Microsoft.Exchange.Data.Storage.SendAsDeniedException: Can't transport send message - Set Send-As permission for on-prem mailbox

Unable to send as from on-prem as an Exchange online user? Chances are that your access rights aren't setup correctly.

First of all there is a known issue regarding "Send-As" and "Send on behalve" in Exchange Online:

Can't manage "Send as" and "Send on behalf" permissions for Exchange Online users in an on-premises hybrid environment
Exchange Online
Symptoms

You can’t find a user who was migrated to Exchange Online in the People Picker in the Exchange Admin Center (EAC). Additionally, the "Send as" and "Send on behalf" permissions can’t be added for legacy dedicated or on-premises mailboxes.
Cause

After mailboxes are moved from the on-premises environment to Exchange Online, they are represented as Remote Mailboxes. These remote mailboxes are not displayed in the EAC People Picker.
Workaround

This issue is being investigated by Microsoft. To work around this issue, run the following Remote PowerShell cmdlets to add these permissions:

"Send as" permission: Add-ADPermission

"Send on behalf" permission: Set-Mailbox

Source

How to get around this?

Connect to Exchange Online PowerShell and run the following:

1 2 3 4 5 6 7 8 9

Add-RecipientPermission -Identity sharedmailbox@domain.nl -Trustee firstname.Lastname@domain.nl -AccesConfirm Are you sure you want to perform this action? Adding recipient permission 'SendAs' for user or group 'Firstname.Lastname@domain.nl' on recipient Identity:'sharedmailbox@domain.nl'. [Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): A Identity Trustee AccessControlType AccessRights Inherited -------- ------- ----------------- ------------ --------- Klic Lastname, Firstname (50439) Allow {SendAs} False

Check your settings:

1 2 3 4 5 6 7

Get-RecipientPermission -Identity sharedmailbox@domain.nl Identity Trustee AccessControlType AccessRights Inherited -------- ------- ----------------- ------------ --------- Klic NT AUTHORITY\SELF Allow {SendAs} False Klic Some.User@domain.nl Allow {SendAs} False Klic Firstname.Lastname@domain.nl Allow {SendAs} False

And for a security group:

1 2 3 4 5 6 7 8 9 10

Add-RecipientPermission -Identity sharedmailbox@domain.nl -Trustee YourSecurityGroupName -AccessRights sendas Confirm Are you sure you want to perform this action? Adding recipient permission 'SendAs' for user or group 'sm.klic' on recipient Identity:'klic.klicdomain@domain.nl'. [Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): A Identity Trustee AccessControlType AccessRights Inherited -------- --------------------- ----------------- ------------ --------- Klic YourSecurityGroupName Allow {SendAs} False

554 5.2.0 STOREDRV.Deliver.Exception:ObjectNotFoundException.MapiExceptionNotFound - NDR when users send mail in Exchange Online

 I had never heard of this before, so maybe this helps others.

After sending an e-mail you may receive a NDR 554 5.2.0 STOREDRV.Deliver.Exception:ObjectNotFoundException.MapiExceptionNotFound.

What this means is that there is something on in the users mailbox called "clutter".
I had to look this up in my OWA mailbox.

You will only see this option when you have "Focused Inbox" turned on.
The user itself could turn it off, but in many cases the user doesn't know how to or is out of the office or whatever.

So ofcourse this can be done with PowerShell:

First check to see the current setting

1 2 3 4 5 6 7 8 9

Get-Clutter -Identity username@domain.nl RunspaceId : 2a09c611-03b6-4926-8293-c1692c3bcb00 IsEnabled : True MailboxIdentity : username@domain.nl Identity : IsValid : True ObjectState : New

As you can see the setting "Clutter" is revered to as "IsEnabled"

Then set the value to $False

1 2 3 4 5 6 7 8 9 10

Get-Mailbox username@domain.nl | Set-Clutter -Enable $false RunspaceId : 2a09c611-03b6-4926-8293-c1692c3bcb00 IsEnabled : False MailboxIdentity : CN=username,OU=tenantname.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR10A003,DC=PROD,DC=OUTLOOK,DC=COM Identity : IsValid : True ObjectState : New

Move new mailbox from on-premises to Exchange Online with PowerShell - Exchange Hybrid new mailbox moves

If your running Exchange Hybrid then you need to create your mailboxes on premises first and then sync them to AzureAD/Office365/EXO. 

Now in my case this was a manual task, and ofcourse this was forgotten too often.
So I created this script, to automate the move.
I'm still looking for the way to let the moves be visible in the EAC, it's something with New-MigrationBatch and Start-MigrationBatch.
I just didn't find the time yet to mess with it.

