The ramblings of a computer geek
We had an issue with event ID 2004 being logged on our Exchange Servers, grumbling about a missing certificate. Warning Observed The following error is observed: Analysis It seems to indicate that an expected certificate is missing. Running the “get-authconfig” gives this output, and we can see that the PreviousCertificateThumbprint Confirm Current Certificate Confirm that … Read more
When attempting to uninstall Exchange 2016 one a couple of the servers I got this error after running the setup.exe with the uninstall switch. The uninstallation obviously failed and would not go any further. First thing was to reboot the server and retry, but that still didn’t work. Resolution Turns out this is a fairly … Read more
We were completing a migration from Exchange 2016 to Exchange SE, and we found that when attempting to decommission the old Exchange Servers that we could not due to user accounts referring within the homeMDB attribute to a mailbox database on a legacy Exchange 2016 server. In some cases these didn’t actually have a mailbox … Read more
You can obtain information from a Virtual Machine via its VMTools service via the VMware PowerCLI, here is a simple working example you can build from to determine ID 1808 which shows that the machine has successfully completed its Secure Boot remediation (i.e. installing the new 2023 certificates to NVRAM and swapping to the new … Read more
Here’s a quick example, which might help you, it filters by specific attributes (which you can’t get through the GUI) when you’re attempting to create a Custom View for Event Viewer.
Assuming you have your Microsoft Windows Domain Controllers sending their event logs into Splunk, here is a query that will pull out the pertinent details you need to find anything that is still running non-compliant RC4 for ticketing. Note that your index and Log names may vary.
The periodic reset of the KRBTGT password is now recommended by Microsoft to be carried out every 180 days. Resetting the password periodically reduces the risks of a Kerbroasting attack being successful. To ensure the KRBTGT password is fully reset you MUST perform this reset operation twice. And you MUST wait a bare minimum of … Read more
The periodic reset of the KRBTGT password is now recommended by Microsoft to be carried out every 180 days. Resetting the password periodically reduces the risks of a Kerbroasting attack being successful. To ensure the KRBTGT password is fully reset you MUST perform this reset operation twice. And you MUST wait a bare minimum of … Read more
Can you restore a Microsoft Exchange 2016 or 2019 mailbox database to a Microsoft Exchange SE server? The short answer is yes you can, but you must use the Recovery Database approach. Why would you want to? Well, if like us you are moving at pace to Microsoft Exchange SE to ensure you are on … Read more
A quick command to determine where a mailbox has been moved during its lifetime. It is common for a mailbox to have been moved from database to database, and therefore at different points in time been backed up to different databases. When it comes to a need to restore a database, then you’ll need to … Read more