I use PuTTY a lot and sometimes I want to log my changes as I make them or I want a quick and dirty way to get a config file off a device. In this post, I will show step-by-step how to log the PuTTY output to a log file.
For whatever reason the default fresh setup of Microsoft 365 has no audit logging turned on. Audit logging is very useful for IT troubleshooting and auditors love logs.
Microsoft says that it is enabled by default for Microsoft 365 and Office 365 enterprise organizations. I suspect that means only if you have E1 or higher. The new tenants I’ve made recently are not E1 or higher, that could be why I didn’t see it already on.
Someone asked for clarification about this on GitHub however the replies all say that it is on by default for everything but that isn’t true based on my experience. You can read the GitHub issue here.
Microsoft’s documentation also says to double check that audit logging is enabled which you 100% should be doing as if it’s on or not seems inconcistant.
In this post I will detail how to check if audit logging is enabled and how to enable it via the Web UI or PowerShell.
If audit logging isn’t enable the page will look something like this.
Audit Logging is now enabled it may take a bit for it to actually start working.
Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled
In my example the returned result is false so audit logging isn’t enabled and we want to turn that on.
…
I ran into an issue where some older Cisco Aironet APs (Access Points) stopped connecting to a Cisco WLC (Wireless LAN Controller). No config changes had been made and some of the Cisco Aironet APs would connect and some wouldn’t. All of them were the same model, the Cisco Aironet APs were able to ping the Cisco WLC and vice versa.
What happened is the Cisco MIC (Manufacture Installed Certificate) expired and the default setup of a Cisco WLC is to reject any Cisco Aironet AP with an expired MIC.
It looks like this could impacts every Cisco WLC when used with older Cisco Aironet APs that have an expired Cisco MIC. Cisco has a Field Notice about this issue, you can read it here FN63942.
Any Cisco Aironet AP that was manufactured from July 18, 2005 until 2017 will have a Cisco MIC that expires 10 years after the manufacture date. There seems to be no way to replace or renew that Cisco MIC, this will keep being an issue that could randomly show up until 2027 when all of them should be broken.
The reason some of my Cisco Aironet APs worked and some didn’t is because they were manufactured at different times even though they have the same model number.
The fix is super quick we just need to tell the Cisco WLC to ignore expired Cisco MICs.
…
Something that’s annoyed me with FortiGates is that viewing the deny logs isn’t super straight forward. Part of the issue is the fact that Fortinet disables the deny log by default and if you don’t know where to look for it you might not figure it out by clicking around.
Fortinet says that they have the deny logs off by default to optimize the usage of logging space. I however want to see as much info as possible when possible, especially when troubleshooting.
Thankfully turning it on is easy, here’s how to do it and view it.
…