Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010
Is your MSP a CSP? My CSP has just as many privileges as my GA account. In fact, probably far too many.

Adbot
ADBOT LOVES YOU

vanity slug
Jul 20, 2010

snackcakes posted:

I'm not sure how I'd make that work, care to elaborate? (I'm not being sassy, just stupid)

You would use 'Show one-time code in app', then store the generated token somewhere secure to share with your colleagues. They could configure this in their own apps. Or have a bot spit it out upon request (probably a better solution if you want to keep tracking who's requesting tokens when).

The Fool
Oct 16, 2003


snackcakes posted:

...the former. I don't think I can convince my company to make individual admin accounts for every technical member of my company for each of our many clients

We are delegated admin as well with our own accounts but there's only so much you can do with that

If you're a Microsoft partner your delegated admin accounts could have global admin. I don't recommend giving everyone global admin, but there should be no weird restrictions.

Toast Museum
Dec 3, 2005

30% Iron Chef

The Fool posted:

If it's bluescreening during the PE stage and not after imaging/first restarts, you could try using a real computer or virtualbox instead of Hyper-V for your testing. Or you may just need to maintain two different PE images.

You already know how to limit the drivers used by the PE image, the other method to filter drivers only applies to drivers being injected to the wim during the imaging process.

Yeah, it's bluescreening immediately upon trying to boot to WinPE (System thread exception not handled, AppleSSD.sys; no specific stop code given). On the bright side, injecting drivers is the only significant customization I'm doing to WinPE, so the driverless image should work fine for Hyper-v as long as I don't have to edit bootstrap.ini or something.

Thanks Ants
May 21, 2004

#essereFerrari


If you're an MSP then you should be using your own Office 365 accounts with delegated admin permissions to admin the tenants, you get seats of EM+S E3 licensing free with a Silver partner status and you can use that to configure conditional MFA.

https://docs.microsoft.com/en-us/powershell/partnercenter/multi-factor-auth?view=partnercenterps-2.0

Maneki Neko
Oct 27, 2000

Speaking of Office 365, anyone have this fun overlay breaking admin center?



Seems to not be machine/browser/tenant specific, I can't zap it to switch back to classic mode either, only seems to be new folks in "new" admin center mode :(

kiwid
Sep 30, 2013

We just sold half our company to another company.

What's the best way to migrate mailboxes from our Office 365 to their Exchange 2013?

Am I to export the mailboxes to PST files? Please tell me there is a more elegant way?

GreenNight
Feb 19, 2006
Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

kiwid posted:

We just sold half our company to another company.

What's the best way to migrate mailboxes from our Office 365 to their Exchange 2013?

Am I to export the mailboxes to PST files? Please tell me there is a more elegant way?

Hahahahahahahaha.

No.

Thanks Ants
May 21, 2004

#essereFerrari


https://help.bittitan.com/hc/en-us/articles/115008107267-Office-365-to-On-Premises-Exchange-version-2007-and-later-Migration-Guide

kiwid
Sep 30, 2013


ooo I didn't look very closely. I thought migrationwiz just went the one direction. Thanks.

Thanks Ants
May 21, 2004

#essereFerrari


It's a really good product, it's cheap, the support is great. You don't need anything more than the basic mail migration licenses if you're just moving mail and you have an AD at the other side to set the accounts up for you automatically.

You'll presumably have to forward messages out of your domain across to the other company for a while, but you can just throw a load of contacts into your Office 365 tenant and create DLs to achieve that.

devmd01
Mar 7, 2006

Elektronik
Supersonik
Adding another vote for Bittitan, over the last year we’ve been migrating 1400 employees from the acquisition we made almost exactly a year ago. Once we set up the proper service account with the divesting company it’s been super easy to use.

ChubbyThePhat
Dec 22, 2006

Who nico nico needs anyone else
The answer is always BitTitan.

kiwid
Sep 30, 2013

Yea we decided to use BitTitan. Just hoping the recipient company accepts this method.

Unrelated though, does anyone still use Server 2016? If so, why does it take like 8 loving hours to do the initial Windows updates?

Sickening
Jul 16, 2007

Black summer was the best summer.

kiwid posted:

Yea we decided to use BitTitan. Just hoping the recipient company accepts this method.

Unrelated though, does anyone still use Server 2016? If so, why does it take like 8 loving hours to do the initial Windows updates?

