Jim Jones

Thanks for the good info. Microsoft’s ever-changing nature presents a challenge (and a rabbit-hole of searching).
In reviewing mail status, we trigger the stock monthly email & collaboration report. (Using Defender for O365 Plan 1 policy defaults). Most data is obvious (Edge Block Spam, Good Mail, Malicious URL etc.) but there’s a column labeled ‘others’ – in our case tallying as much as 10% of total volume.

Any idea what that is? (and are these messages delivered? quarantined? bit-bucketed? returned to sender?)

Your expertise appreciated.

There are some great plugins for Terraform, I use the Pycharms on every day: code completion, refactoring support, colour coding etc.

Getting the below error when running the Flow:

“There is no such object on the server. (Exception from HRESULT: 0x80072030)”
Could you please advise?

Thank you very much for your effort. I’ve enabled the log file and it works!

cheers

By mistake I have tried this simulation ( Malware Attachment) in my personal laptop directly, worried how to remove that malicious thing running in my personal laptop, any idea like where that malicious file gets stored, Thanks in Advance

Thank you!

The new portal is a bit confusing as the reports are scattered.

Thanks a lot!

I mean, the audit mode is useless if I can’t see what is blocked and what not. And tuning becomes a very difficult task

Please be aware of this issue:

https://github.com/MicrosoftDocs/windows-itpro-docs/issues/6813

I mean, adding rules for scripts it’s a matter of trial and error…
Do you know any workaround?

[…] (Source: Set Internet Explorer as the default browser in Windows 10 with Group Policy) […]

—————————————————————————————————————-
New-CimInstance : The requested object could not be found.
At line:28 char:1
+ New-CimInstance -Namespace $namespaceName -ClassName $className -Prop …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (MDM_AppLocker_A…ictions01_EXE03:CimInstance) [New-CimInstance], CimException
+ FullyQualifiedErrorId : MI RESULT 6,Microsoft.Management.Infrastructure.CimCmdlets.NewCimInstanceCommand

Hi Vignesh,

Can we change the user training for those who click on these links and attachments?

Good info. I wanted to know about DISM as a non-sysop. Keep the articles coming.

Will it work for new domains?

thanks….great post

DISM, can also be fragile. There are commands to check its state.

DISM /online /Cleanup-Image /ScanHealth
DISM /online /Cleanup-Image /SpSuperseded
DISM /online /Cleanup-Image /StartComponentCleanup
DISM /online /Cleanup-Image /RestoreHealth

Great stuff! I can’t believe how much of my life I have wasted navigating GUI’s to get basic networking info. This is a huge timesaver. I like the backup process as well before getting into heavy duty diagnostics.
Your writing is great. I always read your articles even when I think I already know/understand the content because you always have a new wrinkle. Keep up the great work!

“With NTLM authentication, there is no way around rebooting or logging out.”

Not true. You can just kill explorer.exe and then launch it again by using runas.exe, as this will perform authentication with a DC and get a new token with the updated group membership for the new explorer process. So now they can access files and folders that are only accessible by those groups you added them to. Obviously requires the user to type their password in as part of the runas bit, but better than having to close everything and log off.