User Profile
8932LDG
Copper Contributor
Joined 7 years ago
User Widgets
Recent Discussions
Investigating Excel-Initiated Email Activity Without Sent Items Trace
Two days ago, three emails were sent from a user’s inbox without leaving any copies in the Sent Items folder. The user did not send these emails manually—this is confirmed by the presence of the SimpleMAPI flag in Outlook. **What I know:** **Email Characteristics:** - All three emails contained a Word attachment. - No body text was present. - The subject line matched the attachment file name. - Two of the emails were identical. **Recipients:** - Emails were sent to colleagues who originally created the attached documents. **Attachment Details:** - One attachment appeared to be a temporary file (e.g., a3e6....). **System Behavior:** - No suspicious logins detected before or after the event. - Emails were sent via the Outlook.exe process on the user’s machine. - Excel.exe was identified as the parent initiating process according to Microsoft Defender endpoint logs. **In Defender's Endpoint logs I found this under Typed Details (related to the firing of the 3 emails):** - Downloaded file: `2057_5_0_word_httpsshredder-eu.osi.office.net_main.html` - Path: `C:\Users\s***s\AppData\Local\Microsoft\Office\16.0\TapCache\2057_5_0_word_httpsshredder-eu.osi.office.net_main.html` - Downloaded file: `~$rmalEmail.dotm` - Path: `C:\Users\s***s\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm` I am seeking assistance to replicate this issue and accurately determine how these three emails were triggered.Investigating Excel-Initiated Email Activity Without Sent Items Trace
Two days ago, three emails were sent from a user’s inbox without leaving any copies in the Sent Items folder. The user did not send these emails manually—this is confirmed by the presence of the SimpleMAPI flag in Outlook. What I know: Email Characteristics: All three emails contained a Word attachment. No body text was present. The subject line matched the attachment file name. Two of the emails were identical. Recipients: Emails were sent to colleagues who originally created the attached documents. Attachment Details: One attachment appeared to be a temporary file (e.g., a3e6....). System Behavior: No suspicious logins detected before or after the event. Emails were sent via the Outlook.exe process on the user’s machine. Excel.exe was identified as the parent initiating process according to Microsoft Defender endpoint logs. In Defender's Endpoint logs I found this under Typed Details (related to the firing of the 3 emails): 1. -Downloaded file: 2057_5_0_word_httpsshredder-eu.osi.office.net_main.html Path: C:\Users\s***s\AppData\Local\Microsoft\Office\16.0\TapCache\2057_5_0_word_httpsshredder-eu.osi.office.net_main.html 2. Downloaded file: ~$rmalEmail.dotm Path: C:\Users\s***s\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm I am seeking assistance to replicate this issue and accurately determine how these three emails were triggered.Optimizing Excel Formula for Dynamic VLookup
Hi, I have this formula: =IF(F2="", "", VLOOKUP(IF(VLOOKUP(F2, $A$2:$I$1400, 4, FALSE) = 0, VLOOKUP(F2, $A$2:$I$1400, 6, FALSE), F2), $A$2:$I$1400, 9, FALSE)) This formula is meant to fill in the Manager’s email. Rank 0: Every role below the Department Manager level is ranked as 0 in the 4th column (‘Rank’). Currently If an executive reports to a Senior Executive (Rank 0), the formula checks the 4th column. If the Senior Executive has a Rank 0, it looks at the 6th column instead (to get the employee number the Senior Executive reports to). Example: For employee ‘7586’ with email ‘email address removed for privacy reasons’, the formula currently fills ‘email address removed for privacy reasons’. It first looks at the 4th column of 1577, finds 0, then takes the value in the 6th column (0209) and uses that for the final VLOOKUP. Needed Change: I need the formula to perform an additional VLOOKUP. It should check the 4th column for employee 0209. If it’s still 0, it should look at the 6th column instead. Goal: The new formula should fill ‘email address removed for privacy reasons’ as the manager’s email for employee 7586, not ‘email address removed for privacy reasons’.Can Copilot extract data from a Sharepoint list (to which I have access to)?
In Loop, I asked Copilot to create a table with similar instructions: "Design a table and for each row in the SP list 'A' on the 'Z' SP site that has column 'C' empty and column 'D' with the value mailto:email address removed for privacy reasons add a row to the table with the following columns: column 'f' and 'g' with values as in the SP list 'A' and then the following empty columns 'h','i','l'. Add 5 empty rows at the end" It created the table with just one row and now values extracted from the sharepoint list to which I have access to. Is there a way I can instruct Copilot to do that?Sharepoint List lookup value not adding additional fields values
Hi I have a main list 'Actions Types', where to each type of 'Action Type ID' is assigned a Person (using Person of Group field). Using a JSON code, I created a single text column (named 'Owner Email Address') column where the email address of that person is extracted. Now I have a second list: Actions. Each action has an 'Action type' lookup column so that when the type value is selected (from the 'Action Type ID' list) then the related 'Owner Email Address' is pulled in . No value is added though, the field remains blank. If I add default additional fields such as 'Modified' or 'Created' those are filled correctly. Has anybody some clue while the 'Owner Email Address' values , which is a single text column, are not being pulled in?SCIM User Provisioning : exclude fields from syncing with Azure
Hi, we have setup on Knowbe4 SCIM user provisioning from Azure AD. It works, but now we would like to excluded the manager field from syncing with Azure AD. We edited the SAML SSO configuration on Azure, deleting the manager field from the 'Attribute Mapping' (I put a screenshot below just to give an idea of where we removed the manager's field. NB: this is not a screenshot from our system) list under User Provisioning. We even stopped for a few minutes User Provisioning on Azure and then restarted it, but it still keep syncing and overriding the 'manager's field' and the related manager's email field on Knowbe4 platform. Any idea on how can I stop the manager's field from syncing between Azure AD and Knowbe4 platform?Error when recording a macro (argument is invalid or missing or has an incorrect format)
I'm trying to automate a set of operations in Excel and recorded a macro. The macro gives the following error: Line 56: Range setFormulaLocal: The argument is invalid or missing or has an incorrect format. This is what's on the script on line 56: selectedSheet.getRange("J2").setFormulaLocal("=IF(F2=\"\",\"\",VLOOKUP(IF(VLOOKUP(F2,R2C1:R1400C9,4,FALSE)=0,VLOOKUP(F2,R2C1:R1400C9,6,FALSE),F2),R2C1:R1400C9,9,FALSE))"); When recording the macro I entered this formula on the cell J2: =IF(F2="","",VLOOKUP(IF(VLOOKUP(F2,$A$2:$I$1400,4,FALSE)=0,VLOOKUP(F2,$A$2:$I$1400,6,FALSE),F2),$A$2:$I$1400,9,FALSE)) The formula worked fine while I was recording it. Anybody has any idea what could I have done wrong?VLookup formula based on two columns with condition
Hi I have a list with the following fields: Email Forename Surname Job Title Department Portal Username Management Unit Full Email Address I need to create 2 vlooup columns for manager and manager's email . We have 5 roles (ordered by the lowest to the highest) in the organization (we have more, but 5 is enough to describe the problem that needs to be resolved) Executive, Senior Executive, Department manager, Divisional Manager, CEO The manager field would be filled based on the 'Job Title ' 'Management Unit' and the 'Department'. So if an employee is a department manager, the vlookup fomula should look for the for the row that has the same management unit as the employee and 'divisional manager' in the' job title' field. Then concatenate the last name and the first name in the manager's column cell. If the employee is 'Divisional manager', it should look for the row that has 'CEO' in the 'job title' and then concatenate the last name and the first name in the manager's column cell. If the employee has as a role 'Executive' or 'senior executive' then the formula should look for the column that has the same 'department' value and 'department manager' in the job title. Then concatenate the last name and the first name in the manager's column cell. For each one of those 3 cases it should also fill the 'manager's email' field accordingly (taking the value from the last column 'full email address' ). Do you know if it's possible (and if it is do you have any clues on how) to create such a formula?Excluding custom fields from SAML-based Sign-on
Hi, in my organization we enabled SSO with a third party platform and it's working. We need though to excluded some fields in AD from syncing. We want prevent the following fields from syncing/being managed by ADSync: -Manager -Division -Location -Employee-start-date Does anybody know how we can exclude those fields from the SSO/ADSync?Forms Pro : can't see link to share and colleagues with std version cannot edit my form
Hi, I started the trial with Forms Pro, and created a new Form. Didn't do anything different than when creating forms with the standard version. The problem is that other colleagues with standard version cannot edit my form. They get a blank form, My colleague with Pro paid version can edit it using the same link. Also I miss the link to send to people for submission. Initially the link was there, and I downloaded the QR code, but now I can't see it anymore. Please see the screenshots
