Latest posts

Microsoft 365 Passkey Setup

Microsoft 365 supports hardware security keys with passkeys. Passkeys are sometimes called FIDO2. Passkeys are one of many ways you can secure your accounts.

In this post, I will show you step-by-step how to set up a passkey in Microsoft 365, including configuring a passkey with a break glass emergency access account.

Prerequisites

  • Hardware security key that is FIDO2 compliant. (A common one is YubiKey 5)
  • Microsoft Entra ID Authentication Method for Passkey (FIDO2) and Temporary Access Pass enabled.

The Process

  • Login to Microsoft 365.
  • Click on your account in the top right and click on View account.
  • Click on Security info.
  • Click on Add sign-in method.
  • Select Security key and click Add.
  • Select the type of security key you have.

In this example, I will use a USB device.

  • Plug your security key into your computer and click Next.
  • On the new window select the Security key option to save the passkey to the security key and click Next.

Outlook Email Mover

The way I manage my email might seem a bit strange. Due to working in IT, I get lots of emails. Some emails need action, some are regular emails, and some are notifications I want to know about as soon as they happen. I feel like a normal person would make an Outlook rule to move emails into folders and just check those folders when needed.

The problem I have with dumping emails into folders automatically is when I only have my phone on me, I won’t know if a new email comes in when it’s auto-moved to a folder, so I’d have to keep checking the folders, and that doesn’t work with my workflow.

An example is I get notifications when backups run. If a backup is successful, I have an activated Outlook rule that moves the email into a folder. However, if a backup has an issue or something like that, I want it in my inbox so I see it immediately, no matter what device I’m using.

After I’ve addressed the email, I could move it into a folder. But that is a manual step, I’d rather have an automated way. Also, it doesn’t scale well if you get a lot of emails, and due to the nature of IT and alerts, I get lots of emails for all sorts of things that I want to see, but after I’ve read the email, I want the email to get filed away correctly.

I used to select blocks of emails and move them into folders. However, I’ve accidentally moved an email I needed to reply to into a folder and didn’t notice. If I don’t have a way to move the emails around, an email I need to action could also get lost in the noise of other emails.

A normal person might say to use a different system for alerts. While that’s valid, the issue I have is that’s another system that I’d need to keep checking when I’m not in front of a computer, and I don’t want to do that because I am stubborn and my current system does work, which is why I prefer email notifications.

I expressed the issue of my email clutter to a friend, and they told me about a system they’ve been using to help with it. They use Outlook rules that aren’t enabled to move emails around to different folders. They trigger the rules by using a macro in Outlook.

I tried the Outlook rules macro option, and it worked wonderfully with the one catch you need to enable macros in Outlook. I am worried that having macros enabled in Outlook will increase the attack surface for my account.

Rather than using macros, I found a way to do the same thing but with PowerShell and com objects. This works great, but you have to have Outlook open for it to work, and it doesn’t work with New Outlook. Currently, there doesn’t seem to be any support for com objects in New Outlook.

I went down the rabbit hole of figuring out how I could upgrade the script to support moving emails without using com objects. The rabbit hole led me to Microsoft Graph. With Microsoft Graph, there is a way to retrieve a user’s Outlook rules, but there doesn’t appear to be a way to execute the rules on demand like the macro and com object methods did.

However, Microsoft Graph does support moving emails around. Most of the Outlook rules I use to move emails around are basic rules that can be easily rebuilt using Microsoft Graph. I now have a script that I’m calling Outlook Email Mover that moves emails around based on some provided parameters, which is exactly what an Outlook rule does.

The Script

Outlook Email Mover uses Microsoft Graph to connect to the user’s mailbox and move emails around.

You can find the script on my GitHub https://github.com/thedxt/Outlook-Email-Mover

Prerequisites

How It Works

Outlook Email Mover uses Microsoft Graph to connect to a user’s mailbox. The required scope is "Mail.ReadWrite".

Inside the Outlook Email Mover script is a function called Outlook-email-mover-connector.

The Outlook email mover connector is a function you can use to connect to Microsoft Graph. You can also connect to Microsoft Graph yourself and not use the function as it is optional.

Reset VMware vCenter Root Password

You should always know the root password for your VMware vCenter. Fortunately, if you don’t remember your VMware vCenter root password, there’s a way to reset it.

In this post, I will show you step-by-step how to reset the root password for VMware vCenter.

