redundancy management-module nonstop-switching
show redundancy
redundancy rapid-switchover 60
redundancy swtchover
show redundancy detail
Firmware-
boot set-default flash primary
write memory
boot standby
show redundancy (wait for sync
redundancy switchover
Check users email fields-
get-aduser -Filter * -Properties mail | select name,mail | Out-GridView
Command to copy-
Get-ADUser -LDAPFilter '(userPrincipalName=*)' ` -Properties userPrincipalName,mail | Select-Object * | ` ForEach-Object { Set-ADObject -Identity ` $_.DistinguishedName -Replace ` @{mail=$($_.userPrincipalName)} }
Here is how to set up Mimecast to work with Duo's Cloud SSO. The online instructions are confusing and inaccurate.
DUO SSO-
Deploy and configure DUO SSO if you haven't already.
https://duo.com/docs/sso
DUO Application-
In Duo, go to Applications, click Protect an Application, search for Generic, there will be two Generic Service Providers, select the one that says "2FA with SSO hosted by DUO".
Fill in the following-
Entity ID- us-api.mimecast.com.ACCOUNTCODE (Replace account code with your account code, it will be something like CUSA88U99)
Assertion Consumer Services ACS URL- https://us-api.mimecast.com/login/saml
Copy the metadata URL to notepad, you'll need it later.
Name (under settings)- Mimecast
Leave everything else alone, click save.
Mimecast-
Administration, Services, Applications, Authentication Profiles, Default Authentication Profile.
Check the box that says "Enforce SAML Authentication for Mimecast Personal Portal"
Provider- Other
Metadata URL- paste the Metadata URL you copied earlier. Click Import.
Click Save and Exit.
Repeat above if you want to enforce User Applications.
Repeat above in Administration, Services, Applications, Authentication Profiles, Account_Administrators_Authentication_Profile if you want to enforce it for admins.
1. DISM /Online /Cleanup-Image /RestoreHealth
2. Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register “$($_.InstallLocation)\AppXManifest.xml”} --
3. Delete this folder for each user: C:\Users\username\AppData\Local\TileDataLayer
You get- "You cannot visit localhost right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later."
IF YOU'RE CERTAIN the page is safe, you can type thisisunsafe and you will be able to reach the site.
You want to keep a user's mailbox indefinitely, however, you do *not* want to keep their AD account (or you want it disabled). Converting it to a shared mailbox still anchors it to their AD account, so purging that deletes the mailbox.
- Delete or Disable the account in AD.
- Run an AD Sync.
- Ensure the account is gone in Office 365.
- In Office 365 Admin Center, open the Azure Active Directory Admin Center.
- Gop into Users, Deleted Users, find the user in question, check the box and click "Restore User".
- Go into the user's cloud account and reapply the license.
- Once their mailbox is in Exchange Admin Center, convert the mailbox to a shared mailbox.
- Remove the license from their user account.
(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List
New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName @()
Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate
Set-AuthConfig -ClearPreviousCertificate
IISReset
In Veeam Backup and Replication you get the notification "Warning Skipping credentials backup because the encryption is disabled. This will complicate the restore process significantly. Enable configuration backup encryption to stop receiving this warning."
Personally, I do not want the credentials stored in the configuration backups, so this is the desired behavior. To suppress this warning-
HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication "ConfigurationBackupSuppressEncryptionWarning", DWORD, value "1"
ESXi 7.0U2a Build 17867351
ESXi 7.0U2c Build 18426014
ESXi 7.0U3 Build 18644231
ESXi 7.0U3a Build 18825058
From SSH-
esxcli network firewall ruleset set -e true -r httpClient
esxcli software profile update -p ESXi-8.0U1c-22088125-standard -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
esxcli software profile update -p ESXi-8.0U1c-22088125-standard -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
esxcli software profile update -p ESXi-8.0U1c-22088125-standard -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
esxcli network firewall ruleset set -e false
esxcli software sources profile list --depot=https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xmlUse grep to filter the list for your version,
esxcli software sources profile list --depot=https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml | grep -i ESXi-6.7If you want to convert a mailbox to shared to preserve it, but you want to disable or delete the AD account, do the following-
- Go into mailboxes in Exchange Admin Center, click "Convert to Shared" on the right.
- To to the users in Microsoft 365, remove the users license.
- Disable or delete the AD account, wait for Azure AD to sync.
