How to fix a compromised (hacked) Microsoft Office 365 account

Verify that the users machine is not compromised

Make sure the user has anti-malware software installed, running and that it's up-to-date. If you do not have malware software installed, you can download a free solution from the Microsoft Protection Center. You can also use the Malicious Software Removal Tool to scan your computer for malware. In cases where these recommendations are not enough, you should follow the Advanced Troubleshooting steps.

Remediation Steps:

• Reset password (this secures the account and kills active sessions).
• Remove mailbox delegates.
• Disable mail forwarding rules to external domains.
• Remove global mail forwarding property on mailbox.
• Enable Multi-Factor Authentication (MFA) on the user's account.
• Set password complexity on the account to be high.
• Enable mailbox auditing.
• Produce Audit Log for the admin to review.

Resolution Steps: 

Issue – O365 user unable to send emails due to “Potentially Compromised Account’ Error.

Resolution: 

1. Login to O365 Admin Portal
2. Go to “Exchange”  in Admin Centers
3. Now go to  “Protection”
4. In Protection Page Search for the Restricted User
5. In the End There is “Actions” Section Click on Unblock – This will allow user to send out emails

False duplicate IP address detected on Microsoft Windows Servers and later virtual machines on ESX/ESXi when using Cisco devices on the environment

False duplicate IP address detected on Microsoft Windows Vista and later virtual machines on ESX/ESXi when using Cisco devices on the environment

Symptoms

When you assign an IP address on Windows Vista and later versions, you see a duplicate IP address conflict.

When you restart Windows Vista and later versions, you receive a 169.254.x.x IP.

When you set up the same virtual machine on a vSwitch with no uplink port on the vSwitch, the IP address is assigned successfully.

When you assign the same IP address to a Windows 2003 virtual machine on the same vSwitch, the IP address is assigned successfully.

Cause

This issue occurs when the Cisco switch has gratuitous ARPs enabled or the ArpProxySvc replied to all ARP requests incorrectly.

Resolution

Note: Investigate the network configuration at the physical layer for the root cause. For more information from Cisco

To work around this issue, turn off gratuitous ARP in the guest operating system.

Note: This procedure modifies the Windows registry. Before making any registry modifications, ensure that you have a current and valid backup of the registry and the virtual machine. For more information on backing up and restoring the registry, see the Microsoft Knowledge Base article 136393.

To turn off gratuitous ARP in the guest operating system:

Shut down the guest operating system and power off the virtual machine.

Change the virtual machine to a network vSwitch with no uplink. You can create one for this procedure.

Power on the virtual machine and log in.

Open the Registry editor.

In Windows XP to Windows Server 2003 - Click Start > Run, type regedit, and click OK.

In Windows 7 and Current - Click Start, type regedit, and click OK.

Locate this registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Click Edit > New, and click DWORD Value.

Type ArpRetryCount.

Right-click the ArpRetryCount registry entry and click Modify.

In the Value box, type 0 and click OK.

Exit the Registry Editor.

1. Shut down the guest operating system and power off the virtual machine.

2. Change the virtual machine back to a network vSwitch with the uplink.

3. Power on the virtual machine.

4. Alternatively, you can disable gratuitous ARP on the physical switch.

For example:

To disable gratuitous ARP in Cisco IOS, run this command:

# no ip gratuitous-arps

Re-Registering VSS DLL

Re-Registering VSS DLL Binaries In 32-Bit And 64-Bit Environments

1. Background

This article contains methods to re-register VSS DLL binaries. For a general overview of VSS, see VSS Explained: Common Writers, Services, And Hotfixes Available.

These steps only pertain to Windows Server 2008 Standard, Windows Server 2008R2, Windows Server 2003 and below. Attempting these fixes on Windows Vista or higher could cause operating system damage.

2. Overview

·         If the command vssadmin list writers does not produce an output, the commands in this article can help to re-register the VSS Service's associated DLL binaries.

·         Conflicting VSS-aware applications running on the protected machine is a common cause of backup errors.