Has windows update ever been fast?

GreenNight
Feb 19, 2006
Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Sickening posted:

Has windows update ever been fast?

Server 2016 is the absolutely worst with updates. It takes loving forever. 2019 is way way way better in my experience.

kiwid
Sep 30, 2013

GreenNight posted:

Server 2016 is the absolutely worst with updates. It takes loving forever. 2019 is way way way better in my experience.

Yeah I'm regretting not renewing our SA now.

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

kiwid posted:

Yea we decided to use BitTitan. Just hoping the recipient company accepts this method.

Unrelated though, does anyone still use Server 2016? If so, why does it take like 8 loving hours to do the initial Windows updates?

It's the lovely way they built the servicing stack.


Nth'ing this. There are other solutions as well, but this works well. Migrating to 2013 on prem.... whoof.

Sickening
Jul 16, 2007

Black summer was the best summer.

kiwid posted:

Yeah I'm regretting not renewing our SA now.

Wouldn't you just get 2019 licenses when you update your SA?

Thanks Ants
May 21, 2004

#essereFerrari


skipdogg posted:

It's the lovely way they built the servicing stack.


Nth'ing this. There are other solutions as well, but this works well. Migrating to 2013 on prem.... whoof.

Yeah it seems like the better way to do this would be to go Office 365 as a hybrid deployment, migrate the new company direct to that and then slowly move all your accounts there as well.

kiwid
Sep 30, 2013

Sickening posted:

Wouldn't you just get 2019 licenses when you update your SA?

What do you mean? I'm installing a new 2016 server because I don't have 2019 licenses :D

Sickening
Jul 16, 2007

Black summer was the best summer.

kiwid posted:

What do you mean? I'm installing a new 2016 server because I don't have 2019 licenses :D

Your SA for a server license should cover anything of equal status. 2016 standard vs 2019 standard. Datacenter for datacenter, etc. Just call your VAR.

snackcakes
May 7, 2005

A joint venture of Matsumura Fishworks and Tamaribuchi Heavy Manufacturing Concern

Thanks Ants posted:

If you're an MSP then you should be using your own Office 365 accounts with delegated admin permissions to admin the tenants, you get seats of EM+S E3 licensing free with a Silver partner status and you can use that to configure conditional MFA.

https://docs.microsoft.com/en-us/powershell/partnercenter/multi-factor-auth?view=partnercenterps-2.0

Hey, this looks cool. I'm going to do check this out more in-depth after I get some caffeine in me. Thanks!

kiwid
Sep 30, 2013

Lol so the other company doesn't want to use MigrationWiz (even if we're paying) so PST files it is.

quote:

I’m thinking we could get an external drive and load it up with PST files and then upload it

Ugh.

Sickening
Jul 16, 2007

Black summer was the best summer.

kiwid posted:

Lol so the other company doesn't want to use MigrationWiz (even if we're paying) so PST files it is.


Ugh.

Your company gives this company it owns too much voting power. How can someone not want to use migration wiz? Like on what grounds? Those leaders are the types that usually find themselves fired after an acquisition.

Thanks Ants
May 21, 2004

#essereFerrari


Create an account for someone at the new company to use, give it access to the mailboxes of all the staff who are moving over, tell them to go hog wild

kiwid
Sep 30, 2013

Sickening posted:

Your company gives this company it owns too much voting power. How can someone not want to use migration wiz? Like on what grounds? Those leaders are the types that usually find themselves fired after an acquisition.

Their reasoning was that they don't want to dump the mail into the Exchange mailboxes due to sizing limitations, etc. They want to put the PSTs on an archival server or some poo poo.

I suppose that's not terrible reasoning... I don't know.

Also, we don't own them. We sold part of our company to them, so they own the mailboxes technically.

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010
I take it all the technical talent is staying with the old company. Let em drown in a sea of PSTs I say as you wave and shut the door slowly.

kiwid
Sep 30, 2013

incoherent posted:

I take it all the technical talent is staying with the old company. Let em drown in a sea of PSTs I say as you wave and shut the door slowly.

Yeah not my problem. If they want PSTs they can have their PSTs. I see MigrationWiz can also dump mailboxes to PST files on Microsoft Azure so that's what I'm going to do. I still get to use BitTitan and they still get their PSTs. Win-Win I guess?

