SQL Server 2019 Express Installation

Hi All,

For a Project, i have installed SQL Server 2019 Express. Here are the Screenshot from the Installation.

Editions and supported features of SQL Server 2019 (15.x)





I choose "custom" to see all the Settings

















Here is where you would normally choose to place the Data on a diffrent Drive. As this is only a Test System i won't do that.











Let's see if we can connect

sqlcmd /?
sqlcmd -S ICESRV04\SQLEXPRESS -E -Q "Select @@Version"



Regards
Andres Bohren


Exchange Online Litigation Hold an Licensing

Hi All,

I've recently had to deal with Litigation Hold. So i did a bit of research.

Place a mailbox on Litigation Hold

When a mailbox is placed on Litigation Hold, items in the Purges subfolder are preserved for the hold duration specified by the Litigation Hold. The hold duration is calculated from the original date an item was received or created, and defines how long items in the Purges subfolder are held. When the hold duration expires for an item in the Purges subfolder, the item is marked for permanent deletion and will be purged from Exchange the next time the mailbox is processed by the Managed Folder assistant (MFA). If an indefinite hold is placed on a mailbox, items will never be purged from the Purges subfolder.


What threw me of, was the Statement for Licensing. I didn't quite understand when a License is needed.


Learn about inactive mailboxes

What are inactive mailboxes?
When an employee leaves your organization (or goes on an extended leave of absence), you can remove their Microsoft 365 account. The employee's mailbox data is retained for 30 days after the account is removed. During this period, you can still recover the mailbox data by undeleting the account. After 30 days, the data is permanently removed.

But if a hold is applied to the mailbox prior to deleting the Microsoft 365 account, the mailbox will be converted into an inactive mailbox. The following sections contain information about holds that can be applied with Microsoft 365 retention and eDiscovery holds.

My initial thought regarding Licensing was: How do you assign a License to a Mailbox when the User Account has been deleted?

Let's put it to the Test

Syncronized Mailbox from OnPrem

User1 is a syncronized User from Active Directory and has a Mailbox in Exchange Online (Exchange Hybrid)

Connect-ExchangeOnline
Get-Mailbox User1 | ft Name, Primary*, RecipientTypeDetails
Get-MailboxStatistics User1
Set-Mailbox -Identity User1 -LitigationHoldEnabled $true -LitigationHoldDuration 365

Then i deleted the Account in Active Directory

CloudOnly Mailbox

I've created a User "cloudservice" in Azure Active Directory and enabled the Mailbox on that Account.
It's a SharedMailbox and therefore does not require a License

Connect-AzureAD
Get-AzureADUser - Searchstring "CloudService" | fl Name, UserPrincipalName, *sync*

Connect-ExchangeOnline
Get-Mailbox *CloudService* | ft Name, Primary*, RecipientTypeDetails

Set-Mailbox -Identity CloudService -LitigationHoldEnabled $true -LitigationHoldDuration 365

Ah now i understand, you need to add a License, before you can put the Mailbox in Litigation Hold


I have assigned a "Exchange Online Plan 2" License


Then i put the Mailbox in Litigation Hold - this time it would work

Set-Mailbox -Identity CloudService -LitigationHoldEnabled $true -LitigationHoldDuration 365


After a couple of Hours i've deleted the CloudOnly Account in Azure Active Directory. The used License was released again after the Account was deleted.


The Mailboxes have turned into Inactive Mailboxes

Get-Mailbox -InactiveMailboxOnly | fl name, WindowsEmailAddress, Lit*


As you can see, there is a Mailbox "Hans.Muster@icewolf.ch" witch has been put into Litigation Hold on 25.11.2020 with a Litigation Hold duration of 365 Days.Time since has been passed these 365 Days.

To delete the Mailbox finally the Litigation Hold has to be released.

Set-Mailbox -Identity Hans.Muster@icewolf.ch -InactiveMailbox -LitigationHoldEnabled $False


Now the Mailbox has been finally deleted.

Get-Mailbox -InactiveMailboxOnly | fl name, WindowsEmailAddress, Lit*


I hope, that clarified some unclear Statements about how Litigation Hold works and the associated Licensing.

Regards
Andres Bohren


Microsoft Teams returns Shared Mailbox in Search

Hi All,

I was wondering why teams Search shows some SharedMailboxes and some not.

For Example: There are two Shared Mailboxes "SharedForward" and "SharedForwardSMTP" that can be found over Teams Searchbar on Top (does not matter if Teams Web or Teams for Windows).


The fun part is, that you can even send a chat message or call them





On the other hand there is a Shared Mailbox Postmaster - that shows no result when searching


To me, these Accounts all look the same

Get-AzureADUser -SearchString "Sharedfor" | ft DisplayName, UserPrincipalName, *Enabled*
Get-Mailbox -Identity SharedFor | ft Prim*, RecipientTypeDetails, *userAccount*



These Accounts do not even have a SIP Address 😂

Get-CsOnlineUser -Identity postmaster@icewolf.ch | fl UserPrincipalName, InterpretedUserType, RegistrarPool, *SIP*


Check the Postmaster Account

Get-AzureADUser -SearchString "Postmaster" | ft DisplayName, UserPrincipalName, *Enabled*
Get-Mailbox -Identity postmaster | ft Prim*, RecipientTypeDetails, *userAccount*



Get-CsOnlineUser -Identity postmaster@icewolf.ch | fl UserPrincipalName, InterpretedUserType, RegistrarPool, *SIP*


I can't spot a diffrence that would matter.

Let's check with the Developer Tools in Teams Web

You can see the call to suggestions - one time returning results - one time not.
https://substrate.office.com/search/api/v1/suggestions?scenario=powerbar&setflight=Teams_BestMatch_3slots_v1,Teams_BestMatch_Channels

Are there somewhere documented the "Attributes" that are used by the Suggestions Query? Please contact me if you know more.






There exists already some Suggestions in the Feedbackportal - please upvote them

Allow hiding of users from Microsoft Teams

Shared mailboxes can be contacted via Teams chat, confuses users

EDU: Teams will send chat messages to shared mailboxes that don't have Teams without activation of the Information barrier policy

Regards
Andres Bohren


MicrosoftTeams PowerShell Module 3.2.0 Preview released

Hi All,

A few Days ago, Microsoft has released the MicrosoftTeams PowerShell Module v3.2.0 Preview to the PSGallery.


Find-Module -Name MicrosoftTeams -AllowPrerelease
Install-Module -Name MicrosoftTeams -AllowPrerelease -Force


Let's see how long it takes to load the Module. It's about the same as with the Microsoft Teams PowerShell 3.1.1

Measure-Command -Expression {Import-Module MicrosoftTeams}
Get-Module


My usual Tests

Connect-MicrosoftTeams
Get-Team
Get-CsOnlineUser -Identity a.bohren@icewolf.ch | fl *Ent*, *host*, *voice*, *um*



Regards
Andres Bohren


Azure AD cross-tenant access settings Preview

Hi All,

Microsoft recently announced the Azure AD cross-tenant access settings Preview

Collaborate more securely with new cross-tenant access settings

Overview: Cross-tenant access with Azure AD External Identities (Preview)


The settings can be found in Azure Active Directory > External Identities


If you click on "Default settings" and then edit the defaults you will see the details




I find this one of the most interesting Settings. If you have already done MFA in your home Tenant - i can trust that Setting. Something i would recommend for example.


There is also a Workbook that shows the cross-tenant Activity


This gives you already a good overview - but if you want to see more details, open up the LogAnalytics Query


That's the Query behind the cross-tenant activity Workbook


Microsoft has released a PowerShell Module based on the MGGraph Module

Find-Module MSIdentityTools
Install-Module MSIdentityTools


These are the available Commands of the Module

Get-Command -Module MSIdentityTools


With the following Commands you should be able to see the Names of the Tenant (ResolveTenantId) - but does not work here. Any hints?

Connect-MGGraph -Scope AuditLog.Read.All
Select-MgProfile -Name beta
Get-MSIDCrossTenantAccessActivity -SummaryStats -ResolveTenantId



Update 07.04.2022
Branko Sabadi found out that you require the following Scope: CrossTenantInformation.ReadBasic.All
But it only works in PowerShell 7 as you can see





Connect-MgGraph -Scopes AuditLog.Read.All,CrossTenantInformation.ReadBasic.All
Select-MgProfile -Name "beta"
Resolve-MsIdTenant -TenantId 2e467102-8204-4e70-a8b6-11272c26e761



Connect-MgGraph -Scopes AuditLog.Read.All,CrossTenantInformation.ReadBasic.All
Get-MSIDCrossTenantAccessActivity -SummaryStats -ResolveTenantId




Connect-MgGraph -Scopes AuditLog.Read.All,CrossTenantInformation.ReadBasic.All
Resolve-MsIdTenant -TenantId 815d4e96-e3a0-41eb-9183-2fea315f3277



Regards
Andres


ESXi670-202102001

Hi All,

An Update for ESXi 6.70 has been released by VMware

ESXi670-202102001
https://docs.vmware.com/en/VMware-vSphere/6.7/rn/esxi670-202102001.html




I have uploaded the ZIP File to the ESXi Datastore



I have only a Single ESXi Server. So i stop all VM's.

Now the Patch can be installed

esxcli software vib install -d /vmfs/volumes/datastore3/ISO/ESXi670-202201001.zip



After the Update, the Server has to be rebooted. When the Server is up again, you can see the new Version Number 6.7.0.19195723



This time no VMware Tools upgrade is available



Regards
Andres Bohren


VMware vCenter 6.7 U3q

Hi All,

Yesterday i received a Mail with an update to the Status of VMware Log4j. Finnaly ESXi and vCenter have received patches.

VMSA-2021-0028



Notice the Version before the Update 6.7.0.51000


The Update can be installed from the VCSA Appliance Management Portal under "Update"
https://vcsa.corp.icewolf.ch:5480/






After the Update you have to be patient until the VCSA and the Appliance Management Portal are available again.



Regards
Andres Bohren


Microsoft Defender for Endpoint

Hi All,

In mid January Microsoft Announced, that the Microsoft Defender for Endpoint Plan 1 will be now Included in M365 E3/A3 Licenses.

Microsoft Defender for Endpoint Plan 1 Now Included in M365 E3/A3 Licenses

My Account has a M365 E3 License and i can see "Microsoft Defender for Endpoint Plan 1" has been assigned.



Overview of Microsoft Defender for Endpoint Plan 1




I went for the Documentation and Set it up in Micrsosoft Endpoint Manager.

Set up and configure Microsoft Defender for Endpoint Plan 1







I was not sure if i had to choose the Group with the User or the Group with the Computer. I went for the Group with the Computer.



The Policy was assigned to the Computer but the Settings are pending


On the next day i checked - and it was sucessfully



I checked the Settings on the Client computer
Get-MpPreference



Don't judge me too hard - i am not much working with Windows Client Stuff. Hopefully this Article did help you a bit.

Regards
Andres Bohren