·         Remove VSS-aware processes that are still present, including scheduled shadow copies in the OS. This ensures further long term stability and reliability.

·         Performing the below steps can help reduce recurring VSS writer failures.

3. Determine the OS version that is being investigated

·         From the Windows desktop, right-click on My Computer, and then click Properties.

·         On most operating systems, you can find the My Computer icon on the Start Menu. Depending on your OS version, the icon might be listed as Computer or This PC.

·         You can also open a Windows Explorer window, and find the icon on the left-hand pane.

·         On the Properties menu, find the entries for Windows Edition and System Type. Make sure that they are compatible with the prerequisites outlined in this article.

·         If the host machine is running a compatible operating system, follow the steps in section 3.1 (for 64-bit systems) or section 3.2 (for 32-bit systems).

3.1 64-Bit Version

To re-register VSS binaries and services on 64-bit systems, copy the following code into a file, and name it FIXVSS64.bat. Run it with administrative privileges.

rem FILENAME: FIXVSS08.BAT

rem

net stop "System Event Notification Service"

net stop "Background Intelligent Transfer Service"

net stop "COM+ Event System"

net stop "Microsoft Software Shadow Copy Provider"

net stop "Volume Shadow Copy"

cd /d %windir%\system32

net stop vss

net stop swprv

regsvr32 /s ATL.DLL

regsvr32 /s comsvcs.DLL

regsvr32 /s credui.DLL

regsvr32 /s CRYPTNET.DLL

regsvr32 /s CRYPTUI.DLL

regsvr32 /s dhcpqec.DLL

regsvr32 /s dssenh.DLL

regsvr32 /s eapqec.DLL

regsvr32 /s esscli.DLL

regsvr32 /s FastProx.DLL

regsvr32 /s FirewallAPI.DLL

regsvr32 /s kmsvc.DLL

regsvr32 /s lsmproxy.DLL

regsvr32 /s MSCTF.DLL

regsvr32 /s msi.DLL

regsvr32 /s msxml3.DLL

regsvr32 /s ncprov.DLL

regsvr32 /s ole32.DLL

regsvr32 /s OLEACC.DLL

regsvr32 /s OLEAUT32.DLL

regsvr32 /s PROPSYS.DLL

regsvr32 /s QAgent.DLL

regsvr32 /s qagentrt.DLL

regsvr32 /s QUtil.DLL

regsvr32 /s raschap.DLL

regsvr32 /s RASQEC.DLL

regsvr32 /s rastls.DLL

regsvr32 /s repdrvfs.DLL

regsvr32 /s RPCRT4.DLL

regsvr32 /s rsaenh.DLL

regsvr32 /s SHELL32.DLL

regsvr32 /s shsvcs.DLL

regsvr32 /s /i swprv.DLL

regsvr32 /s tschannel.DLL

regsvr32 /s USERENV.DLL

regsvr32 /s vss_ps.DLL

regsvr32 /s wbemcons.DLL

regsvr32 /s wbemcore.DLL

regsvr32 /s wbemess.DLL

regsvr32 /s wbemsvc.DLL

regsvr32 /s WINHTTP.DLL

regsvr32 /s WINTRUST.DLL

regsvr32 /s wmiprvsd.DLL

regsvr32 /s wmisvc.DLL

regsvr32 /s wmiutils.DLL

regsvr32 /s wuaueng.DLL

sfc /SCANFILE=%windir%\system32\catsrv.DLL

sfc /SCANFILE=%windir%\system32\catsrvut.DLL

sfc /SCANFILE=%windir%\system32\CLBCatQ.DLL

net start "COM+ Event System"

NOTE: In certain cases, it is normal for the msxml commands to not install, or fail to register. The eventcls and es commands fail to register on Vista and newer systems. The vssui command only applies to Windows Server 2003 and Windows Server 2008. 