If you have the right method to make this possible, drop a line below.

For now this is how I do it (this needs to run from an Exchange server on-premises or a management server with the Exchange Management Tools installed):

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

# Load Exchange modules and snapin add-pssnapin microsoft.exchange.management.powershell.snapin . $env:ExchangeInstallPath\bin\RemoteExchange.ps1 # Connect to local Exchange server Connect-ExchangeServer -auto -AllowClobber # Import EXO module Import-Module -Name ExchangeOnlineManagement # Get the current date $Date = Get-Date -format dd-MM-yyyy # Get mailboxes created in the last 7 days $mailboxes = Get-Mailbox | Where-Object {$_.WhenCreated –ge ((Get-Date).Adddays(-7))} ` | Select UserPrincipalName,identity,samaccountname # Get on-prem credentials $onpremcred = Get-Credential domain\username # Set the proxy for the connection to EXO netsh winhttp set proxy proxy-server="http=proxy.domain.lan;https=proxy.domain.lan:8080" ` bypass-list="*.domain.lan;10.*" # Connect to EXO Connect-ExchangeOnline -UserPrincipalName username@domain.nl # Show the mailboxes to move $mailboxes # Create a move request per found mailboxes foreach ($mailbox in $mailboxes) { $username = $mailbox.Samaccountname $moverequestbatch = New-MoveRequest -Identity $mailbox.SamAccountName -remote ` -RemoteHostName hybridserver.domain.nl -TargetDeliveryDomain tenantname.mail.onmicrosoft.com ` -RemoteCredential $OnPremCred -BatchName "MigrationService:$username" <# === This piece is experimental === #$migrationEndpointOnPrem = tenantname.domain.nl-endpoint #$OnboardingBatch = New-MigrationBatch -Name $username -SourceEndpoint ` $MigrationEndpointOnprem.Identity -TargetDeliveryDomain tenantname.mail.onmicrosoft.com ` -CSVData ([System.IO.File]::ReadAllBytes("C:\Users\Administrator\Desktop\RemoteOnBoarding1.csv")) #Start-MigrationBatch -AutoStart -Name -AutoComplete -Identity $OnboardingBatch.Identity #> } # Reset the proxy netsh winhttp reset proxy <# # Some command to check your moves Get-MoveRequest Get-moverequest | Get-moverequeststatistics Get-MoveRequest | Select batchname Get-MoveRequest -MoveStatus Completed | Remove-MoveRequest -confirm:$false Get-MoveRequest -MoveStatus CompletedWithWarning | Remove-MoveRequest -confirm:$false #>

Teams Team not showing in Outlook groups - Microsoft 365 group not showing in Outlook groups

Learned something today.

If you create a Teams Team or a Microsoft 365 group, and these were created via Microsoft Teams, they are hidden from Outlook by default.
If you want them to show in both the Outlook left navigation and the address book, you can use Set-UnifiedGroup to flip -HiddenFromExchangeClientsEnabled to $false.

Connect to Exchange Online PowerShell.

To get a group and it's current settings:

Get-UnifiedGroup -id YourGroupName | select displayname,hidden*            
            
DisplayName        HiddenFromExchangeClientsEnabled HiddenGroupMembershipEnabled HiddenFromAddressListsEnabled            
____               ________________________________ ____________________________ _____________________________            
YourGroupName                                  True                        False                         False

To unhide a group:

Set-UnifiedGroup -Identity YourGroupName -HiddenFromExchangeClientsEnabled:$false

Check your adjustment:

Get-UnifiedGroup -id YourGroupName | select displayname,hidden*            
            
DisplayName        HiddenFromExchangeClientsEnabled HiddenGroupMembershipEnabled HiddenFromAddressListsEnabled            
____               ________________________________ ____________________________ _____________________________            
YourGroupName                                 False                        False                         False

Set all groups in your organization to be visible in Outlook:

Get-UnifiedGroup -ResultSize unlimited | Set-UnifiedGroup -HiddenFromExchangeClientsEnabled:$false

Be careful with the last one, if your users have a lot of memberships to Teams the list in Outlook may get very long.

Skip TPM check Windows 11 installation (upgrading) on unsupported hardware with PowerShell

Run in an elevated PowerShell:

# Skip TPM check Windows 11
{
REG ADD "HKLM\SYSTEM\Setup\MoSetup" /vAllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f
REG QUERY "HKLM\SYSTEM\Setup\MoSetup"
}

Happy upgrading

Version numbers Exchange 2019 - 2016 - 2013 and CU's and SU's (security updates)

Exchange Server build numbers and release dates

In this article

You can use the information in this article to verify the version of Microsoft Exchange Server that is running in your organization.

