Friday, 26 March 2021

Enable Sharepoint Online Site Scoped Publishing Features

 There appears to be a known issue when trying to active SharePoint Server Publishing Infrastructure within the GUI of Sharepoint Online. This would usually be achieved through Site Settings > Site Collection Administration > Site Collection Features but the page can hang and timeout citing "Sorry, something went wrong Save Conflict. Your changes conflict with those made concurrently by another user. If you want your changes to be applied, click Back in your Web browser, refresh the page, and resubmit your changes."

The workaround to this is to do it via powershell. I had the script below supplied to me by Microsoft after raising a support ticket.

The first thing to do is to enable the PnpPowershell module by running the command below

  • Install-Module SharePointPnPPowerShellOnline
With the module installed, edit the script below to reflect the name of your Sharepoint Online site in the $SiteURL variable


#Config Variable
$SiteURL = "https://yoursite.sharepoint.com/sites/sitename"
$FeatureId = "f6924d36-2fa8-4f0b-b16d-06b7250180fa" #Site Scoped Publishing Feature
 
#Connect to PNP Online
Connect-PnPOnline -Url $SiteURL -Credentials (Get-Credential)
 
#get the Feature
$Feature = Get-PnPFeature -Scope Site -Identity $FeatureId
 
#Get the Feature status
If($Feature.DefinitionId -eq $null)
{   
    #sharepoint online powershell enable feature
    Write-host -f Yellow "Activating Feature..."
    Enable-PnPFeature -Scope Site -Identity $FeatureId -Force
 
    Write-host -f Green "Feature Activated Successfully!"
}
Else
{
    Write-host -f Yellow "Feature is already active!"
}


Save the script and execute it from Powershell and this will enable the feature.

Thursday, 21 January 2021

Replace ADFS Service Communication SSL Certificate ADFS 3.0

  1. Log onto the AD FS server and from the certificates MMC snap in, import the new certificate to the server into the Personal certificate store. Right click Certificates item and select All Tasks > Import option. Import your PFX bundle.
  2. Right click the new certificate and select All Tasks > Manage Private KeysAssign read permission to the service account used to run the AD FS service and click OK.
  3. Launch the AD FS Management Console, expand the Service menu in the left pane and click Certificates. Click the link Set Service Communications Certificate to set the new certificate. Select the valid certificate and click OKClick OK to close the message. The  certificate under Service communications has been updated.
  4. Right click the new imported SSL certificate and select OpenSelect Details tab, find the Thumbprint for the new certificate and copy it, removing any spaces. From PowerShell run the command Set-AdfsSslCertificate –Thumbprint <ThumbprintID>
  5. Restart the ADFS service on the server 
Update the Web Application Proxy Server

  1. Log onto the WAP server and import the new certificate as per the above steps
  2. Open PowerShell and run the command Set-WebApplicationProxySslCertificate –Thumbprint <ThumbprintID>

Thursday, 14 January 2021

Replacing SSL certificates on exchange 2013

 

  • Copy pfx file to exch03
  • Open exchange powershell as admin and run “certutil -csp "Microsoft RSA SChannel Cryptographic Provider" -importpfx name_of_file.pfx” – failing to import like this will and doing it through the GUI may lead to a loop when logging into ECP/OWA
  • Assign SMTP and IIS services in ECP > Servers > Certificates, overwriting old certificate. 
  • From a command prompt as admin, run “iisreset” – this will interrupt your exchange services
  • Delete old certificate. If it complains that IIS/SMTP services are still in use, run this powershell to enable those services on your new certificate "Enable-ExchangeCertificate -Thumbprint <Thumbprint> -Services 'iis,smtp' 
  • If it complains that it is in use on a send connector when trying to delete the old certificate, follow these steps:

  1. From ECP, open the certificate you want to use and note the thumbprint
  2. In exchange powershell run “$cert = Get-ExchangeCertificate -Thumbprint <thumbprint>”
  3. Set a new variable and assign it the concatenated values of the Issuer and Subject values of the certificate (must also include <I> and <S> before each field):
    $TLSCert = (‘<I>’+$cert.issuer+'<S>’+$cert.subject)
  4. Update the send connector with the new values
    Set-SendConnector -Identity “sendconnectorname” -TLSCertificateName $TLSCert

 

Thursday, 22 October 2020

Hiding folders on a windows share that users dont have access to (Access Based Enumeration)

A useful thing when it comes to Windows file shares is enabling Access Based Enumeration. When a user doesn't have security permissions to access a folder within a share, the folder is not visible to them.


To enable this, run the powershell command Set-SmbShare -Name Shares -FolderEnumerationMode AccessBased 

You can acheive the same thing on the AWS FSx Managed Windows file share by first entering a powershell session to FSx using the command enter-pssession -ComputerName fsxPowershellEndpoint -ConfigurationName FsxRemoteAdmin then the command Set-FSxSmbShare -Name ShareName -FolderEnumerationMode AccessBased. 

Thursday, 10 September 2020

Setting up trust between on premise domain and AWS Managed Active Directory

 On Premise domain prerequisites:

You must configure your on-premises firewall so that the ports below are open to the CIDRs for all subnets used by the VPC that contains your AWS Managed Microsoft AD

  • TCP/UDP 53 - DNS

  • TCP/UDP 88 - Kerberos authentication

  • TCP/UDP 389 - LDAP

  • TCP 445 - SMB

Wednesday, 9 September 2020

Raspberry Pi 4 Configuration for Web Page Display and VNC remote management

 Initial Pi Setup:

  1. Download the Raspberry Pi Imager for your OS from https://www.raspberrypi.org/downloads/
  2. Plug your SD card into your computer/card reader (not the Pi) 
  3. Run the installer. This will ask you to select the OS you want to install and the card you want to install it on 
  4. Once completed, insert the card into the Pi.
  5. Ensure your HDMI lead is plugged into slot 1 (the closest to the power cable and boot the Pi.
  6. Follow the startup wizard to set a password, sync time and update the Pi
  7. Setup a static IP
    1. Open the terminal from the icon on the top bar
    2. Run the command sudo cp /etc/dhcpcd.conf /etc/dhcpcd.conf.bak to take a backup before making any changes to the file
    3. Run the command sudo nano /etc/dhcpcd.conf to edit the configuration
    4. Find the section # Example static IP configuration:
      #interface eth0
      #static ip_address=192.168.0.10/24
      #static ip6_address=fd51:42f8:caae:d92e::ff/64
      #static routers=192.168.0.1
      #static domain_name_servers=192.168.0.1 8.8.8.8 fd51:42f8:caae:d92e::1
    5. Delete the # before interface eth0
    6. Delete the # before static ip_address=192.168.0.10/24 and change the IP to the one you want to give it. The /24 should be the subnet mask (/16 for 255.255.0.0, /24 for 255.255.255.0)
    7. Delete the # before static routers and change the IP to that of your router
    8. Delete the # before static domain_name_servers and everything after the =. After the = enter your DNS server addresses (domain controllers or router. You can enter multiple by leaving a space in between each
    9. Press ctrl+x to save. Press Y to save changes in the buffer then enter to confirm the file name to save it as.
  8. Reboot the Pi by running the command Reboot

VNC Setup:

  1. From the GUI, click the Pi icon in the top left and go to Preferences > Raspberry Pi Configuration
  2. Go to the Interfaces tab and tick enabled next to VNC. This will enable to the RealVNC server that comes as part of the recommended Raspberry Pi OS build
  3. Download the RealVNC viewer client for your OS from https://www.realvnc.com/en/connect/download/viewer/
  4. In the VNC Viewer software, click File > New Connection and enter the IP address you configured in step 7f above. Click OK and it should connect and prompt you for the username and password for the machine set during the initial setup wizard in step 6 above (default is pi and raspberry).

Disable sleep mode

  1. First off, to disable sleep mode by opening the terminal and running the command sudo raspi-config
  2. Go down to option 7 - Advanced Options and press enter
  3. Go down to option A6 - Screen Blanking and press enter
  4. When prompted with the "Would you lke to enable screen blanking" option, Highlight <No> and press enter
  5. You should now see the message "Screen blanking is disabled". Press enter then tab twice to highlight <Finish>. When asked if you would like to reboot now, choose Yes and press enter

Auto load web page in full screen mode on boot

  1. Enable auto login by opening the terminal and running the command sudo raspi-config
  2. Go to option 3 - Boot Options
  3. Select option B1 Desktop / CLI
  4. Select option B4 Desktop Autologin
  5. Back in the terminal run the command sudo nano /etc/xdg/lxsession/LXDE-pi/autostart
  6. Arrow down to the end of the file and copy/paste this in - /usr/bin/chromium-browser --kiosk --disable-restore-session-state https://www.yourwebsitehere.com 
  7. Press ctrl+x to save. Press Y to save changes in the buffer then enter to confirm the file name to save it as.
  8. Reboot the Pi by running the command Reboot and you should find the page loads in full screen when you sign in. 

Auto refreshing the page 

  1. There is a chromium extension that works well for this here - https://chrome.google.com/webstore/detail/easy-auto-refresh/aabcgdmkeabbnleenpncegpcngjpnjkc
  2. Install this and click the 'refresh' symbol which is added to the address bar. This will allow you to set a timer to refresh the page every 'X' seconds

Monday, 7 September 2020

Giving full mailbox access with auto mapping Exchange 365

 Firstly, launch an Exchange 365 powershell and connect to your tenant using connect-exopssession


FULL ACCESS (without AutoMapping): Add-MailboxPermission -Identity emailladdress@domain.co.uk -User emailladdress@domain.co.uk -AccessRights FullAccess -InheritanceType All -AutoMapping $false


SEND AS PERMISSION: Add-RecipientPermission emailladdress@domain.co.uk -AccessRights SendAs -Trustee emailladdress@domain.co.uk


Where -Identity is the account you want access to and -User / -Trustee is the account you want to allow access to it