3.2 32-Bit Version

To re-register VSS binaries and services on 32-bit systems, copy the following code into a file, and name it FIXVSS32.bat. Run it with administrative privileges.

cd /d %windir%\system32

net stop vss

net stop swprv

regsvr32 ole32.dll

regsvr32 oleaut32.dll

regsvr32 /i eventcls.dll

regsvr32 vss_ps.dll

vssvc /register

regsvr32 /i swprv.dll

regsvr32 es.dll

regsvr32 stdprov.dll

regsvr32 vssui.dll

regsvr32 msxml.dll

regsvr32 msxml3.dll

regsvr32 msxml4.dll

net start vss

net start swprv

NOTE: In certain cases, it is normal for the msxml commands to not install, or fail to register. The eventcls and es commands fail to register on Vista and newer systems. The vssui command only applies to Windows Server 2003 and Windows Server 2008. 

 Test VSS with the Microsoft VShadow tool

Reboot the production machine if you have trouble testing the VSS writers with the VShadow tool.

1. First, download the VShadow tool for your OS:

Windows 2000 - Unsupported; Windows 2000 does not have VSS

2. Download VShadow.exe to %windir%\system32\

3. Before running VShadow, stop any VSS-related services that are running. Also, stop the following services, and set them to Automatic Startup in services.msc:

·         Background Intelligent Transfer Service

·         Hyper-V Volume Shadow Copy Requestor

·         Microsoft Software Shadow Copy Provider

·         MS Software Shadow Copy Provider

·         SQL Server VSS Writer

·         Volume Shadow Copy

4. Open a command prompt with administrative privileges.

5. Attempt to take a shadow copy of each system volume by using the VShadow tool. The syntax for this command is as follows: vshadow VolumeList. Replace VolumeList with the drive letters of the hard disks attached to the system, as shown in Figure 1. Do not include removable media drives.

8. If the VShadow tool fails to take a shadow copy, reboot the production system.

Missing System Writer

Missing System Writer

Below are the identified causes for missing system writer issue, In most of the case it was identified system writer went missing after patching.

First thing to check if patches took place recently.

1.       Check if recently patching was done, Identified patches causing an issue (KB4087398, KB4089175, KB4089229, KB4089344, KB3170455, KB4090450, KB4056564

For recent issue patching was done on 22/06/18 and patches were found on server having issue.

Further checks to perform.

2.       Check & Delete any .BAK Entries in Registry – This has worked for me on Server 2008R2 - 

    "HKey_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList” 

  Please open the registry editor with regedit. Expand and local to the subtree, check if there is an entry that has a ".bak" value appended. If so, this may be cause the failure when trying to resolve the SID of the writer."

3.       Give full rights to NETWORK SERVICES Account on below Reg Key – “HKLM\CurrentControlSet\Services\VSS\Diag” - When this occurs, the Network Service account is removed.     

4.       Delete Temp Files from .NET Folder

C:\Windows\Microsoft.NET\Framework\v2.0.50727 – Delete any Temp Files found inside

5.       Capi2 – 513 Event ID

Execute below:

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

You should receive a successful result of

[SC] SetServiceObjectSecurity SUCCESS

Extend System Partition on a Windows Server 2003 VM using Dell ExtPart

Extend System Partition on a Windows Server 2003 VM using Dell ExtPart

There is no native tool that enables extending system partitions (C:\ drives) on Server 2003. There are multiple ways to perform this task, however, the only method that can be done onlineutilises a Dell utility called ExtPart. It can perform the extension of the system partition with no downtime although sometimes booting into Safe Mode and then running ExtPart is necessary to clear locks on the disk.

Note: This applies to Server 2003 only, newer versions of Windows do not suffer from this limitation, Disk Management as well as the diskpart are able to extend system partitions on-the-fly.

