If you ever wondered if there is a cooler or faster way to update a computer’s group membership without having to reboot: well there is. If you delete or “purge” the kerberos tickets on the machine and then perform a gpupdate, the client is going to retrieve a new kerberos ticket with the new group membership.
Here are the two (well, if have never heard of gpupdate /force):
On the first day of a new year (for me it was the second day) Microsoft gave us a present to work on that affects Exchange servers. Affected systems could not send or receive mails, messages would get stuck in message queue with the error “Message deferred by categorizer agent”. Here are the two relevant event viewer entries:
The issue here is that the malware filter could not scan the message because of this error (it has to do with date time not fitting into 32 bit integers anymore) and the message would not get sent to the recipient. To temporarily resolve the issue, you can disable antimalware.
The key needs to be set on your print server. Remember that by setting this key, you will effectively re-open the print nightmare security flaw by downgrading your security level on the server. If you want a persistent fix, you should use type 4 printer drivers, which do not need admin rights on the client side. Admin rights are needed if you have type 3 printer drivers.
Have you ever gotten this annoying error when trying to open old control panel settings from the new settings app? This usually occurs in a domain environment.
You can fix this by creating a Domain policy or locally through secpol.msc > Local Policies > Security Options > User Account Control: Admin Approval Mode for the Built-in Administrator account:
Azure AD App Proxy allows you to publish an internal website to the internet. It is easy to set up and does not require inbound firewall rules. Traditionally, you would publish a website with the help of a reverse proxy, for example with Citrix Netscaler/ADC, KEMP Loadbalancer or F5.
In the Azure AD Portal (aad.portal.azure.com) open Application Proxy and firstly install the software on a server in the corporate network. Domain join is not a requirement, but is needed if you use Kerberos authentication.
You will need to log in with your tenant admin (or a M365 user that has the appropriate role).
After the installation, you should see the server in Azure AD App Proxy:
To then publish your site, select + Configure an app
Provide the internal URL along with the protocol (HTTPS or HTTP). You could select Azure AD in Pre Authentication and work with conditional access policies and require MFA for example. This example is using Passthrough Authentication.
Also some basic settings can be changed. To publish the site, hit + Add
After a few minutes, your site should be available:
You can also configure custom domains by verifying your domain(s) in Microsoft 365 by uploading your public certificate with the private key (pfx) and configuring the appropriate DNS record. For detailed information, check out the Microsoft docs below.