This article is organized in sections that correspond to the major releases of Exchange. Each section lists build numbers for each Service Pack (SP), Cumulative Update (CU), Security Update (SU), or Update Rollup (RU) of the specific Exchange release.

Links for the available downloads are also included.

Note

Starting in the March 2021 Security Update (SU), we also include build numbers for Security Updates.

RTM stands for "release to manufacturing" (the first version of the product).

View the build number of an Exchange-based server

This section describes the various methods that you can use to view the build number of servers that are running Exchange Server.

Option 1 (recommended)

Run the HealthChecker script, and check the build number.

Option 2

Open the Exchange Management Shell, and run the following command:

Get-Command Exsetup.exe | ForEach {$_.FileVersionInfo}

Option 3

Open the Exchange Management Shell, and run the following command:

Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

Exchange Server 2019

The table in this section provides build numbers and general release dates for each version of Microsoft Exchange Server 2019.

---

Product name	Release date	Build number (short format)	Build number (long format)
Exchange Server 2019 CU11 Oct21SU	October 12, 2021	15.2.986.9	15.02.0986.009
Exchange Server 2019 CU11	September 28, 2021	15.2.986.5	15.02.0986.005
Exchange Server 2019 CU10 Oct21SU	October 12, 2021	15.2.922.14	15.02.0922.014
Exchange Server 2019 CU10 Jul21SU	July 13, 2021	15.2.922.13	15.02.0922.013
Exchange Server 2019 CU10	June 29, 2021	15.2.922.7	15.02.0922.007
Exchange Server 2019 CU9 Jul21SU	July 13, 2021	15.2.858.15	15.02.0858.015
Exchange Server 2019 CU9 May21SU	May 11, 2021	15.2.858.12	15.02.0858.012
Exchange Server 2019 CU9 Apr21SU	April 13, 2021	15.2.858.10	15.02.0858.010
Exchange Server 2019 CU9	March 16, 2021	15.2.858.5	15.02.0858.005
Exchange Server 2019 CU8 May21SU	May 11, 2021	15.2.792.15	15.02.0792.015
Exchange Server 2019 CU8 Apr21SU	April 13, 2021	15.2.792.13	15.02.0792.013
Exchange Server 2019 CU8 Mar21SU	March 2, 2021	15.2.792.10	15.02.0792.010
Exchange Server 2019 CU8	December 15, 2020	15.2.792.3	15.02.0792.003
Exchange Server 2019 CU7 Mar21SU	March 2, 2021	15.2.721.13	15.02.0721.013
Exchange Server 2019 CU7	September 15, 2020	15.2.721.2	15.02.0721.002
Exchange Server 2019 CU6 Mar21SU	March 2, 2021	15.2.659.12	15.02.0659.012
Exchange Server 2019 CU6	June 16, 2020	15.2.659.4	15.02.0659.004
Exchange Server 2019 CU5 Mar21SU	March 2, 2021	15.2.595.8	15.02.0595.008
Exchange Server 2019 CU5	March 17, 2020	15.2.595.3	15.02.0595.003
Exchange Server 2019 CU4 Mar21SU	March 2, 2021	15.2.529.13	15.02.0529.013
Exchange Server 2019 CU4	December 17, 2019	15.2.529.5	15.02.0529.005
Exchange Server 2019 CU3 Mar21SU	March 2, 2021	15.2.464.15	15.02.0464.015
Exchange Server 2019 CU3	September 17, 2019	15.2.464.5	15.02.0464.005
Exchange Server 2019 CU2 Mar21SU	March 2, 2021	15.2.397.11	15.02.0397.011
Exchange Server 2019 CU2	June 18, 2019	15.2.397.3	15.02.0397.003
Exchange Server 2019 CU1 Mar21SU	March 2, 2021	15.2.330.11	15.02.0330.011
Exchange Server 2019 CU1	February 12, 2019	15.2.330.5	15.02.0330.005
Exchange Server 2019 RTM Mar21SU	March 2, 2021	15.2.221.18	15.02.0221.018
Exchange Server 2019 RTM	October 22, 2018	15.2.221.12	15.02.0221.012
Exchange Server 2019 Preview	July 24, 2018	15.2.196.0	15.02.0196.000

Exchange Server 2016

The table in this section provides build numbers and general release dates for each version of Microsoft Exchange Server 2016.