Thanks Ants
May 21, 2004

#essereFerrari


Imagine someone wanting to deal with PST files

kiwid
Sep 30, 2013

I've converted all our MFDs to use Office 365 SMTP relay using SSL on port 587. Why then when I block port 25 on the firewall, do these stop working?

wolrah
May 8, 2006
what?

kiwid posted:

I've converted all our MFDs to use Office 365 SMTP relay using SSL on port 587. Why then when I block port 25 on the firewall, do these stop working?

As described, someone's being stupid. Either you forgot to open up outbound 587 for those devices or they're still trying 25 for some dumb reason.

Packet captures will tell you everything you need to know.

lol internet.
Sep 4, 2007
the internet makes you stupid
Is 587 not for TLS? If it is, I thought it goes through 25 first, runs STARTTLS command then upgrades the connection to port 587

That aside, Is anyone using REFS in a CSV on dedicated SAN storage for Hyper V Clusters? Any pros/cons at this point. Lots of google searches say stay away in but it is from 2016.

lol internet. fucked around with this message at 16:31 on Oct 1, 2019

kiwid
Sep 30, 2013

wolrah posted:

As described, someone's being stupid. Either you forgot to open up outbound 587 for those devices or they're still trying 25 for some dumb reason.

Packet captures will tell you everything you need to know.

That could be. Now that I remember, I think the Canon printers need to change the port in the maintenance settings somewhere.

lol internet. posted:

Is 587 not for TLS? If it is, I thought it goes through 25 first, runs STARTTLS command then upgrades the connection to port 587

Ah that's probably it. Yes, I'm using STARTTLS (which is still SSL right?) but I didn't know it needed port 25 then upgrades it.

wolrah
May 8, 2006
what?

lol internet. posted:

Is 587 not for TLS? If it is, I thought it goes through 25 first, runs STARTTLS command then upgrades the connection to port 587

No, STARTTLS upgrades within the same connection. If it started on 25 it stays on 25, if it started on 587 it stays on 587. 465 is implied TLS, so the negotiation happens before the first SMTP verb is transmitted.

The main purpose of moving clients to submitting messages on 587 is to get them off of 25 so that ISPs and network operators can block outbound 25 by default, only opening it up for their actual mail servers. This basically eliminates the problem of botted end-user PCs sending spam and gives you an easily detected red flag for something being wrong. If it still required starting on port 25 that'd defeat the purpose.

In an ideal world the only systems that can connect out to the internet on port 25 would be those that are defined in your SPF records. All clients should be using 465 or 587.

kiwid
Sep 30, 2013

wolrah posted:

No, STARTTLS upgrades within the same connection. If it started on 25 it stays on 25, if it started on 587 it stays on 587. 465 is implied TLS, so the negotiation happens before the first SMTP verb is transmitted.

The main purpose of moving clients to submitting messages on 587 is to get them off of 25 so that ISPs and network operators can block outbound 25 by default, only opening it up for their actual mail servers. This basically eliminates the problem of botted end-user PCs sending spam and gives you an easily detected red flag for something being wrong. If it still required starting on port 25 that'd defeat the purpose.

In an ideal world the only systems that can connect out to the internet on port 25 would be those that are defined in your SPF records. All clients should be using 465 or 587.

Yeah my goal was to prevent bots sending spam so thanks for the info. I'll work on getting these changed.

Thanks Ants
May 21, 2004

#essereFerrari


I used this to get a Canon device sending outbound email using Office 365

https://techbytes.co/2016/05/09/connecting-a-canon-mfp-to-office-365/

Could never get SMTP relay to work though, ended up having to license an account for them. Didn't have time to do a Wireshark trace to see what was going on.

cr0y
Mar 24, 2005



Who is a good cloud provider that provides on demand per hour windows instances? This will just be for testing stuff, I use digitalOcean for linux but need to play with windows from time to time. Should I just use azure?

Thanks Ants
May 21, 2004

#essereFerrari


Azure, AWS, Google, all offer Windows

Adbot
ADBOT LOVES YOU

FunOne
Aug 20, 2000
I am a slimey vat of concentrated stupidity

Fun Shoe
I've spun up Windows server instances on Google cloud super easily and quick before to do some transfers with no issues.


Fastest way to move files from cloud to cloud when you have lovely DSL sometimes.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply