also retiring on May 15th 2018. More info HERE.

Alternatives for the OWA App, is of course Outlook, for either IOS or Android.

I’ve been using Outlook for both platforms, for some time now. I must admit, its getting really good. For the first couple of years, it was terrible, but they are definitely getting there.

If you haven’t, you should try it out

Outlook for Android

Outlook for IOS

Seamless Sign On and High Availability

March 27, 2018December 10, 2018 Mark GerlowLeave a comment

In my previous articles I’ve written about Seamless Sign On, and for good reason. It’s an absolutely awesome feature . For small and midsize companies wanting to go “up” the Cloud road, not having Exchange, SharePoint and so on, with the high cost, tons of expensive maintenance in their Onprem environment.

Office 365 is, in my humble opinion, the only way to go. But what about the users. Well AADConnect is a must, if you have your own AD. So you have 4 options for authentication…

– User sync but Cloud only password

– Password synchronization

– ADFS Single Sign On

– Seamless Sign On

User sync but Cloud only password

Not really an option in my book. We want to make it easy for the users and not giving them 2 sets of credentials to worry about. (gives us less time to enjoy a good cup of coffee )

Password synchronization

Could be a possibility, but why would you force your users to login twice?

ADFS Single Sign On

Absolutely, IF you want to maintain 2 ADFS server, 2 WAP servers and you AADConnect server. ADFS is an awesome feature. But it leaves a fairly large footprint in your infrastructure, especially if you want high availability. Maybe not the best solution for the smaller to midsize company’s.

Seamless Sign On

YESSSS…. You guessed it…. Seamless Sign On to the rescue. First of, I’ve never had an AADConnect service break down, its very stable (Big thanks to the guys at Microsoft ). Second, if the server you’ve installed AADConnect on crashes, well users won’t be able to logon. But why bother getting stressed about it? Just make it High Available . With the newer versions, you have the option to install AADConnect Authentication Agent.

So, here we go

First of, a little about my test setup. I have 2 Domain Controllers and one File server. AADConnect is installed on DC01 (I won’t go into the installation process of AADConnect), and I want to install the AADConnect Authentication agent on my File Server.

Logon on to your O365 tenant, and go straight to the Azure Portal –> Go to “Azure Active Directory” –> then to “Azure AD Connect”

Click on “agents” (please disregard the warning sign and the 3’rd agent, it was for testing purpose, and it takes a while for Azure to realize, its not there anymore, and I was so excited to write this article, that I didn’t have the patience to wait for it to go away.)

At the top left, you have a Download option, this is the agent install file. (I’ve cheated, and already installed it on the File server… Shh…)

It’s a Next –> next, finish installation, so no need to document that.

After a short wait, the second “agent” will popup in your view. Now, your Seamless sign on setup as HA…. And yes, it really is that easy.

In my setup I have 2 DC’s, so if the AADConnect DC crashes, the Authentication agent on the File server, still has authentication against the second DC.

The “downside” to this, is you’ll need at least 2 Domain Controllers, for this to work, but with multi-role servers today, I don’t see this as any issue.

Hope you enjoyed, this little write-up. Feel free to comment

Seamless Sign On – How to and why

February 9, 2018April 30, 2019 Mark GerlowLeave a comment

Seamless Sign On, what is it and why would you want to use it

Well, good questions. Seamless Sign On is a fairly new feature in Azure ADConnect, that allows users to have that “Single Sign On” experience, you get from using ADFS, but without the huge infrastructure. I can’t really see a lot of large companies using this feature, but for smaller / midsize businesses it makes a lot more sense. Why? Make it as easy for your users as possible, they would only need to remember 1 password, and you, as and admin, are in control of your users ID’s and passwords, from within your local AD (which in return will give you more time to enjoy your )

So, lets get to it and start looking at the configuration. It doesn’t matter if you already have Azure ADConnect installed, or its a new installation. Its the same settings for both scenarios.

