Daniyar's Tech blog: Security

ADFS access control rules to disable MFA for Office 365 application if usrs are connecting from intranet, Lync clients and enforce MFA for member of AD group:

$rp = Get-AdfsRelyingPartyTrust –Name "Microsoft Office 365 Identity Platform"

$groupMfaClaimTriggerRule = 'NOT EXISTS([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent", Value =~ "(?i)skype"]) && NOT EXISTS([Type=="http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent", Value =~ "(?i)ACOMO"]) && NOT EXISTS([Type=="http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent", Value =~ "(?i)lync"]) => add(type = "http://schemas.company.com/not_lync", value = "true" );

c1:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value == "S-1-5-21-796845957-688789844-854245398-6148"] && c2:[Type =="http://schemas.company.com/not_lync", Value== "true"] && c3:[Type =="http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value== "false"]=> issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn");'

Set-AdfsRelyingPartyTrust –TargetRelyingParty $rp –AdditionalAuthenticationRules $groupMfaClaimTriggerRule

We use this rule to let Lync on Premises users to use Exchange online

Thursday, September 14, 2017

Some ADFS MFA trics

http://www.lieben.nu/liebensraum/2016/05/excluding-skype-for-business-from-adfs-mfa/

Monday, August 14, 2017

ADFS 3.0 from Windows 2012 R2 does not support TLS 1.2 out of box

Surprise! Look for details here: https://support.microsoft.com/en-us/help/3194197/considerations-for-disabling-and-replacing-tls-1-0-in-adfs

The article will explain how to enable TLS 1.2 especially that we know that TLS 1.0 is obsolete and wil be dropped by Microsoft in 2018.

Wednesday, May 24, 2017

Azure MFA - the architectural options

https://dirteam.com/sander/2017/02/07/supported-azure-mfa-server-deployment-scenarios-and-their-pros-and-cons/

Monday, February 6, 2017

DPM system state backup error

Type: Consistency check
Status: Failed
Description: DPM cannot create a backup because Windows Server Backup (WSB) on the protected computer encountered an error (WSB Event ID: 517, WSB Error Code: 0x98ED90). (ID 30229 Details: Internal error code: 0x80990ED0)
More information
End time: 06.02.2017 10:24:38
Start time: 06.02.2017 09:18:17
Time elapsed: 01:06:21
Data transferred: -
Cluster node -
Source details: Computer\System Protection
Protection group members: 1
Details
Protection group: Protection Group
Items scanned: 0
Items fixed: 0

in the WBS inside the server we can see it actually corresponds to low space error. indeed we have 12GB free on the drive E: and backup size is 14GB.

As we decide not to touch the drive E: (it is IDE VHD drive on that server, we add new VDHX file attached to SCSI adapter - this way we can alter disk space online. Which is not possible with VHD attached ove IDE interface. You will have to shutdown server and then change.

Now new drive F: can take the load.

go to C:\Program Files\Microsoft Data Protection Manager\DPM\Datasources and in the file PSDataSourceConfig.xml locate E; - drive short in space in section FilesToProtect and replace by F: new drive.

Rerun consistance check in DPM.

Wednesday, January 18, 2017

AD LDS authentication in AD with userProxy

https://technet.microsoft.com/en-us/library/2008.12.proxy.aspx

Friday, December 16, 2016

IIS security

If you have an account like contoso\sharepoint-farm in your IIS be aware that you can run locally appcmd command and obtain the password in clear text. Message: never use powerfull accounts in IIS. There are some people that use Domain Admin accounts there.