- Under Admin Centers, click Azure Active Directory, Users, Deleted Users. Select the users and click "Restore Users." This will move them to a "Cloud User" which will need to be maintained to prevent the mailbox from being deleted. This account will not be able to log into the mailbox, however, so it presents a pretty minimal risk. You can set a complex password and enable MFA.
First- Ensure Office 365 is set for Modern Auth-
- Log in to the Office 365 portal, Edge seems to work the best.
- Admin Centers, Exchange, Classic Exchange Admin Center.
- Hybrid, click "Configure" under Exchange Online Powershell Module.
- Type "Connect-EXOPSSession -UserPrincipalName <your UPN>"
- Get-OrganizationConfig | ft OAuth*
- If it's set to "True", you're good to go, modern auth is enabled.
- If it's set to false- Set-OrganizationConfig -OAuth2ClientProfileEnabled $True
- Give it a couple of hours.
If a user is still getting the basic prompt in outlook-
- Go into control panel, credential manager, delete everything related
- In regedit, go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Identity.
- Create a new DWORD named "EnableADAL" and give it a value 1
If that doesn't work-
- Create a new DWORD named "DisableAADWAM" and give it a value 1
- Create a new DWORD named "DisableADALatopWAMOverride" and give it a value 1
Choose , and right-click the Cisco ASDM-IDM Launcher application.
Choose .
Windows opens the directory with the shortcut icon.
Right click the shortcut icon, and choose Properties.
Change the Target to:
C:\Windows\System32\wscript.exe invisible.vbs run.bat
Click OK.
ReDirUsr "CN=Users,DC=domain,DC=com"
ReDirCmp "CN=Computers,DC=domain,DC=com"
Check to make sure the following services are NOT disabled, and start them-
Device Install Service
Device Setup Manager
Device Association Service
- Open up powershell-
$rootcert = New-SelfSignedCertificate -Type Custom `
-Subject "CN=ASARoot" `
-KeyExportPolicy Exportable `
-KeySpec Signature `
-HashAlgorithm sha256 `
-KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-KeyUsageProperty Sign `
-KeyUsage CertSign
- Run MMC, add Certficiates, User, go to personal, Export, no to private key, pick Base-64 encoded, save file.
- Log into ASA-
MyASA(config)# crypto ca trustpoint ASACERT
MyASA(config-ca-trustpoint)# no ca-check
MyASA(config-ca-trustpoint)# enrollment terminal
MyASA(config-ca-trustpoint)# no id-usage
MyASA(config-ca-trustpoint)# exit
MyASA(config)# crypto ca authenticate ASACERT
- Log into ASDM, Network Client Access, Anyconnect Connection Profiles, select profile and click Edit, set authentication to certificate only.
Field Test Mode- *3001#12345#*, Call.
Get IMEI- *#06#
Get Data Usage- *3282# or #3282
Bill Balance- *225# or #225 or #225#
Reinstall CU 23-
.\setup.exe /m:upgrade /IAcceptExchangeServerLicenseTerms
Windows Update Fails with error 80072efe. Looking at C:\Windows\WindowsUpdate.log, you see windows unable to access a URL that begins with sls.update.microsoft.com.
If you open https://sls.update.microsoft.com in internet explorer, you this page can't be displayed.
SOLUTION-
Open HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL
Delete Functions key. Reboot.
You're welcome. This took me FOREVER to find.
Information on Exploit-
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Alternate Mitigation-
https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/
Script to check server-
https://github.com/microsoft/CSS-Exchange/tree/main/Security
Microsooft Safety Scanner-
https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
del /f /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
del /f /s /q %SystemRoot%\SoftwareDistribution\*.*
del /f /s /q %SystemRoot%\system32\catroot2\*.*
del /f /q %SystemRoot%\WindowsUpdate.log
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
You cannot register RHEL, you get rhsm.connection.RestlibException: HTTP error (401 - Unauthorized): Service not available, please try again later
subscription-manager register --username your_username --password 'your$password'
subscription-manager attach --auto
To re-register-
Un-register the system :
sudo subscription-manager remove --allsudo subscription-manager unregistersudo subscription-manager clean
Re-register the system :
sudo subscription-manager registersudo subscription-manager refresh
Search for the Pool ID :
sudo subscription-manager list --available
Attach to subscription :
sudo subscription-manager attach --pool=<Pool-ID>
Clean YUM and cache :
sudo yum clean allsudo rm -r /var/cache/yum
Update the resources :
sudo yum upgrade
openssl enc -base64 -d -in Cert.pfx -out converted.pfx
- Open powershell as administrator.
- run qwinsta.exe
- Run rwinstal.exe <session#>