The Process

  • To be extra safe, take a snapshot of your current vCenter VM.
  • Determine which ESXi host is running your vCenter VM by looking at the related objects and the host listed.
  • Connect to the ESXi host that is housing the vCenter VM.
  • Restart the vCenter VM.
  • When you see the Photon boot screen, press the letter e.

VMware vCenter Disable Root Password Expiry

The root password for VMware vCenter expires every 90 days by default. Depending on your vCenter setup, you may want to disable the root password expiry.

In this post, I will show you step-by-step how to disable the root password expiry for VMware vCenter using the GUI and the CLI.

GUI Way

  • Log in to the vCenter Server Management interface as root (it used to be called the vCenter Server Appliance Management Interface (VAMI)).
  • Click on Administration.

I Went to VMware Explore 2024

This year, I had the exciting opportunity to attend VMware Explore 2024 in Las Vegas from August 26th to August 29th.

I set a few goals for myself for VMware Explore. Those goals were to learn as much as possible about AVI load balancer, VMware Cloud Foundation (VCF), NSX, Kubernetes, and network with other VMware nerds like me. I am happy to report that I achieved those goals. I even met people that I had only ever spoken with online. My brain is so overloaded with information right now, and I love it.

This post will recap my VMware Explore 2024 experience in Las Vegas.

Day 0

The first day of my trip was Sunday, August 25th, and I’m calling this Day 0 as this was essentially a travel day. I flew from the Calgary airport and landed in Las Vegas around 5:45 pm local time.

It was my first time in Las Vegas, so everything was a new experience. The first shock I had was that the airport had gambling machines throughout, even ones in isolated boxes for people to smoke in. I did not expect to see that, but it makes sense, as Las Vegas is known for gambling.

Gambling machines in the Las Vegas airport.

Escaping the airport to the rest of the Las Vegas civilization was an adventure. I needed to take a tram to another part of the airport to get to the doors that would let me out. I thought that was strange as I figured they would just be like exit here, which would be very straightforward.

I then took a cab to the hotel where I stayed, The Palazzo. On the way to the hotel, the cab passed by the Las Vegas Sphere, and holy smokes, is it huge!

The Las Vegas Sphere

The Palazzo is one of two hotels that make up the Venetian Resort. The second hotel is the Venetian. VMware Explore occurred in the Venetian Convention Center, also known as the Venetian Expo.

Outside view of the Venetian Expo

I got checked into the Palazzo and proceeded to find my room. You must cross the entire casino floor to get to the rooms (also called guest suites). I found my way across the casino floor to the guest suite elevators, where you needed to tap your access card before getting to the elevators. I found the bank of elevators that took me to the 35th floor, the floor my room was on.

I dropped off my bags and proceeded to find my way to the VMware Explore registration as it was around 6:15 pm, and registration closed for the day at 7 pm. I wanted to get registered immediately, as I was worried that if I waited until the following day, I might miss out on some sessions. I also wanted to have one less thing to worry about.

The only thing I knew about the location of the VMware Explore registration was that it was at the Venetian Expo and in a ballroom on level 2. I had no idea where any of that was.

Onyx (MLNX-OS) Text Config Export

By default, with Onyx (MLNX-OS), when you export the switch configuration, it is exported as a bin file rather than the regular text-based config files we are all used to. Fortunately, there’s a way to export the configuration as a text file.

In this post, I will show you step-by-step how to generate and export a text-based configuration file from a switch running Onyx (MLNX-OS).

The Process

  • SSH into the switch
  • Run the command enable to elevate yourself
  • Enter configuration mode with the command configure terminal

Before we can run the next command, we need to build it out. First, we tell the Onyx switch to generate a text-based version of the configuration. We will do that with the command configuration text generate

The following option tells the Onyx switch what to use to generate the text config file. We can use an already saved configuration file, or we can use the active configuration. I will use the active configuration. To do this, I will use the active parameter.

Now, we need to specify if we want to use the running config that could be unsaved or the saved version of the running config. If the running config isn’t saved, it’s not real, and I don’t care about it, so I will use the saved option.

Next, we decide if we want the configuration’s expanded version. The expanded version will list everything individually and not use ranges. I like ranges, so I won’t be using the expanded parameter.

Ranged config compared to expanded config

We also need to tell the Onyx switch we want to copy the generated text configuration file off of the switch. We will do that with the parameter upload.

Company Portal Theme

The default theme for Company Portal is fine, but it always looks better when you customize it to match your origination’s theme.

In this post, I will show you step-by-step how to set a theme for Company Portal.

The Process

  • Login to Microsoft Intune admin center
  • Click on Tenant administration
  • Under the End user experiences section, click on Customization.
  • Click on Edit beside settings.
  • Enter your Organization name.
  • Select a Theme color.

The default color for Company Portal is blue.

The default Company Portal Header and color.
  • Select what you would like to see in the header.

I will be selecting Organization logo only as my logo has the organization name in it already.

  • Select a logo for the color-themed background and the white background.

I will be using the same logo for each of them.

Company Portal themed with a logo-only header.

Intune Deploy Windows 11 Default Start Menu

With Windows 11, many visual elements have changed, and one of the most noticeable ones is the Start Menu. With a new star menu comes a new way to manage it. With Windows 10, you can control the start menu with an XML file. Now, with Windows 11, you can control it with a JSON file.

What’s extra interesting is that you still control the taskbar with an XML file. If you want to know how to deploy a default taskbar, my blog post, Intune Deploy Default Taskbar, covers how to do that.

There are a few pitfalls when you control the Windows 11 Start Menu. The first one is that users will no longer be able to pin anything extra to the Start Menu.

The option to Pin to Start is no longer available

Another pitfall is that users can technically reorder the applications you pin in the start menu but the next time they log in, it is reset to the layout you defined.

In this post, I will show you step-by-step how to deploy a Windows 11 default Start Menu layout using Microsoft Intune.

Building the Start Layout

  • On a source system, pin the applications to the start menu in the order you want.
  • Export the Start Menu layout by running the following PowerShell command Export-StartLayout -path C:\temp\Win11-Start.json

Intune Deploy Company Portal for Windows

The Company Portal application is a wonderful tool for Microsoft Intune. If you come from the world of ConfigMgr (Microsoft Configuration Manager aka SCCM (System Center Configuration Manager)), it is the Intune version of Software Center.

Company Portal allows users to install programs you publish on the Company Portal. My favorite part is that the users don’t need local admin to install the applications you make available to them.

You can also make Company Portal do more than just install applications for users on demand. For example, it can allow users to factory reset their devices or retrieve their own BitLocker keys.

There are three main ways to deploy the Company Portal on Windows.

  1. Online Company Portal as System-based
  2. Online Company Portal as User-based
  3. Offline Company Portal

The original method for deploying Company Portal was to use the Microsoft Store for Business. At the time two options existed: the Offline Company Portal and the Online Company Portal. The main difference between the two was that the Offline Company Portal could use device-based licensing and could be installed system-based, while the Online Company Portal was user-based.

With the deprecation of the Microsoft Store for Business, the current Microsoft Store was updated with a new method for deploying the Online Company Portal. This method includes system and user based deployments, allowing us to achieve the same results as the old Microsoft Store for Business.

System vs User

A system-based Company Portal deployment makes the most sense when the organization fully owns the device or when items like Windows Autopilot are used.

A user-based Company Portal deployment makes sense when the device is a BYOD setup.

The difference between the two is that the system-based deployment of Company Portal only needs to be done once per system, which can help speed up login times. The user-based deployment needs to install Company Portal for each user that uses the system, which can result in users waiting for Company Portal to install, which can be a pain for shared devices like meeting rooms.

Offline Company Portal

The need for the Offline Company Portal is rare but can still be useful in some situations. Typically the Offline Company Portal is used in situations where the Microsoft Store is disabled or can not be used for various reasons.

What sets the Offline Company Portal apart from the Online Company Portal is that it does not use the Microsoft Store to install itself. Instead, it uses the Microsoft Intune Management Extension. The Offline Company Portal will require manual updates when new versions are released.

In this post, I will show you step-by-step how to deploy the Company Portal for Windows using Microsoft Intune.

The Process

  • Log in to the Microsoft Intune admin center.
  • Click on Apps.
  • Click on All Apps.
  • Click on Add.

Windows Update Settings Stuck

Usually, when you want to control the Windows Update settings, you create a GPO to manage the settings or tweak some registry entries. Both methods alter the registry values in the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdateCode language: plaintext (plaintext)

To reset any custom Windows Update settings, I nuke out that registry key or reverse the GPO or both, and restart the Windows Update service, and everything would be good. However, that process stopped working consistently.

At some point, Microsoft tweaked something, and now there’s a scheduled task named Refresh Group Policy Cache. It’s unclear which update added this to systems, but it impacts Windows 10, Windows 11, and Windows Servers.

What is Refresh Group Policy Cache?

The Refresh Group Policy Cache is a scheduled task in the task scheduler under Microsoft > Windows > WindowsUpdates. It seems to be a custom scheduled task that uses the DLL %systemRoot%\system32\updatepolicy.dll.

Refresh Group Policy Cache scheduled task

I don’t know everything the DLL does but what I do know is that it is a Microsoft DLL, and its internal name is Update Policy Reader. I tried to find more information about it, but there isn’t much, and I’m not good at decompiling DLLs.

I did find the MUI file for the DLL. The MUI has a list of strings that provide an idea of the DLL’s purpose.

100 None<br />101 Set branch readiness level<br />102 Set period to defer Feature Update<br />103 Set period to defer Quality Update<br />104 Enable Update Pause<br />105 Branch readiness level<br />106 Enable Quality Update deferral<br />107 Quality Update deferral period<br />108 Enable Feature Update deferral<br />109 Feature Update deferral period<br />110 Pause Feature Updates<br />111 Pause Quality Updates<br />112 Exclude drivers from Windows Quality Updates<br />113 Start date for pausing Quality Updates<br />114 Start date for pausing Feature Updates<br />115 End date for pausing Quality Updates<br />116 End date for pausing Feature Updates<br />117 Enable Auto Restart deadline<br />118 Auto Restart deadline<br />119 Auto Restart deadline for Feature Updates<br />120 Disable check for updates by user<br />121 Enable Active Hours maximum range<br />122 Active Hours maximum range<br />123 Enable the method by which the auto restart required notifications are dismissed<br />124 Dismissal method for auto restart required notifications<br />125 Configures Auto Restart reminder schedule<br />127 Time period for displaying Auto Restart reminder notification<br />128 Turn off Auto Restart notification<br />129 Configure Auto Restart deadline warning notifications schedule<br />130 Time period for displaying Auto Restart deadline reminder notification<br />131 Time period for displaying Auto Restart deadline warning notification<br />133 Enable Auto - restart to Engaged restart transition schedule<br />134 Auto restart to Engaged restart transition schedule<br />135 Engaged restart snooze schedule<br />136 Engaged restart deadline<br />137 Auto restart to Engaged restart transition schedule for Feature Updates<br />138 Engaged restart snooze schedule for Feature Updates<br />139 Engaged restart deadline for Feature Updates<br />140 Enable skipping battery checks for EDU devices<br />141 Allow updates to be downloaded automatically over metered connections<br />142 Do not allow update deferral policies to cause scans against Windows Update<br />143 Disable Pause updates by user<br />144 Enable automatic wake up to install scheduled updates<br />145 Display options for update notifications<br />146 Specifies the number of days before Quality Updates are installed on a device automatically<br />147 Specifies the number of days before Feature Updates are installed on a device automatically<br />148 Allows device to have an additional grace period until restarts occur automatically for Quality Update installation<br />149 Do not attempt to auto reboot device outside of active hours before the deadline is reached<br />150 Target Version for Feature Updates<br />151 This setting specifies that a device that is configured with DeferFeatureUpdatesPeriodInDays or BranchReadinessLevel policies to skip safeguards.<br />152 Allows device to have an additional grace period until restarts occur automatically for Feature Update installation<br />1000 Microsoft Corporation.<br />1001 This task is used to refresh group policy cache in Windows UpdateCode language: Basic (basic)

By playing around, I think I have a basic idea of what the scheduled task is doing. It seems that the Refresh Group Policy Cache scheduled task queries the values in the registry key

HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdateCode language: plaintext (plaintext)

and duplicates them to a cache location of CacheSet001 or CacheSet002 in the registry key

HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCacheCode language: plaintext (plaintext)

What it takes to trigger that scheduled task, I’m not sure.

In my testing, there can only be two cache sets, and only one can be active. The value that controls which cache set is active is the REG_DWORD named ActiveCache. The number defined in the data value indicates which cache will be used.

The active cache in GPCache is CacheSet001

The Issue

The problem with Refresh Group Policy Cache is that sometimes Windows Updates ignores the settings defined in

HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdateCode language: Ada (ada)

and instead honors the settings of the active cache in

HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCacheCode language: plaintext (plaintext)

This issue can impact any system with custom Windows Update settings. Also, it impacts systems imaged with ConfigMgr (Microsoft Configuration Manager aka SCCM (System Center Configuration Manager)) task sequences.