We use cookies on this page to better serve you. You can find more information about cookies here.

Latest posts

Create Active Directory Central Store
by

The default setup of Windows Active Directory is no central store. A central store is a central place to store your group policy definitions. If you only have one domain controller and make all your GPOs (Group Policy Objects) on that domain controller this likely wouldn’t be much of a problem.

The limitations start to show their faces when you have a second domain controller or you use a different system to make your GPOs. They also show up if you import GPOs that were build using newer group policy definitions. If you want to know how to import GPOs from another system I detailed the full process in a post called GPO Export and Import.

When you create or edit a GPO with the Group Policy Management Editor it checks to see if it can find a central store, if it can’t find one or if none exist it uses the group policy definitions from your computer which are stored in C:\Windows\PolicyDefinitions.

GPO not using the central store

Here’s how to create an Active Directory Central Store for all your group policy definitions on your domain.

…
Read more
IT
Active DirectoryCentral StoreGPOHow ToMicrosoft

Moving Windows Recovery Partition Correctly
by

Recently I needed to expand a disk on a Windows 10 VM and a Windows Server 2022 VM, but I couldn’t because the Recovery Partition was in the way.

When searching for a way to do this I discovered that the internet is full of posts about simply deleting the Windows Recovery Partition. I am not a fan of simply deleting a recovery tool. On numerous occasions the recovery partition has been instrumental in helping me to fix a system.

If you search for how to move the Windows Recovery Partition the internet has many posts of fake ways to do it or ways to do it with third-party tools like GParted. I have nothing against third-party tools or GParted and I don’t doubt some of those methods do work. The issue I have with those methods is that you have to take the system offline in order to do them or the tools cost money.

Now yes you could just delete the Windows Recovery partition, but before you do that make sure you understand that you will lose a bunch of recovery options. You can read more about the recovery options you’ll lose in an earlier post I made about the Windows Recovery Partition.

Here’s how to correctly move the Windows Recovery Partition on a Windows server or a normal Windows system.

…
Read more
IT
EUCHow ToMicrosoftRabbit HoleRecoveryServersVirtual MachinesWindowsWindows Server

Microsoft 365 Enable Organization Customization
by

Right out of the box the initial configuration of Microsoft 365 (aka Office 365) isn’t bad, but there’s a lot more you can do to harden it and to make it fully yours.

By default all Microsoft 365 tenants are in a state that is called dehydrated. Microsoft places all the tenants in this state in order to save space, as there are likely many Microsoft 365 tenants that will never change anything past the defaults, but that’s no fun.

In order to rehydrate our Microsoft 365 tenant to allow for a whole number of customizations we need to enable something that is called organization customizations.

Once we have enabled organization customizations we will be able to customize a lot more things in our Microsoft 365 tenant.

Here’s how to do that.

The Process

  • Connect to Exchange Online with PowerShell
  • Double check the hydration status of your Microsoft 365 tenant by running the following command Get-OrganizationConfig | FL isDehydrated
…
Read more
IT
CustomizeExchange OnlineHow ToMicrosoftMicrosoft 365Office 365PowerShell

Intune Silently Enable BitLocker
by

When you are managing devices with Microsoft Intune aka Microsoft Endpoint Manager it’s great to control BitLocker but silently enabling BitLocker for all devices is even better.

Here is everything you need to know to silently enable BitLocker with Intune.

Disk Encryption Policy Profile

First up we need to create a disk encryption policy profile that we can use later on with our configuration profile. The Disk Encryption Policy Profile by itself really does nothing other than defining the settings that will apply when referenced by a configuration profile.

  • Login to Microsoft Intune admin center
  • Click on Endpoint Security
  • Click on Disk encryption
  • Click on Create Policy
…
Read more
IT
BitLockerEUCHow ToIntuneMicrosoftMicrosoft Endpoint ManagerWindows

VMware Horizon Customize Web Portal
by

VMware Horizon’s web portal has a decent appearance out of the box. However, I wanted to customize it to make it look like my own.

If you have a customized login background on your Microsoft 365, it could be beneficial to create a consistent end-user experience by making them look similar.

I couldn’t find any official documentation from VMware about this. I suspect the customizations might break when you upgrade to a new version of VMware Horizon. With all of that aside altering the images on the HTML portal is actually really straightforward.

Here’s how to change the default background and the default logo on the VMware Horizon HTML web portal.

  • Go to your current VMware Horizon web portal and right click on the VMware Horizon logo and select Open image in new tab
  • You will now have a new tab that has a URL that looks something like this horizon.yourwebsite.com/portal/webclient/icons-21414280/logo.png
…
Read more
IT
CustomizeEUCHow ToOmnissaOmnissa HorizonVMwareVMware Horizon

ESXi Config Restore
by

Having a backup is great, but it only helps if you know how to restore it. Previously I showed you how to take an ESXi Config Backup. Now let me show you the process to restore that ESXi config backup.

The Process

  • Make a note of your current ESXi build number and the build number of the ESXi config backup file.

If you aren’t sure how, here’s a post I made about how to get your ESXi Build Number without vCenter for your current ESXi and your ESXi config backup file.

Your current ESXi build number and the ESXi build number in the ESXi config backup file must match.

Technically you can still restore with mismatching build numbers however that is a bug and it could cause unexpected behavior and based on VMware’s documentation it would likely not be supported if something goes wrong later on.

You can read more about this bug on my post called ESXi Config Restore Bug.

  • Rename the ESXi config backup file you want to restore to configBundle.tgz
  • Enable SSH by right clicking on the host and selecting Services > Enable Secure Shell (SSH)
…
Read more
IT
ESXiHow ToRestoreVMware

Onyx (MLNX-OS) BIOS Password Reset
by

Recently I’ve been playing with some Nvidia/Mellanox switches specifically the SN2410. An issue that I ran into was that I didn’t have the BIOS password.

All of the documentation says that the default BIOS password is admin. That password did not work on my switch.

You can absolutely use the switch even without the BIOS password, however it may limit some of your options in the future specifically recovery options if needed.

The documentation that I found says that if the default password doesn’t work you need to contact Mellanox/Nvidia support. The issue with that is I’m playing with this switch in my home lab so I don’t exactly have a support contract to contact support.

I took the switch apart and there doesn’t appear to be a CMOS battery to pull to clear the BIOS either. There might be a jumper for it but it wasn’t obvious which one it might be and I didn’t want to risk breaking it.

Inside the SN2410 switch

In the end I ended up figuring out a way to reset the BIOS password back to default.

Here’s how to do it.

…
Read more
IT
BIOSHow ToMellanoxMLNX-OSNetwork OSNetworkingNvidiaOnyxSwitch

Intune Dynamic Device Groups
by

Intune aka Microsoft Endpoint Manager can be extremely powerful but as it always goes with great power comes great responsibility.

To make sure I’m only targeting the devices I want, I like to make a few dynamic device groups that I’ll use for various Intune policy targeting.

The dynamic device groups I create are:

  • Windows AAD Joined for all the Windows devices joined to Azure AD.
  • Windows Hybrid AAD Joined for all the Windows devices that are hybrid joined to Azure AD.
  • Windows AAD Registered for all the Windows devices that are registered to Azure AD this is typically BYOD (Bring Your Own Device).
  • Windows Personal for all the personal Windows devices.

By creating these groups I can correctly target my Intune policies to always have the intended outcome.

Here are the dynamic membership rules I use for the dynamic device groups.

…
Read more
IT
Active DirectoryAzure ADDynamic GroupIntuneMicrosoftMicrosoft Endpoint ManagerWindows

Lenovo Remote Physical Presence
by

On Lenovo servers the default configuration has a physical presence policy enabled. When a physical presence policy is enabled it prevents you from doing a few tasks on the system either in BIOS or IPMI. Lenovo calls their IPMI XClarity Controller (XCC).

With an enabled physical presence policy your only options to do some of those task is to either physically go move a jumper on the motherboard or to make some tweaks in XCC or BIOS to assert your physical presence even if you are remote.

Here’s how to do it in IPMI or BIOS.

…
Read more
IT
BIOSHow ToIPMILenovoThinkServerXClarity

Upgrading Duo Authentication for Windows Logon
by

Duo Authentication for Windows Logon and RDP is great tool that I like to use to add MFA to Windows systems specifically servers, as it could help prevent lateral movement in the network.

When you only have a few systems running Duo Authentication for Windows Logon and RDP upgrading it is short and painless. When you have many systems it can be a bit of a painful process as the only method seems to be to do it manually.

Naturally to solve this I wrote a PowerShell script to do the work.

PowerShell Script

The PowerShell script will check if Duo Authentication for Windows Logon is installed. If no Duo Authentication for Windows Logon install is found it will just exit.

…
Read more
ITScripts
CiscoDuoDuo WinlogonMFAPowerShellScriptUpdateUpgrade
theDXT on GitHub
theDXT on X (Twitter)
theDXT on YouTube