The first step is to download the ExtPart utility from this link. Click on the Download File link and save it to your desktop. The file is a self-extracting zip file called ExtPart.exe per the below:

Double-click on it and accept the default path it will extract the utility to:

Click on Unzip and the files will be extracted successfully:

To demonstrate how useful ExtPart is we will use an example whereby our demo VM has a 15 GB C:\ drive and it needs to be increased to 30 GB. A screenshot of the the current state of the C:\ drive is below:

We go into the VM settings and can see that the virtual disk is indeed 15 GB in size:

We increase the virtual disk size to 30 GB and apply the change:

Within the VM load Disk Management and select Action > Rescan Disks so that the system sees the newly added 15 GB of storage:

After the re-scan completes you will now see the extra 15 GB of unallocated space:

Now we need to run the ExtPart utility expand the C:\ drive so that it utilizes the 15 GB of unallocated space. To proceed, open the command prompt and go to the location where you extracted the ExtPart utility, in my case, C:\dell\ExtPart:

C:\>cd C:\dell\ExtPart

Then run ExtPart.exe:

C:\dell\ExtPart>extpart.exe

Enter the volume that is being expanded, in this example it is the C:\ drive so enter just C: without the backslash:

Volume to extend (drive letter or mount point): C:

Then enter the amount in MB to increase the volume by, I entered 15343:

Size to expand the volume (MB): 15343

The output will confirm the new size of the volume (C:\ drive), which is 30678 MB:

New volume size          :30678 MB (32169069568 bytes)

The full sequence of commands can be seen in the screenshot below:

When going back into Disk Management and re-scanning the disks, we can see that there is still 31 MB that is unallocated:

To add that remaining 31 MB to the C:\ drive, we go back to ExtPart and perform the same series of steps but this time add 31 MB:

Size to expand the volume (MB): 31

A screenshot of those steps is below:

Now going back into Disk Management you can see that the C:\ drive is using all of the provisioned space in the disk:

If the utility returns an error such as “the disk is not accessible” or “unable to connect to C:” then reboot the VM into Safe Mode and then run the same ExtPart commands. This is caused by various services locking the disk and preventing ExtPart from extending the volume. Booting into Safe Mode starts up the OS in a clean state, so only minimal services and drivers will run, thereby allowing ExtPart to expand the volume without interruption.

Check Dot Net Versions Installed on Server

Check Dot Net Versions Installed on Server

1.      Open the command prompt (i.e Windows + R → type "cmd").

2.      Type the following command, all on one line:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"

(This will list all the .NET versions.)

3.      If you want to check the latest .NET 4 version.

4.      Type following instruction, on a single line:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full" /v version

Extending Windows 2003 Server System Drive Without Reboot

EXTENDING WIN2K3 OS DRIVE

We’re in the middle of a VMware migration from 3.5 to 4.  Some of the older VMs have small C drives, and since Microsoft loves to release tons of patches, they’re running out of space.

In the past you could shut the VM off, attach the OS drive as an extra HD to another VM, increase the space and then use diskpart to extend it.  With VM Hardware v.7, it’s much easier!

Grab the ExtPart tool from Dell here.

1) Edit the VM’s settings to increase the disk size

2) Copy ExtPart to the VM and double-click to extract.  Default path is C:\Dell\ExtPart\

3) Check the Partitions before:

4) From a command-prompt, change to the ExtPart directory

5) Run extpart.exe

6) Enter in the disk you want to extend in lower-case, i.e., c:

7) Specify in MB of the amount of space you want to ADD, not the final total

8) Check partitions after

9) That’s all!

*note:  your partition in “Disk Management” will look funny until you quit and re-open Disk Managment:

Setting Specific Target DFS Environment

Setting Specific Target DFS Environment 

You can set a specific DFS-Target to be active but it won’t stick past the next logon I believe.

By default, the users will connect to the target in their 'site'

If you want to set a specific target as 'Primary" for everyone in a site

1.    Open up the DFS Management utility

2.    Open the Namespace the folder and target you wish to modify is under

3.    Select the folder you wish to control the targets on

4.    Right click on the target you wish to set as active

5.    Select the Advanced tab

6.    Check the "Override referral ordering" checkbox

7.    Select "First among all targets"

Edits:

This will allow users to Failover to other targets when needed.

It's also smart to enable the "Clients fail back to preferred targets" so if a user does fail over, they will switch back to the primary target once its back up.

You can also 'hard' control the targets by enabling/disabling them as needed. This works good when performing maintenance.