User Profile
m_krone
Brass Contributor
Joined Jan 25, 2019
User Widgets
Recent Discussions
Identity theft using Pass-the-Hash attack verify false positive
Hello, I have some messages about "Identity theft using Pass-the-Hash attack" in our ATA. Checked also some things on the client but cannot find some suspicious activities. I opened a MS ticket some weeks ago and did not get any information or at least a status mail. I think this is an false positive but its a good case for us to troubleshoot this. Can anyone from Microsoft have a look at the case and why we don't get any infos? Does anyone else have some ideas how to verify this? Regards Miguel5.6KViews0likes4CommentsChrome installation failed due to ExploitGuard block
Hi all, we are facing the problem if Google Chrome should be installed by Intune via the Company Portal it gets blocked from the ExploitGuard. In Intune theres a Endpoint Protection Profile with Attack Surface Reduction rules: Flag credential stealing from the Windows local security authority subsystem = Enabled If now Chroe should be installed exactly this rule will block the installation. Did someone facing the same problem? I dont want do tisabled this setting....is the only way to use an Mitigation XML to allow the GoogleUpdater.exe acces to the lsass to have an complete installation? Regards MiguelSolvedGrades sorted decending by end date
Hello all, our teachers facing the issue that in the Grades tab the sort order is decending. So, the Assingment whch is ending soo is the last one not the first one. On the Assingments tab its all fine. All is sorted chron. by the end date. here is the one which si ending soon the first one. D someone facing the same or is it just an setting which we have to find? RegardsRe: Stop syncing an already synced SPO document library
AMDMan64 Unfortunately I got no help on several social and support channels. What I implemented was: 1. Stop OneDrive process as is flushes the config after closing to the disk 2. Remove the ID and path information from the config in the onedrive folder and registry (per user) 3. Start OneDrive again and wait until its fully loaded (waiting for checking/merging files) after this the filesystemhandler will unlock the folder and files 4. I had to remove all files at first and than all folders as an normal recursive remove -Force wasnt working Really crappy this whole thing but thats the way I got it to work. I think its really sad that there is again no managed/admin interface/api or something else to handle this. Cannot imagine to use this for a company with several 1000 or 10000 emplyees....4.2KViews0likes1CommentMicrosoft Exchange Information Store service encountered a corrupt AD object
Having a problem with some ExchangeGuids. Does anyone seen that before? Couldnt find a solution as I also cannot find the GUID in Exchange or AD properties: Microsoft Exchange Information Store service encountered a corrupt AD object with ID (xxxxxxxxxxxxxxxxxxxx). Error text is (Lookup by ExchangeGuid returns inconsistent result for recipient xxxxxxxxxxxxxxxxxxxx LID: 60828 Correlation ID: 00000000-0000-0000-0000-000000000000 Database GUID: xxxxxxxxxxxxxxxxxxxx Database Hash: xxxxxxxxxxxxxxxxxxxx Mailbox GUID: xxxxxxxxxxxxxxxxxxxx Mailbox Number: 288 Operation source: MailboxMaintenance Client Type: Maintenance Hash Code: xxxxxxxxxxxxxxxxxxxx Logged on User Identity: 00000000-0000-0000-0000-000000000000 ). Microsoft Exchange Information Store service has encountered a permanent error while reading information from Active Directory. Details: Microsoft.Exchange.Server.Storage.DirectoryServices.DirectoryInfoCorruptException: ErrorCode: ADPropertyError, LID: 60828 - Lookup by ExchangeGuid returns inconsistent result for recipient xxxxxxxxxxxxxxxxxxxx LID: 60828 Correlation ID: 00000000-0000-0000-0000-000000000000 Database GUID: xxxxxxxxxxxxxxxxxxxx Database Hash: xxxxxxxxxxxxxxxxxxxx Mailbox GUID: xxxxxxxxxxxxxxxxxxxx Mailbox Number: 288 Operation source: MailboxMaintenance Client Type: Maintenance Hash Code: xxxxxxxxxxxxxxxxxxxx Logged on User Identity: 00000000-0000-0000-0000-000000000000 at Microsoft.Exchange.Server.Storage.DirectoryServices.Directory.CheckADObjectIsNotCorruptWithArgs(LID