First of, start the AADConnect wizard. If you install AADConnect for the first time, the below is what you need to configure.

If you already have AADConnect running, this is what you need to configure.

On a side note, I would always recommend using OU filtering, so that you only synchronize what you need, and not all objects from AD. It will only look messy and confusing.

After configuration is done, you need a little more work on the client side. You need to set up GPO’s to allow Azure to receive the Kerberos tickets for Authentication before it works. So you need your browser to trust some sites.

Internet Explorer

For IE users (the few left ), you need to add some URL’s to the local intranet zone. Preferably done by GPO. These are the 2 addresses you need to add:

https://autologon.microsoftazuread-sso.com
https://aadg.windows.net.nsatc.net

Chrome

For Chrome users, there is a little more work, but it pays of. First of, download the Google ADMX files and add them to your AD, so that you are able to configure Chrome with GPO’s. Afterwards go to the Google Extension store. Search for “Windows 10 accounts”

Right click on the the logo and copy the link address.

Paste it to notepad

Copy the “app id”, from the last dash, to the questionmark, and paste it on a new line. Now you need to format the address for the Chrome GPO.

Separate the 32 character ID, with the default Google store address ;https://clients2.google.com/service/update2/crx, so that it looks like this

ppnbnpeolgkicgegkbkbjmhlideopiji;https://clients2.google.com/service/update2/crx

Find the correct Computer GPO setting for Chrome extensions

Open up “Configure the list of force-installed apps and extensions”

Enable –> show, and paste the above ID address we created a few seconds ago

Save the GPO and link it to the OU where your computers are located, and you’re in business.

Once the GPO is “active” on clients (if it doesn’t happen run gpupdate /force, might require a restart) you will see the little Windows logo on the right topside of Chrome

Try and click on it , or just go to https://portal.office.com.

I have not tested it with other browsers. Edge browser isn’t supported, go figure

Pros and cons

I my opinion this as an awesome feature. Some of the smaller customers that I have helped, would definitely have benefited from this, instead of an ADFS infrastructure, but that’s just me . I will list my view on pros and cons here.

Pros

Users, need only to remember their AD password, and get easy access to your Office 365 tenant
Easy configuration, no need for expensive certificates, or a larger infrastructure as with ADFS
If browsers are configured correctly, the Seamless Sign On is as close to the Single Sign On, as you can get
The AADConnect / service is really stable. I have yet to see it crashing, or break down
Low footprint in your infrastructure. With installation on Domain Controllers being supported, or maybe your file server / application server, you don’t need dedicated HW / VM to run add extra costs

Cons

If the service is down, users can’t login. It’s possible to make the solution High available, but for that you will need one more local server to install an agent on
hmm… not sure I can find any more cons, but if i do, I’ll be sure to update

Have fun, and enjoy.

CrazyClouds

Helpful articles about Exchange, Office 365, Teams and other related products

Author: Mark Gerlow

Exchange 2016 CU15 -> CU17 update error

The Solution…

Launch Teams app when clicking “Join Microsoft Teams Meeting” link in Meeting invite

Here is how in Edge Chromium

Here is how in Google Chrome

Teams – now in Lock-down – Limit creations

Oops, I deleted AZUREADSSOACC – What now – How to fix

AADConnect password sync error

Skype for Business online – Hide some users from the adressebook – Notes from the field

Seamless Sign On, Kerberos roll over–Wait what??

Office 365 update – apps seeking pension

Seamless Sign On and High Availability

Seamless Sign On – How to and why

Seamless Sign On, what is it and why would you want to use it

Internet Explorer

Chrome

Pros and cons

Pros

Cons

The Solution…

Share this:

Like this:

Here is how in Edge Chromium

Here is how in Google Chrome

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Seamless Sign On, what is it and why would you want to use it

Internet Explorer

Chrome

Pros and cons

Pros

Cons

Share this:

Like this: