Exchange – Add nested group recipients to parent resources

Nested Groups

Do you have nested groups within Exchange resources such as distribution groups, shared mailboxes, rooms or equipment?

If you have, you have come to the right place. I have created a script that extracts all nested group members of a resource, and add it directly to the resource instead.

The script works in both on-premise and Exchange Online.

Before you can run the script, you need to have access to the following:

  • Access to on-premise and/or Office 365 environment as a administrator.
  • Have the AzureAD and Active Directory PowerShell module installed.

Read More

Tutorial – Deploy Always On VPN

AlwaysOn VPN

Always On VPN provides a single, cohesive solution for remote access and supports domain-joined, non-domain-joined (workgroup), or Azure AD–joined devices, even personally owned devices. With Always On VPN, the connection type does not have to be exclusively user or device but can be a combination of both. For example, you could enable device authentication for remote device management, and then enable user authentication for connectivity to internal company sites and services.

The purpose for this guide is to demonstrate how to deploy the Always On feature easily. In this guide we will deploy the following platforms primarily using PowerShell where possible:

  • Active Directory (AD DS)
  • DNS
  • Certificate Authority (AD CS)
  • DHCP
  • Routing and Remote Access Service (RRAS)
  • Network Policy Server (RADIUS)

It will not be demonstrated how to install Windows Server or Windows 10 operating system.

Do not attempt to deploy Remote Access on a virtual machine (VM) in Microsoft Azure. Using Remote Access in Microsoft Azure is not supported, including both Remote Access VPN and DirectAccess.

Read More

SCCM – Cloud Management Gateway and Cloud Distribution Point

The cloud management gateway (CMG) provides a simple way to manage Configuration Manager clients on the internet. By deploying the CMG as a cloud service in Microsoft Azure, you can manage traditional clients that roam on the internet without additional infrastructure. You also don’t need to expose your on-premises infrastructure to the internet.

A cloud-based distribution point is a System Center Configuration Manager distribution point that is hosted in Microsoft Azure. The following information is intended to help you learn about configurations and limitations for using a cloud-based distribution point.

In this step-by-step guide, I will demonstrate how to configure and establish a Cloud Management Gateway (CMG) and Cloud Distribution Point (CDP) in SCCM and Azure.

In order to walk you through the entire process of setting up the Cloud Management Gateway and Cloud Distribution Point features, I am going to break this down into 6 parts.

  1. Overview
  2. Certificates
  3. Azure Service
  4. Cloud Management Gateway
  5. Cloud Distribution Point
  6. Log Files

Read More

Ethical Hacking – Tools for the 5 Phases of Hacking

5 Phases of Hacking

After finishing two MCSA (Office 365 & Windows Server 2012 R2) certifications, I’m currently studying to take the CEH v10 certification, which is a valuable tool for any IT-professional.

This post is part of a series called “Ethical Hacking”.

While I’m studying for this certification, I’m going to update this post with variety of useful tools and websites. Only use these tools in your own environment for education purposes only.

Read More

WSUS – High CPU due to “supersedence” updates.

Lately I have been seeing high CPU (90-100%) usage on servers where the Windows Server Updates Services (WSUS) is installed.

This is mainly caused by updates that is superseded, and is filling the database causing the CPU to spike.

Read More

WSUS – Windows 10 Clients – Error 0x8024500c

Error

Just finished troubleshooting an error with Windows 10 clients (build 1607 and above) contacting WSUS server getting 0x8024500c like below while searching updates.

The client had an on-premise WSUS server which they wanted to push out Windows Updates, instead of using the internet (windowsupdate.microsoft.com).

Cause/Solution

They had configured the following group policy to enable:

  • Computer Configuration\Administrative Templates\Windows Components\Windows Update
    • Do not connect to any Windows Update Internet location

This caused the Windows Update on the clients to break, instead they should disabled the above and configured the following instead:

  • Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings
    • Turn off access to all Windows Update features

The above will allow users to download apps on the Windows Store, but still only allowing the users to use the on-premise WSUS server.

Unfortunately Microsoft introduced a new feature called “Dual Scan” (read more about it here) which allows the Windows clients to access both WSUS and the internet, which would potentially bypass the local WSUS.

To disable the dual scan, the client needs to have the following registry keys deleted.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Update
    • BranchReadinessLevel
    • DeferFeatureUpdatesPeriodInDays
    • DeferQualityUpdatesPeriodInDays
    • DeferUpdatePeriod
    • DeferUpgradePeriod
    • ExcludeWUDriversInQualityUpdate
    • PauseDeferrals
    • PauseFeatureUpdates
    • PauseQualityUpdates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
    • BranchReadinessLevel
    • DeferFeatureUpdatesPeriodInDays
    • DeferQualityUpdatesPeriodInDays
    • ExcludeWUDriversInQualityUpdate
    • DeferUpgrade

If though you set the matching group policies to “Not Configured” or “Disable”, it will not delete the keys but only set them to zero (DWORD) in the registry.

For those clients that are running build 1607, you need to install kb4025334 which will add a local policy “Do not allow update deferral policies to cause scan against Windows Update” under “Computer Configuration\Administrative Templates\Windows Components\Windows Update“.

You can set this group policy on those 1607 clients by adding the following registry through group policy.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
    • Key: DisableDualScan
    • Value: 0x1
    • Type: DWORD

The WSUS server was also tuned a little, because all resources was used. This caused the clients to take a long time to talk and eventually timeout.

  • All superseded updates was declined in the WSUS management console.
  • The WSUS IIS application pool (“WsusPool“) was also tunned with the following settings (remember IISRESET afterwards):
    • .NET Framework Version: v4.0
      • Already on Windows Server 2012 above, but this server was Windows Server 2008 R2
    • Queue Length: 2000
    • Private Memory Limit: 7843200

You can test the Windows Update by executing the following command in a elevated command prompt.

  • usoclient.exe StartScan

Troubleshooting

Registry Keys

If you want to see what registry keys you have on your client, you can run the following in a command prompt with elevated rights.

  • reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /s
  • reg query HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update
  • reg query HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings

Windows Update Log

Check the Windows Update log by running the following command in PowerShell.

  • Get-WindowsUpdateLog

CBS Log

Check the Component-Based Servicing log here.

  • C:\Windows\Logs\CBS

That is my 2 cents, hope you can use it!

 

 

 

 

SCCM – Image Capture – Error 0x00004005

I had to capture a Windows 7 image in SCCM. When I tried to capture the image, i was getting the following error.

Task Sequence: Image Capture Wizard has failed with the error code (0x00004005)

The solution was pretty easy. It turned out that it was the product key that couldn’t be activated.

Read More

SCCM – Task Sequence – Error: 0x80070490

Recently I have been doing a lot of SCCM work and deploying tests.
Some of the clients I tried to run a task sequence to, gave me the following error 0x80070490.

Read More

SCCM 2012 R2 – Where are the client log files?

Lately I have been testing a new deployment sequence of Windows 10 from the System Center Configuration Manager (SCCM) 2012 R2.
There was a lot of new things to try, and therefor potential for errors.

Under each deployment failure I needed to look in the client logs, to investigate the problem.

Read More

“Network Path Not Found” while joining server to the domain

Recently I had a problem, where I couldn’t join a Windows Server to the domain. It displayed the following error.

There can be various reasons why this errors shows.

  • Mistype DNS configuration.
  • Firewall issues.
  • Wrong domain typed.

Even though I had all above correct, I still had the problem.

So I used the following commands in a cmd.exe to resolve the issue.

Read More