If a computer is in an Active Directory Domain environment with Exchange On-Prem installed, Outlook clients might connect to local Exchange instead of Exchange Online, because they query Active Directory first.
This Registry key will avoid SCP Lookup in Active Directory.
So here is a challenge I had to face today: I created a virtual machine (VM) in Azure from a custom image that was previously Sysprep’d by me. The image contained several applications intended to run on a RDSH (Remote Desktop Session Host) for Citrix Virtual Apps and Desktops (former XenApp), so the RDS role was also installed. The VM was not part of the domain, it was in a Workgroup and it could not reach the RDS license server. Which meant: I could not RDP into the machine to perform Domain Join. And if you already have some experience with Microsoft Azure, you will know that there is no Remote Console like in VMware or Hyper-V.
The VM was still reachable over the network. So here are four PowerShell commands that allowed me to remotely perform a Domain Join on that particular machine. Nothing fancy, but it might come in handy.
This credential variable stores the local username and password of the computer. Something like computername\admin along with the password.
$Cred = Get-Credential
Add-Computer -DomainName “ajni.lab” -Restart
After executing the last command you will be prompted to insert domain credentials. The user obviously must have the right to create computers in the domain.
What is DNS over HTTPS ? Well it’s basically an encrypted way of querying DNS. Normally DNS uses port 53 to communicate with the server and query the name we want. But all of that traffic is in plain-text and thus it is very easy to poison that communication. DNS over HTTPS is secure because it uses certificates to encrypt traffic (just like HTTPS websites).
Mozilla Firefox makes it very easy to enable this feature. Just open the settings and search for “DNS over HTTPS”:
I was trying to enable Bitlocker on my C: drive, but unfortunately my PC does not have a physical TPM chip built-in. Turns out there is a way to enable Bitlocker Drive Encryption without the TPM chip with help of Group Policies.
Open Local Group Policies (gpedit.msc) > Administrative Templates > Windows Components > Bitlocker Drive Encryption > Operating System Drives > Require additional authentication at starutp
Enable this Policy and leave the default settings.
Now in Windows Explorer, Bitlocker can be turned on:
Because there is no TPM chip available, we either have the option to enter a password every time the OS boots or unlock the drive with a USB flash drive.
I got tasked with installing a brand new Windows Server 2019 with the Remote Desktop Services (RDS) role. It was a pretty straightforward installation, but minor things might work differently compared to previous versions of Windows Server (I was migrating off Windows Server 2012 R2).
Start by adding the RDS role through Server Manager.
Select the RDS installation:
I went for the Quick Start because my deployment is fairly basic.
Session-based deployment enables multi-session support on the server.
The server should be automatically selected.
The three roles (RD Connection Broker, RD Web Access and RD Session Host) will be installed.
After the installation a license warning will be shown in the Notification Center.
Two things are needed in order for licensing to work properly: The license server and licensing mode. In a production environment, usually there is a separate server hosting the RDS Licensing service.
Make sure you select the server by moving it to the right with the arrow.
In a production environment a custom group should be used to control the number of permitted users.
User profile disks were not needed in my environment.
After the creation, there are some things that should be changed in the Collection properties (Server Manager > Remote Desktop Services > Collections > Collection Name):
These are my specific settings, you should change the parameters based on your experience or leave them at their default values.
Older clients might have problems with these security settings (like Network Level Authentication – NLA)