lid, IExecutionContext context, Boolean assertedCondition, Object adObjectId, String errorMessageTemplate, Object[] args) at Microsoft.Exchange.Server.Storage.DirectoryServices.Directory.LoadMailboxInfoByGuid(IExecutionContext context, TenantHint tenantHint, String domainController, Guid mailboxGuid, GetMailboxInfoFlags flags, Boolean& ours) at Microsoft.Exchange.Server.Storage.DirectoryServices.Directory.GetMailboxInfoHelper(IExecutionContext context, TenantHint tenantHint, String domainController, Guid mailboxGuid, GetMailboxInfoFlags flags) at Microsoft.Exchange.Server.Storage.DirectoryServices.Directory.GetMailboxInfoImpl(IExecutionContext context, TenantHint tenantHint, Guid mailboxGuid, GetMailboxInfoFlags flags) at Microsoft.Exchange.Server.Storage.DirectoryServices.DirectoryBase.GetMailboxInfo(IExecutionContext context, TenantHint tenantHint, Guid mailboxGuid, GetMailboxInfoFlags flags) at Microsoft.Exchange.Server.Storage.MapiDisp.MailboxCleanup.GetMailboxInfoFromAD(Context context, TenantHint tenantHint, Guid mdbGuid, Guid mailboxGuid, MailboxInfo& directoryMailboxInfo).7.3KViews0likes1CommentExposure level clarification
Hi everybody, I having some machines in Defender ATP and wondering about the Exposure level. As explained in the info icon the exposure level is only about the security recommendations. Is there any deeper explanation how this number is generated? Because I see some low level recommendations but in some cases the level is medium - this does not make sense to me. Anyone having the same? RegardsRe: Fotovorschau in Onedrive geht nicht mehr
ffmistlberg Ich hatte das gleiche Problem. Bei uns konnte man per Tracing (F12 - Network) sehen, dass eine URL nicht erreicht werden konnte. Nach freigabe von *.svc.ms funktionierte alles wieder. Kannst ja im Browser mal schauen ob es vllt etwas gleiches ist. Gruss3.4KViews0likes0CommentsMDM Security Baseline vs Intune Profile
Hi all, I am testing currently the 2 profiles in the Security Baselines in default configuration. As they are now checked against the endpoint there is one Error in the Per-settings status: Type of system scan to perform Problem is now - I cannot see anything configured in the MDM Security Baseline for May 2019 the setting itself in the Intune profile is configured. Any idea? Best regards MiguelRe: Identity theft using Pass-the-Hash attack verify false positive
Hi, unfortunately, we couldn't got any solution for this. We are currently investigating by our self. Since Eli got a contact for us which was responding we tried to solve the problem but after 3 weeks of just standard mails that Microsoft has currently too many requests with an delay to up to 4 weeks we finally got a closure email of the ticket without and solution. Also a response to work on this ticket got denied and now its gone.5.2KViews1like0CommentsKerberos Encryption downgrade on delegation
Hi all, we are facing a point on SQL-Servers when they are using Kerberos delegation and request a ticket, its requested as RC4. Are there any options or configurations where a SQL-Server can be hardened? Basically we want to remove the RC4 for SQL-Server for Kerberos tickets. Regards2.8KViews0likes1CommentRe: OneDrive client file sharing limitations
Hi ChrisHoardMVP yes it is the same on outside of the corporate network. Also i tested it on a fresh deployed Azure VM - so no corporate infrastructure or software and so on - its the same...waiting up to 10 minutes for OneDrive to be ready. Is there a way to read the log files? Maybe there is something in it. Regards37KViews2likes2CommentsRe: OneDrive client file sharing limitations
ChrisHoardMVP It is happening for all users and every time OneDrive starts. Also with Fiddler we can see there is a normal call to SPO for logging in and have the personal OneDrive ready. After that the SPO document libraries are called and than nothing happens for minutes. Afte rlike 10 minutes the user ca use all items on the SPO document libraries. If a user tries to access a file which was not downloaded before (Files on Demand enabled) we are getting the message "Please make sure that <name of SPO doucment library> is running.37KViews1like4Comments
Recent Blog Articles
No content to show