The root password for VMware vCenter expires every 90 days by default. Depending on your vCenter setup, you may want to disable the root password expiry.
In this post, I will show you step-by-step how to disable the root password expiry for VMware vCenter using the GUI and the CLI.
By default, with Onyx (MLNX-OS), when you export the switch configuration, it is exported as a bin file rather than the regular text-based config files we are all used to. Fortunately, there’s a way to export the configuration as a text file.
In this post, I will show you step-by-step how to generate and export a text-based configuration file from a switch running Onyx (MLNX-OS).
enable to elevate yourself
configure terminal
Before we can run the next command, we need to build it out. First, we tell the Onyx switch to generate a text-based version of the configuration. We will do that with the command configuration text generate
The following option tells the Onyx switch what to use to generate the text config file. We can use an already saved configuration file, or we can use the active configuration. I will use the active configuration. To do this, I will use the active parameter.
Now, we need to specify if we want to use the running config that could be unsaved or the saved version of the running config. If the running config isn’t saved, it’s not real, and I don’t care about it, so I will use the saved option.
Next, we decide if we want the configuration’s expanded version. The expanded version will list everything individually and not use ranges. I like ranges, so I won’t be using the expanded parameter.
We also need to tell the Onyx switch we want to copy the generated text configuration file off of the switch. We will do that with the parameter upload.
The default theme for Company Portal is fine, but it always looks better when you customize it to match your origination’s theme.
In this post, I will show you step-by-step how to set a theme for Company Portal.
The default color for Company Portal is blue.
I will be selecting Organization logo only as my logo has the organization name in it already.
I will be using the same logo for each of them.
With Windows 11, many visual elements have changed, and one of the most noticeable ones is the Start Menu. With a new star menu comes a new way to manage it. With Windows 10, you can control the start menu with an XML file. Now, with Windows 11, you can control it with a JSON file.
What’s extra interesting is that you still control the taskbar with an XML file. If you want to know how to deploy a default taskbar, my blog post, Intune Deploy Default Taskbar, covers how to do that.
There are a few pitfalls when you control the Windows 11 Start Menu. The first one is that users will no longer be able to pin anything extra to the Start Menu.
Another pitfall is that users can technically reorder the applications you pin in the start menu but the next time they log in, it is reset to the layout you defined.
In this post, I will show you step-by-step how to deploy a Windows 11 default Start Menu layout using Microsoft Intune.
Export-StartLayout -path C:\temp\Win11-Start.json
The Company Portal application is a wonderful tool for Microsoft Intune. If you come from the world of ConfigMgr (Microsoft Configuration Manager aka SCCM (System Center Configuration Manager)), it is the Intune version of Software Center.
Company Portal allows users to install programs you publish on the Company Portal. My favorite part is that the users don’t need local admin to install the applications you make available to them.
You can also make Company Portal do more than just install applications for users on demand. For example, it can allow users to factory reset their devices or retrieve their own BitLocker keys.
There are three main ways to deploy the Company Portal on Windows.
The original method for deploying Company Portal was to use the Microsoft Store for Business. At the time two options existed: the Offline Company Portal and the Online Company Portal. The main difference between the two was that the Offline Company Portal could use device-based licensing and could be installed system-based, while the Online Company Portal was user-based.
With the deprecation of the Microsoft Store for Business, the current Microsoft Store was updated with a new method for deploying the Online Company Portal. This method includes system and user based deployments, allowing us to achieve the same results as the old Microsoft Store for Business.
A system-based Company Portal deployment makes the most sense when the organization fully owns the device or when items like Windows Autopilot are used.
A user-based Company Portal deployment makes sense when the device is a BYOD setup.
The difference between the two is that the system-based deployment of Company Portal only needs to be done once per system, which can help speed up login times. The user-based deployment needs to install Company Portal for each user that uses the system, which can result in users waiting for Company Portal to install, which can be a pain for shared devices like meeting rooms.
The need for the Offline Company Portal is rare but can still be useful in some situations. Typically the Offline Company Portal is used in situations where the Microsoft Store is disabled or can not be used for various reasons.
What sets the Offline Company Portal apart from the Online Company Portal is that it does not use the Microsoft Store to install itself. Instead, it uses the Microsoft Intune Management Extension. The Offline Company Portal will require manual updates when new versions are released.
In this post, I will show you step-by-step how to deploy the Company Portal for Windows using Microsoft Intune.
Palo Alto Networks firewalls often require a device certificate. A device certificate is needed for items like device telemetry and for some of the CDSS (Cloud-Delivered Security Services) items, such as WildFire, DNS and URL filtering, and others.
In this post, I show you step-by-step how to check if a device certificate is installed and how to install a device certificate on a Palo Alto Networks firewall.
Before we proceed with installing the device certificate, we should double-check whether the firewall already has one.
show device-certificate statusIf the result is No device certificate found, move ahead with installing the device certificate.
With the GUI, you can also check if a device certificate exists in another place.
If there is no device certificate installed, we can move ahead with installing the device certificate.
Microsoft recently introduced the public preview of External Authentication Methods in Microsoft Entra ID. I am very excited about External Authentication Methods as they finally allow third-party MFA providers like Cisco Duo to integrate better with Microsoft Entra ID (formerly Microsoft Azure AD).
Microsoft has supported third-party MFA providers for years. The original method for adding external MFA providers is Custom Controls, which was introduced in 2017 as a public preview.
As MFA grew in necessity, the limitations of Custom Controls became apparent. In 2020, Microsoft announced that Custom Controls would not leave public preview but a new solution that addressed its limitations would be created. In May of 2024, the replacement solution External Authentication Methods (EAM) was released as a public preview.
EAM addresses the limitations with Custom Controls, such as satisfying the Multifactor authentication requirement in a conditional access policy rather than using a custom control. EAM is a big deal, as the Entra sign-in logs show Custom Controls as a single-factor authentication when that is not true. I suspect this is because Microsoft has no way of validating whether MFA was completed or not.
Here’s an example of the Entra ID Sign-in logs with Duo using a Custom Control that reports as a Single-factor authentication.
If we drill into more details under the Basic info tab, we will still see that the login is reporting as single-factor authentication.
If we look at the Authentication Details tab, we will see nothing. I suspect this is because Entra has no way of knowing what happened on the Duo side of things, only that Duo said yup this user is good move along.
If we look at the Conditional Access tab, we finally see that Duo was applied with the custom control and that the result was a success.
The issue of Custom Controls reporting as single-factor authentication in the sign-in logs is resolved with EAM.
Using EAM, we can now directly use third-party MFA solutions like Cisco Duo as an MFA option in Microsoft Entra Authentication methods, allowing us to use the MFA setting in a conditional access policy instead of a custom control. This even allows you to be more granular with the accepted forms of MFA, such as allowing Windows Hello rather than just Duo to grant MFA.
External Authentication Methods is currently in preview. However, everything seems to be working correctly in my testing.
In this post, I will show you step-by-step how to set up Cisco Duo with External Authentication Methods in Microsoft Entra ID.
Microsoft 365’s Stay signed in option is designed for user convenience but can increase security risks when used on public or non-corporately owned devices. The risk is due to the potential for unauthorized access to the user’s account and the resources they have access to.
The stay signed in option, also known as KMSI (Keep Me Signed In), stores a cookie on the device for around 90 days when the user selects Yes to KMSI. When the cookie’s lifetime is active, users will see fewer prompts to log in with their Microsoft 365 account and fewer MFA prompts, this can pose a security risk on shared or public devices.
For corporate devices that are Microsoft Entra joined or Microsoft Entra Hybrid joined, the impact of removing the stay signed in option is minimal, as these devices already participate in Microsoft Entra SSO, which reduces the number of times users need to log in with their Microsoft 365 account when accessing Microsoft 365 web resources.
Turning off the stay signed in option in Microsoft 365 can help reduce your attack surface. This helps prevent users from accidentally selecting Yes to KMSI and can positively impact an audit or penetration test.
In this post, I will show you step-by-step how to remove the Stay signed in? option in Microsoft 365.
Palo Alto Networks has this awesome program called the User Identification Agent, aka the User-ID Agent. It allows you to identify which device a user is using, allowing you to craft security policy rules based on the users themselves.
In this post, I will show you step-by-step how to upgrade the Palo Alto Networks User-ID Agent.
The User-ID Agent is typically compatible with the same release number along with earlier still-supported PAN-OS versions. For example, User-ID agent 11.0 works with PAN-OS 11.0 and earlier. You can confirm this by reading the OS Compatibility section in the release notes.
Active Directory is very much a database. It even has a schema to define what can and can’t be created and how everything is related and linked. An oversimplification is that the Active Directory schema is the rules about the types of items you can make in Active Directory, and this also includes the available attributes for each item.
Your schema level (or schema version) is not your domain functional level or forest functional level. The schema level doesn’t always match the domain functional level or the forest functional level.
Windows Server 2019 and Windows Server 2022 both operate at the domain and forest functional level of Windows Server 2016. Even though a server running Windows Server 2019 or Windows Server 2022 has a functional level of Windows Server 2016, its schema version is higher than Windows Server 2016.
In this post, I will show you step-by-step how to check your AD schema level using the GUI or PowerShell and how to translate the output to the corresponding Windows Server version.