---

Product name	Release date	Build number (short format)	Build number (long format)
Exchange Server 2016 CU22 Oct21SU	October 12, 2021	15.1.2375.12	15.01.2375.012
Exchange Server 2016 CU22	September 28, 2021	15.1.2375.7	15.01.2375.007
Exchange Server 2016 CU21 Oct21SU	October 12, 2021	15.1.2308.15	15.01.2308.015
Exchange Server 2016 CU21 Jul21SU	July 13, 2021	15.1.2308.14	15.01.2308.014
Exchange Server 2016 CU21	June 29, 2021	15.1.2308.8	15.01.2308.008
Exchange Server 2016 CU20 Jul21SU	July 13, 2021	15.1.2242.12	15.01.2242.012
Exchange Server 2016 CU20 May21SU	May 11, 2021	15.1.2242.10	15.01.2242.010
Exchange Server 2016 CU20 Apr21SU	April 13, 2021	15.1.2242.8	15.01.2242.008
Exchange Server 2016 CU20	March 16, 2021	15.1.2242.4	15.01.2242.004
Exchange Server 2016 CU19 May21SU	May 11, 2021	15.1.2176.14	15.01.2176.014
Exchange Server 2016 CU19 Apr21SU	April 13, 2021	15.1.2176.12	15.01.2176.012
Exchange Server 2016 CU19 Mar21SU	March 2, 2021	15.1.2176.9	15.01.2176.009
Exchange Server 2016 CU19	December 15, 2020	15.1.2176.2	15.01.2176.002
Exchange Server 2016 CU18 Mar21SU	March 2, 2021	15.1.2106.13	15.01.2106.013
Exchange Server 2016 CU18	September 15, 2020	15.1.2106.2	15.01.2106.002
Exchange Server 2016 CU17 Mar21SU	March 2, 2021	15.1.2044.13	15.01.2044.013
Exchange Server 2016 CU17	June 16, 2020	15.1.2044.4	15.01.2044.004
Exchange Server 2016 CU16 Mar21SU	March 2, 2021	15.1.1979.8	15.01.1979.008
Exchange Server 2016 CU16	March 17, 2020	15.1.1979.3	15.01.1979.003
Exchange Server 2016 CU15 Mar21SU	March 2, 2021	15.1.1913.12	15.01.1913.012
Exchange Server 2016 CU15	December 17, 2019	15.1.1913.5	15.01.1913.005
Exchange Server 2016 CU14 Mar21SU	March 2, 2021	15.1.1847.12	15.01.1847.012
Exchange Server 2016 CU14	September 17, 2019	15.1.1847.3	15.01.1847.003
Exchange Server 2016 CU13 Mar21SU	March 2, 2021	15.1.1779.8	15.01.1779.008
Exchange Server 2016 CU13	June 18, 2019	15.1.1779.2	15.01.1779.002
Exchange Server 2016 CU12 Mar21SU	March 2, 2021	15.1.1713.10	15.01.1713.010
Exchange Server 2016 CU12	February 12, 2019	15.1.1713.5	15.01.1713.005
Exchange Server 2016 CU11 Mar21SU	March 2, 2021	15.1.1591.18	15.01.1591.018
Exchange Server 2016 CU11	October 16, 2018	15.1.1591.10	15.01.1591.010
Exchange Server 2016 CU10 Mar21SU	March 2, 2021	15.1.1531.12	15.01.1531.012
Exchange Server 2016 CU10	June 19, 2018	15.1.1531.3	15.01.1531.003
Exchange Server 2016 CU9 Mar21SU	March 2, 2021	15.1.1466.16	15.01.1466.016
Exchange Server 2016 CU9	March 20, 2018	15.1.1466.3	15.01.1466.003
Exchange Server 2016 CU8 Mar21SU	March 2, 2021	15.1.1415.10	15.01.1415.010
Exchange Server 2016 CU8	December 19, 2017	15.1.1415.2	15.01.1415.002
Exchange Server 2016 CU7	September 19, 2017	15.1.1261.35	15.01.1261.035
Exchange Server 2016 CU6	June 27, 2017	15.1.1034.26	15.01.1034.026
Exchange Server 2016 CU5	March 21, 2017	15.1.845.34	15.01.0845.034
Exchange Server 2016 CU4	December 13, 2016	15.1.669.32	15.01.0669.032
Exchange Server 2016 CU3	September 20, 2016	15.1.544.27	15.01.0544.027
Exchange Server 2016 CU2	June 21, 2016	15.1.466.34	15.01.0466.034
Exchange Server 2016 CU1	March 15, 2016	15.1.396.30	15.01.0396.030
Exchange Server 2016 RTM	October 1, 2015	15.1.225.42	15.01.0225.042
Exchange Server 2016 Preview	July 22, 2015	15.1.225.16	15.01.0225.016

Exchange Server 2013

The table in this section provides build numbers and general release dates for each version of Microsoft Exchange Server 2013.

---

Product name	Release date	Build number (short format)	Build number (long format)
Exchange Server 2013 CU23 Oct21SU	October 12, 2021	15.0.1497.24	15.00.1497.024
Exchange Server 2013 CU23 Jul21SU	July 13, 2021	15.0.1497.23	15.00.1497.023
Exchange Server 2013 CU23 May21SU	May 11, 2021	15.0.1497.18	15.00.1497.018
Exchange Server 2013 CU23 Apr21SU	April 13, 2021	15.0.1497.15	15.00.1497.015
Exchange Server 2013 CU23 Mar21SU	March 2, 2021	15.0.1497.12	15.00.1497.012
Exchange Server 2013 CU23	June 18, 2019	15.0.1497.2	15.00.1497.002
Exchange Server 2013 CU22 Mar21SU	March 2, 2021	15.0.1473.6	15.00.1473.006
Exchange Server 2013 CU22	February 12, 2019	15.0.1473.3	15.00.1473.003
Exchange Server 2013 CU21 Mar21SU	March 2, 2021	15.0.1395.12	15.00.1395.012
Exchange Server 2013 CU21	June 19, 2018	15.0.1395.4	15.00.1395.004
Exchange Server 2013 CU20	March 20, 2018	15.0.1367.3	15.00.1367.003
Exchange Server 2013 CU19	December 19, 2017	15.0.1365.1	15.00.1365.001
Exchange Server 2013 CU18	September 19, 2017	15.0.1347.2	15.00.1347.002
Exchange Server 2013 CU17	June 27, 2017	15.0.1320.4	15.00.1320.004
Exchange Server 2013 CU16	March 21, 2017	15.0.1293.2	15.00.1293.002
Exchange Server 2013 CU15	December 13, 2016	15.0.1263.5	15.00.1263.005
Exchange Server 2013 CU14	September 20, 2016	15.0.1236.3	15.00.1236.003
Exchange Server 2013 CU13	June 21, 2016	15.0.1210.3	15.00.1210.003
Exchange Server 2013 CU12	March 15, 2016	15.0.1178.4	15.00.1178.004
Exchange Server 2013 CU11	December 15, 2015	15.0.1156.6	15.00.1156.006
Exchange Server 2013 CU10	September 15, 2015	15.0.1130.7	15.00.1130.007
Exchange Server 2013 CU9	June 17, 2015	15.0.1104.5	15.00.1104.005
Exchange Server 2013 CU8	March 17, 2015	15.0.1076.9	15.00.1076.009
Exchange Server 2013 CU7	December 9, 2014	15.0.1044.25	15.00.1044.025
Exchange Server 2013 CU6	August 26, 2014	15.0.995.29	15.00.0995.029
Exchange Server 2013 CU5	May 27, 2014	15.0.913.22	15.00.0913.022
Exchange Server 2013 SP1 Mar21SU	March 2, 2021	15.0.847.64	15.00.0847.064
Exchange Server 2013 SP1	February 25, 2014	15.0.847.32	15.00.0847.032
Exchange Server 2013 CU3	November 25, 2013	15.0.775.38	15.00.0775.038
Exchange Server 2013 CU2	July 9, 2013	15.0.712.24	15.00.0712.024
Exchange Server 2013 CU1	April 2, 2013	15.0.620.29	15.00.0620.029
Exchange Server 2013 RTM	December 3, 2012	15.0.516.32	15.00.0516.032

 

How to configure WinRM for HTTPS

Configuring for HTTPS involves the following steps.

1. Check whether the WinRM service is running
2. Create the HTTPS listener
3. Add a firewall exception
4. Validate the HTTPS listener
5. Verify you can connect to the machine via HTTPS

Check whether WinRM service is running

WinRM is installed by default in all supported Windows machines.
Ensure that service is in running state in services.
Get-Service -Name winrm

Status   Name               DisplayName
------   ----               -----------
Running  winrm              Windows Remote Management

Create HTTPS listener

By default when you run winrm quickconfig command WinRM is only configured for HTTP (port 5985). You can check already registered listeners by running following command:
WinRM e winrm/config/listener

You will see output like this:

WinRM e winrm/config/listener
Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = xx.xx.xx.xx, 127.0.0.1, ::1, fe80::8d60:91fb:e11f:d27c%12

To enable HTTPS for WinRM, you need to open port 5986 and add HTTPS listener on the target machine. Before doing that, you will first need to create a self-signed certificate and get its thumbprint. To create a self signed certificate you can use either the makecert command or a New-SelfSignedCertificate powershell commandlet.

New-SelfSignedCertificate -DnsName "YOUR_DNS_NAME" -CertStoreLocation Cert:\LocalMachine\My

PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

Thumbprint                                Subject

542DAFF8F021FC3D1EF3678543D89ACFE10A1ADB  CN=YOUR_DNS_NAME

Copy the thumbprint to the clipboard and run the following command.
This command will register the HTTPS listener in WinRM:
winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="YOUR_DNS_NAME"; CertificateThumbprint="COPIED_CERTIFICATE_THUMBPRINT"}'

 

Add firewall exception

Add an exception to your firewall to allow inbound port 5986 traffic at the target machine.

Validate HTTPS listener

You can verify the listener you added by running the same command you used above:
WinRM e winrm/config/listener
This will show the new HTTP listener now along with previous HTTPS listener.

Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = xx.xx.xx.xx, 127.0.0.1, ::1, fe80::8d60:91fb:e11f:d27c%12

Listener
    Address = *
    Transport = HTTPS
    Port = 5986
    Hostname = YOUR_DNS_NAME
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint = 542DAFF8F021FC3D1EF3678543D89ACFE10A1ADB
    ListeningOn = xx.xx.xx.xx, 127.0.0.1, ::1

Verify you can connect to the machine via HTTPS

You are done with your WinRM configuration and now you need to verify if you can connect using HTTPS.

Run the following commands in PowerShell window as Administrator:

$hostName="YOUR_DNS_NAME"
$winrmPort = "5986"

# Get the credentials of the machine
$cred = Get-Credential

# Connect to the machine
$soptions = New-PSSessionOption -SkipCACheck
Enter-PSSession -ComputerName $hostName -Port $winrmPort -Credential $cred -SessionOption $soptions -UseSSL

Block attachments with macro's - Exchange Online transport rule

Macro's have become a serious threat with new malicious attachments entering your users mailboxes on a daily basis.

To stop the most obvious possible malicious attachments from entering your organization you can create this rule.
This is not the only thing that has to be done of course, but it's a start.

Sign into Microsoft 365 Portal and go to Exchange Admin Center.

Click Mail Flow on the left-side pane, and click the little + icon to add a new rule.

Then give it a name
Apply this rule if the recipient is located outside the organization
and
Any attachment's file extension matches
sldm
ppsm
ppam
potm
xlam
xltm
xlsm
dotm
docm
Do the following
Delete the message without notifying anyone (you could tweak this to your liking)
It will look like this:

And then test test test.

 

Change the netconnection type to Private in the registry - Unable to find the netconnection

This one is quite common:

One of the network connection types on this machine is set to Public.

When trying to setup PSremoting you could run in to this error.

And when trying to find the connection that is marked as public you can't find it.

Chances are that your not connected to that connection at the moment, but the connection is there.
You can find all the connections that are configured on you machine in the registry:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

There you will find all the GUID's with all the connection profiles in it. The value we are looking for is  "Category" DWORD. It will look like this:

Where the value of the "Category" DWORD means:

0 = Domain
1 = Private
2 = Public

So just set all "Category" DWORD's to value 1, reboot and your Enable-PSRemoting command should work.

If that doesn't work you could just run:

Enable-PSRemoting -SkipNetworkProfileCheck -Force

And if all else fails force all connections (in case of an Hyper-V server installation on your WIndows 10/11 box) to be set to "Private":

$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}")) 
$connections = $networkListManager.GetNetworkConnections() 

# Set network location to Private for all networks 
$connections | % {$_.GetNetwork().SetCategory(1)}

Enable Hyper-V on a Hyper-V VM

Enable Hyper-V on a Hyper-V VM

Pure genius this:

Enable Hyper-V on the Hyper-v host for specific VM:

Set-VMProcessor -VMName "guest VM name" -ExposeVirtualizationExtensions $true

And then enable Hyper-V on the guest VM machine:

Windows 10

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All

Server 2016 & 2019

Install-WindowsFeature -Name Hyper-V, RSAT-Hyper-V-Tools

Where is Teams data stored?

 

List of potential dangerous attachment types and their file extensions to block

 

List of potential dangerous attachment types and their file extensions to block:

.EXE – An executable program file. Most of the applications running on Windows are .exe files.

.PIF – A program information file for MS-DOS programs. While .PIF files aren’t supposed to contain executable code, Windows will treat .PIFs the same as .EXE files if they contain executable code.

.APPLICATION – An application installer deployed with Microsoft’s Click Once technology.

.GADGET – A gadget file for the Windows desktop gadget technology introduced in Windows Vista.

.MSI – A Microsoft installer file. These install other applications on your computer, although applications can also be installed by .exe files.

.MSP – A Windows installer patch file. Used to patch applications deployed with .MSI files.

.COM – The original type of program used by MS-DOS.

.SCR – A Windows screen saver. Windows screen savers can contain executable code.

.HTA – An HTML application. Unlike HTML applications run in browsers, .HTA files are run as trusted applications without sandboxing.

.CPL – A Control Panel file. All of the utilities found in the Windows Control Panel are .CPL files.

.MSC – A Microsoft Management Console file. Applications such as the group policy editor and disk management tool are .MSC files.

.JAR – .JAR files contain executable Java code. If you have the Java runtime installed, .JAR files will be run as programs.

.BAT – A batch file. Contains a list of commands that will be run on your computer if you open it. Originally used by MS-DOS.

.CMD – A batch file. Similar to .BAT, but this file extension was introduced in Windows NT.

.VB, .VBS – A VBScript file. Will execute its included VBScript code if you run it.

.VBE – An encrypted VBScript file. Similar to a VBScript file, but it’s not easy to tell what the file will actually do if you run it.

.JS – A JavaScript file. .JS files are normally used by webpages and are safe if run in Web browsers. However, Windows will run .JS files outside the browser with no sandboxing.

.JSE – An encrypted JavaScript file.

.WS, .WSF – A Windows Script file.

.WSC, .WSH – Windows Script Component and Windows Script Host control files. Used along with with Windows Script files.

.PS1, .PS1XML, .PS2, .PS2XML, .PSC1, .PSC2 – A Windows PowerShell script. Runs PowerShell commands in the order specified in the file.

.MSH, .MSH1, .MSH2, .MSHXML, .MSH1XML, .MSH2XML – A Monad script file. Monad was later renamed PowerShell.

.SCF – A Windows Explorer command file. Could pass potentially dangerous commands to Windows Explorer.

.LNK – A link to a program on your computer. A link file could potentially contain command-line attributes that do dangerous things, such as deleting files without asking.

.INF – A text file used by Autorun. If run, this file could potentially launch dangerous applications it came with or pass dangerous options to programs included with Windows.

.REG – A Windows registry file. .REG files contain a list of registry entries that will be added or removed if you run them. A malicious .REG file could remove important information from your registry, replace it with junk data, or add malicious data.

.DOCM, .DOTM, .XLSM, .XLTM, .XLAM, .PPTM, .POTM, .PPAM, .PPSM, .SLDM – New file extensions introduced in Office 2007. The M at the end of the file extension indicates that the document contains Macros. For example, a .DOCX file contains no macros, while a .DOCM file can contain macros.

.GZ GNU Zipped Archive Files

.ACE Proprietary compression file archive compressed by WinAce

.ZIP & .RAR Compression files used to obfuscate malware.

Source

Add file extentions to the default Exchange Online Protection MalwareFilterPolicy with PowerShell

By default there are only a few extensions on the EOP list:

Get-MalwareFilterPolicy -Identity default | fl filetypes            
            
FileTypes : ace, ani, app, docm, exe, jar, reg, scr, vbe, vbs

You might want to add some more, here a quick way to do so:

First add the following to your PowerShell session to see all output:

$FormatEnumerationLimit =-1

The following to add the desired extensions to the list: Note the + sign, this is not an error but allows the list to be appended.

$FileTypesAdd = Get-MalwareFilterPolicy -Identity Default | select -Expand FileTypes            
$FileTypesAdd += "ace", "ani", "app", "appcontent-ms", "appref-ms", "bat", "cdxml", "cer", "cmd", "cnt", "com", "crt", "der", "diagcab", `
"docm", "epub", "exe", "grp", "hpj", "iqy", "jar", "jnlp", "js", "lnk", "mcf", "msh", "msu", "nzb", "par", "par2", "pif", "pl", "printerexport", `
"ps1", "ps1xml", "ps2", "ps2xml", "psc1", "psc2", "psd1", "psdm1", "pssc", "py", "pyc", "pyo", "pyw", "pyz", "pyzw", "reg", "scf", "scr", `
"settingcontent-ms", "theme", "udl", "vb", "vbe", "vbp", "vbs", "webpnp", "website", "wsb", "wsc", "wsh", "xbap", "xll", "xnk"

Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true -FileTypes $FileTypesAdd

Check to see the setting:

Get-MalwareFilterPolicy -Identity default | fl filetypes

$FileTypesAdd += ace, ani, app, appcontent-ms, appref-ms, bat, cdxml, cer, cmd, cnt, com, crt, der, diagcab, `
docm, epub, exe, grp, hpj, iqy, jar, jnlp, js, lnk, mcf, msh, msu, nzb, par, par2, pif, pl, printerexport, `
ps1, ps1xml, ps2, ps2xml, psc1, psc2, psd1, psdm1, pssc, py, pyc, pyo, pyw, pyz, pyzw, reg, scf, scr, `
settingcontent-ms, theme, udl, vb, vbe, vbp, vbs, webpnp, website, wsb, wsc, wsh, xbap, xll, xnk

In case you made a mistake and want to start over:

Set-MalwareFilterPolicy -Identity default -FileTypes $null

Create certificates in bulk from .CSR files with PowerShell

This is a bit of a work in progress, if anyone can help me out with the last bit.
I know it can be done with an foreach statement but haven't had the time to test it.

<#
  .Synopsis
     Request certificates from csr's
  .DESCRIPTION
     This script requests certificates from an on-premises CA
     Define you CA, PKI name, and output path
     Then copy the lines below for each certificate and fill the name between the quotes

     $name = ""
     $filename = "$name.cer"
     $status = Submit-CertificateRequest -path "C:\Scripts\Get-CertificateFromCSR\CSR\$name.csr" -CA $PKI -Attribute "CertificateTemplate:Webserver" 
     $ReqID = $status.requestid
     Get-IssuedRequest -RequestID $reqID -CertificationAuthority $PKI | Receive-Certificate -Path $OutPath\$name -Force
     cd $outpath\$name
     $item = ls
     Rename-Item -path $item -newname $filename

  .Created by
     Edwin van Brenk
  .Created for
     vanbrenk.blogspot.com
  .Date
     03-08-2021
  .Version
     1.0
  #>

# Run as Admin
Import-Module pspki

cd C:\Scripts\Get-BulkCertFromCSR\csr

$ca = Connect-CA caname.domain.lan
$PKI = "CAname.domain.lan"
$OutPath = "C:\Scripts\Get-CertificateFromCSR\IssuedCertificates\"

<#
$name = ""
$filename = "$name.cer"
$status = Submit-CertificateRequest -path "C:\Scripts\Get-CertificateFromCSR\CSR\$name.csr" -CA $PKI -Attribute "CertificateTemplate:Webserver" 
$ReqID = $status.requestid
Get-IssuedRequest -RequestID $reqID -CertificationAuthority $PKI | Receive-Certificate -Path $OutPath\$name -Force
cd $outpath\$name
$item = ls
Rename-Item -path $item -newname $filename

#>


$name = "Certificate-01"
$filename = "$name.cer"
$status = Submit-CertificateRequest -path "C:\Scripts\Get-CertificateFromCSR\CSR\$name.csr" -CA $PKI -Attribute "CertificateTemplate:Webserver"
$ReqID = $status.requestid
Get-IssuedRequest -RequestID $reqID -CertificationAuthority $PKI | Receive-Certificate -Path $OutPath\$name -Force
cd $outpath\$name
$item = ls
Rename-Item -path $item -newname $filename

$name = "Certificate-02"
$filename = "$name.cer"
$status = Submit-CertificateRequest -path "C:\Scripts\Get-CertificateFromCSR\CSR\$name.csr" -CA $PKI -Attribute "CertificateTemplate:Webserver"
$ReqID = $status.requestid
Get-IssuedRequest -RequestID $reqID -CertificationAuthority $PKI | Receive-Certificate -Path $OutPath\$name -Force
cd $outpath\$name
$item = ls
Rename-Item -path $item -newname $filename

$name = "Certificate-03"
$filename = "$name.cer"
$status = Submit-CertificateRequest -path "C:\Scripts\Get-CertificateFromCSR\CSR\$name.csr" -CA $PKI -Attribute "CertificateTemplate:Webserver"
$ReqID = $status.requestid
Get-IssuedRequest -RequestID $reqID -CertificationAuthority $PKI | Receive-Certificate -Path $OutPath\$name -Force
cd $outpath\$name
$item = ls
Rename-Item -path $item -newname $filename