How to deal with Stopped deletion threshold exceeded error in AD Connect

Hello All,

Ahmad Yasin

Today we will discuss very simple topic but sometimes it may confuse the IT Admins, this scenario happens when the Admin made a changes in the synchronization filtering by mistake, for example unselect one OU from OU filtering.

AD Connect have a built in feature to prevent accidental deletion for the objects, when AD Connect sync cycle occurs, if the number of objects to be excluded (deleted) from sync exceed more than 500 objects, AD Connect will prevent this process by default and the export in the Azure AD Connecter will failed with error: Stopped-deletion-threshold-exceeded.

Previously, we discussed this feature , if you are not familiar with this feature read my previous article: http://azuredummies.com/2016/07/15/ad-connect-object-deletion-threshold-office-365/

In this article, we will discuss how to deal with this error if you edited the Sync filtering by mistake, for example remove some OU’s from OU Filtering option.

To make it easier to understand, imagine that you need to exclude some OU’s from syncing, usually you will edit the properties of local AD Connecter in AD Connect console, then uncheck the unwanted OU as below snapshots:

 

Then Uncheck the unwanted OU’s, for example i need to uncheck Users OU, but by mistake let say i unchecked Employees OU as well as below:

Then I tried to run Initial sync using PowerShell As below:

When i went to AD Connect Management Console, i got below result:

from above snapshot, i ended up with 895 objects to be deleted! This is what i did by mistake since Employees OU contains this number of objects, fortunately in this case am very luck and thanks for AD Connect since it will prevent this process to be exported based on the deletion threshold feature, as the number of objects to be deleted exceed 500 objects then the process will be terminated as below snapshot:

Again, Thanks for AD Connect to prevent this accidental deletion for my objects, but what Next and how to deal with this?

Be careful, in this demo i already know that i unchecked Employees OU only, if i go and check the Employees OU again it will solve the issue, but assume that you don’t know which OU’s that was unchecked or another admin who did this!

in this situation, first, let’s go to Azure AD Connecter and click on search connector Space option as appears below:

Then from Scope choose Pending Export Option, check the delete checkbox and finally click search, as appears below all object that will be deleted will appears in the result, in our case it’s under pending Export since AD Connect prevent the completion of this process as below:

so, till now, we know that i have more than 500 objects to be deleted by Mistake, also i know that AD Connect terminate this process.

Note: if the number of objects to be deleted less than 500 objects then the process will complete successfully and the objects will be deleted from Azure AD which may interrupt cloud services such as exchange online. In this case, you need to revert the changes back and sync the objects again, don’t worry because AD Connect will match the objects again.

in this stage, be very careful, if you are trying to guess which OU’s should be selected and in any level, you reach below than 500 objects to be deleted then the process will be completed and you will lose some objects in Azure AD which will interrupt the cloud services until you sync the objects again.

the best approach in this case is to enable the staging Mode for AD Connect server, i will not discuss the staging Mode deeply here (maybe in Next Articles), but simply this action makes the server active for import and synchronization, but it does not run any exports which means that nothing will be commit in Azure AD or local AD and this is what we need till we correct the AD Connect OU filtering operation.

To enable the staging Mode, Run AD Connect Wizard Again, click Configure as below:

Choose “Configure Staging Mode” and click Next:

Enter the GA credential and Click Next:

Check the “Enable Staging Mode” option and click Next:

Finally, click Configure:

Once the configuration completed, click Exit:

if you go to the AD Connect management console, we can see that no export operation was executed as below:

Also, to double confirm, i ran initial sync again as below:

Again, no export operations was executed as below:

For Now this is Great as i can modify and try to correct the configuration without be worried, if we go now to the Azure Connector and search for connector space, we still see the pending deleted objects, Now even while i am correct the configuration ends with less than 500 objects, it will not be deleted since the export operation will not be executed as we are currently in staging mode:

In you case, you need to correct the configuration, and you can go every time to the connector space and see if there is still pending deletion objects or not, in my case i know that the Employees OU should be included again in the sync to prevent this deletion, in your case if you are not sure you can click in any pending export deletion object and see in which OU for example it’s located to check it as below:

Note: From My point of view, if you still not sure which OU’s should be selected, i prefer to select the whole directory then you can exclude one by one based on your requirements.

I went back and check the Employees OU as below:

Once i ran the initial sync again, i can see again that the export not executed as we are still in the staging mode as below:

I went again and search in the Azure AD Connector, i found nothing will be deleted and this make sense since now AD Connect doesn’t see anything to be deleted as Employees OU included in the Sync again as below:

Once i verified nothing will be deleted, i will disable the staging Mode, the same procedure as enabling it but now Just uncheck the option:

Once, the configurations finish, i can see that the export executed without any deletion as below snapshot: ( I Have some errors in export for other objects so don’t worry about that 🙂 )

 

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin is a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.

Find Ahmad at Facebook and LinkedIn.

Getting Started with Azure Active Directory Graph API

Hello Everybody,

In this article we will discuss the concept of Azure Active Directory Graph API and how to start using Graph API.

In local active directory, when any application integrated with local AD want to look up for objects in the directory it used Lightweight Directory Access Protocol (LDAP) in order to perform the queries, LDAP is the protocol used to perform queries against local AD, modifying objects in AD, Adding and removing …etc. For example, if local exchange server wants to search for an object in active directory it will use LDAP protocol to achieve this. Also any other application which integrated with local AD will use LDAP to communicate with Active Directory.

So in general, LDAP is a query language with its special syntax that used to search and perform some operations in the directory such ass Add objects, Update Objects …etc.

To demonstrate the concept of LDAP, lets login to local active directory server and try to search for an object in our directory using LDAP queries, the simplest way to do that is to open Active Directory users and computers console, Right Click in the directory name and choose Find as appear below:

Now, change the find option to be “Custom Search” and click on Advance tab as appear below:

In “Enter LDAP query” field, we can enter our queries and click on Find Now button to get the result, for example if we write below LDAP Query and click on “Find Now” button:

LDAP Query to retrieve all groups in the directory:

(objectCategory=group)

We can see Cleary from above snapshot that the LDAP query get all groups in our directory.

Also, let’s try to get all objects with User type which their names begin with “MO”, to do that let’s execute below LDAP query:

(&(objectCategory=person)(objectClass=user) (cn=Mo*))

The result of the query will retrieve all users which their names starting with “Mo” as appear below:

So imagine that you have an attendance system in your environment, usually such these systems require user’s information, these systems usually configured to be integrated with local active directory to retrieve all employees’ information, in this case the attendance system most probably will apply the queries against local active directory using LDAP queries.

In azure Active Directory the story is different, LDAP was replaced with Graph API which can be used in order to execute queries against Azure Active Directory, Graph API provides programmatic access to azure AD through, Applications can use Graph API to perform Create, read, update and delete operations (CRUD) against Azure AD and get the result of queries in JSON format, so the applications should communicate with Azure AD using Graph API instead of LDAP protocol.

The general syntax of Graph API queries looks like below formula:

https://graph.windows.net/{tenant-identifier}/{resource-path}?[query-parameters]

Example on that Syntax:

https://Graph.Microsoft.net/AzureDummies.com/user?$filter=DisplayName eq “Ali Saleh”

Service Root: In Azure AD Graph API, the service root is always https://graph.windows.net.

Tenant identifier: This can be a verified (registered) domain name, in above example it’s our verified domain AzureDummies.com, we can also use .onmicrosoft domain if needed, It can also be a tenant object ID or the “myorganiztion” or “me” alias

Resource path: This section of a URL identifies the resource to be interacted with (users, groups, a particular user, or a particular group, etc.) In the example above, it is the top-level “users” to address that resource set. You can also address a specific entity, for example “users/{objectId}” or “users/userPrincipalName”.

Query parameters: ? separates the resource path section from the query parameters section. The Graph API also supports the following OData query options: $filter, $orderby, $expand, $top, and $format. The following query options are not currently supported: $count, $inlinecount, and$skip.

Note: at the end of the query you should specify the API version to be used, for example you should write above syntax in this way https://graph.windows.net/AzureDummies.com/users?api-version=1.6, but in our below examples we will not specify it since the web interface will use its API version implicitly.

To demonstrate the concept more, let’s navigate to https://graphexplorer2.cloudapp.net which is a web interface which will help us to execute Graph API queries against Azure AD, after open the web page just click on sign in label as appear below:

Enter a credential for a user with appropriate permission in the directory and click sign in button as appear below:

It will ask you to confirm the requested permission, click Accept button as appear below:

Just verify that the login successes as appear below:

Note: Graph Explorer site only support read (GET) queries, it’s not supported to execute other operations such as deleting objects, we can use https://graph.microsoft.io/en-us/graph-explorer in order to execute other operation which will be discusses in next lines.

Now, for example to get all details about all users in Azure AD we can run below query and click on the GET Button as appear below:

If we zoom out the result, we can see for example a user called “Ahmad Yasin” with his information as appear below:

Assume now we need to get all information about “Ali Saleh user, we can execute the GET query and specify the User Principle name in the query as appear below:

Also if we need to get the Job Title for “Ali Saleh” we can execute the GET query and specify the attribute we need to find it in the query as appear below:

Let’s assume we need to know the status of the password policy for the same user, we can execute below query:

Also we can execute other commands like Create, delete and update operations against azure AD, to demonstrate more, let’s navigate to other website https://graph.microsoft.io/en-us/graph-explorer which will give us the ability to execute more operations, let’s sign in in the page with our tenant privileged account as appear below:

Let’s try to get the information about “Mohammad Saleh” user by executing GET query as appear below:

Let’s double confirm that the user exists in our Azure AD by looking for it in office 365 users as appear below:

Now, let’s try to remove the user by executing below DELETE command:

To verify that the user was removed, let’s try to execute GET query as appear below:

We can be noticed from above snapshot that the user no longer exists, to double confirm that the user was removed, let’s go back to office 365 users, we will see now that the user appears in the deleted user’s container as appear below:

Note: This Article will not discuss the development side using Graph API, It’s Just to demonstrate the general concept of accessing Azure AD using Graph API, for full information about Graph API concepts and references, follow Microsoft Article: https://msdn.microsoft.com/en-us/library/azure/hh974476.aspx

As a conclusion, Application can be integrated with Azure Active Directory using Graph API in the same manner of integrating Applications with local active directory using LDAP.

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin is a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.

Find Ahmad at Facebook and LinkedIn.

 

Azure AD Pass-Through Authentication – Concept Overview

Hello Azure Lovers,

In this Paper,we will discuss the concept of Azure AD pass-through authentication which will enable the organization to keep the users’ password in on-premises and redirect all cloud authentications to be against local active directory.

To download the full document, visit Microsoft Technet: https://gallery.technet.microsoft.com/Azure-AD-pass-through-d0c97543 

Ahmad Yasin

Ahmad Yasin (MCSA office 365, MCSE, Messaging, Azure certified)

Ahmad Yasin is a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.

Find Ahmad at Facebook and LinkedIn.

 

 

Understanding AZURE AD Connect Sync Scheduler

Hi All,

we prepared a document to discuss the concept of Azure AD Connect Sync Scheduler, we tried to demonstrate the concept and let you have a good knowledge on it in addition to how modify the schedule using windows Azure PowerShell based on your requirements, we assumed you have a basic knowledge of Azure AD Connect in this document, to download the document visit TechNet gallery from below:

https://gallery.technet.microsoft.com/Understanding-AZURE-AD-0a837ca7

 

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin in a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.

Find Ahmad at Facebook and LinkedIn.

Office 365 [Solved] – Migration Permanent Exception: You can’t use the domain because it’s not an accepted domain for your organization

Hello folks,

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

In one of our Migration projects from on-premises exchange to Exchange online (Office 365), we enabled Directory Synchronization using AD Connect tool, All on-premises users was synchronized to Azure AD successfully.

After enabling Hybrid Configuration wizard, we migrated a lot of mailboxes without any issues, few number of mailboxes failed to be migrated and showed below error (From office 365 portal, Migration Batch Details):

aa2

 

The error says:

“Migration Permanent Exception: You can’t use the domain because it’s not an accepted domain for your organization –> You can’t use the domain because it’s not an accepted domain for your organization”

Now. let’s understand why this error appear:

Assume you are the owner of AzureDummies.com domain, all email in the format of emailaddress@AzureDummies.com, in order to migrate these mailboxes to office 365 (Exchange online) you should prove for office 365 tenant that you are the real owner of the domain AzureDummies.com and this make sense, Imagine that there is no need to prove the ownership then anyone can create emails in office 365 using any public domain name which is impossible to be allowed.

In our case, our domain already verified in office but still we faced the same error for some mailboxes, when we checked the failed on-premises mailboxe (Email Address Attribute) we something similar to below:

aa1

from above snapshot, the blue arrow is the primary email address for this mailbox and use the same domain which was verified in office 365, but we can notice that the same mailbox have another alias end with different domain (Red Arrow) which is not verified in office 365 which is the main cause of this issue.

To solve the issue we have two options, the first one is to remove the alias and resync the object using AD Connect to update the attribute in Azure AD, in that case the user will not be able to receive emails using the alias.

the second option is to verified the alias domain in office 365 and re-migrate the mailbox again, and this is what we did 🙂

 

About Blogger …

 

Ahmad Yasin

Ahmad Yasin (MCSA office 365, MCSE, Messaging, Azure certified)

Ahmad Yasin in a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.
Ahmad is currently working in Specialized Technical Services Company (STS).
Find Ahmad at Facebook and LinkedIn

 

 

Secure terminal Services (RDP) using Azure Multi-factor Authentication (MFA) – Part 2

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin

Hello Everyone,

In First article of this series we discussed the general concept of Azure Multi-Factor Authentication and how it’s work

In second part of this series we went more deeper in the technical aspects of the implementation of Azure MFA by taking an example of how to secure your remote desktop connection through Azure Multi-Factor authentication and we prepared the azure tenant and the Azure MFA provider.

In this part, we will continue our demo of integrating remote desktop connection (RDP) with Azure MFA by installing the Azure MFA server in the same server we need to secure it.

in this demo we have a server called Secure-Server with windows server 2008 r2 joined to the domain, we need to secure the remote desktop connection to it by installing the MFA server in it.

In this demo, I assumed that the MFA provider is already prepared, for more information read our previous article.

so let’s start the installation of the MFA:

Just to remind you, the below three snapshots show you how to download the MFA setup and generate the credentials which we explained in the previous article :

9

10

11

12

Now after the download of MFA completed, double click in the setup file, choose the installation path and click Next:

13

wait a seconds for the installation to complete:

14

once the installation finish click Finish:

15

A new Wizard will appear as below, Click Next:

16

Now enter the Email and Password credentials which we obtained before from the MFA provider, if you forget how to obtain it please read our previous post, if the credentials expired you can re-generate it again, once you fill the required information click Next:

21

Now, MFA server will try to communicate with Azure MFA Provider as below:

22

Ops, we received an error message as shown below ” Unable to communicate with the Multi-factor Authentication POP, The Multi-factor Authentication server could not be activated … etc“, this error is normal if you use an proxy to access internet, in this case you must verify three things if you use a proxy server:

1- Your proxy is set correctly in the server (in IE browser).
2- Run CMD as administrator, write the following command:
netsh winhttp import proxy source=ie
3-  MFA server must be able to communicate on port 443 outbound to the following:

  • https://pfd.phonefactor.net
  • https://pfd2.phonefactor.net
  • https://css.phonefactor.net

If outbound firewalls are restricted on port 443, the following IP address ranges will need to be opened:

IP Subnet Netmask IP Range
134.170.116.0/25 255.255.255.128 134.170.116.1 – 134.170.116.126
134.170.165.0/25 255.255.255.128 134.170.165.1 – 134.170.165.126
70.37.154.128/25 255.255.255.128 70.37.154.129 – 70.37.154.254

If you are not using Azure Multi-Factor Authentication Event Confirmation features and if users are not authenticating with the Multi-Factor Auth mobile apps from devices on the corporate network the IP ranges can be reduced to the following:

IP Subnet Netmask IP Range
134.170.116.72/29 255.255.255.248 134.170.116.72 – 134.170.116.79
134.170.165.72/29 255.255.255.248 134.170.165.72 – 134.170.165.79
70.37.154.200/29 255.255.255.248 70.37.154.201 – 70.37.154.206

23

After we set a proxy rules, I tried another time to activate the MFA as below:

24

finally, its verified successfully, Now the wizard will ask you to create new MFA group or choose existing one, since it’s first MFA server to be deployed, give any meaningful name for the new group as below, also note that the group used to manage more than MFA servers and enable replication between the servers if there is a need, Click Next:

25

Uncheck enable replication between servers option and click Next:

26

Now, you can select what application need to integrate it with Azure MFA, the last option is remote desktop, you can select it and click Next, but in our demo we will click cancel to configure the remote desktop from the MFA console, click Cancel.

27

Now, go to star menu and click on Multi-Factor Authentication Server icon:

28

Azure MFA server is loading as below:

29

After a while the console appear, this is the MFA server console that you can manage the MFA setup, in the status option it display that the server Secure-Server.demo.lab is online which is the same server we need to secure the RDP connection on it and the MFA server at the same time:

30

Also if you go to the Azure MFA provider manage page, click on Server Status option you will see the server is online as below:
31

Now back to the MFA server console, go to windows authentication, check “Enable Windows Authentication” option as below, then click Add button:
32

Choose the server name and terminal services as an application option, check the “Enable” option, now if you will apply all users in AD to use MFA check the “Require Multi-Factor Authentication user match” option, if not leave it uncheck as below, click OK:

33

The MFA is configured to secure the RDP in that server, it mentioned that the server need to be restarted to take the effect, click OK and wait before restart to continue the configuration:

34

As shown below, the server appear in the console:
35

Now go to Users icon to add the users you need to apply MFA authentication on them, click in Import from Active Directory button as below:

36

choose the users you need and click Import as below:

37

The users successfully imported as below, click OK:

38

the new users appear in the console, there is a warning icon beside each user, this warning because the user must enabled for MFA manual, by default when you import the user it will be not enabled for MFA automatically, double click in any user:

39

fill the required information as below:
-Country Code.
-Phone.
– choose MFA to be phone call, Text Message or mobile app … etc. we will choose for this demo a phone call option.
-check the enabled option.
Finally, Click Apply:

40

note after we check the enable option the warning icon disappear, do the same for all users you need:

41

after I prepared all users, the users appear in the console without the warning icon, to test the configuration choose any user and click the test button:

42

provide the password and click test:

43

wait a while:

44

Now, the user should receive a call, if he end the call the authentication will be refused because it will considered that another person try to use his/her credentials, if the user click (#) he/she confirm that he is the one trying to access the server:

45

After I clicked (#), the test completed as belwo:

46

Now, after I restarted the machine to take effect, I try to access the server remotely as below:

47

I tried to login with the administrator user:

48

Now the welcome page start:

49

during the login and within the welcome page  I received a call from Microsoft MFA, I answered the call and end it direct:

50 - Copy

Because I end the call and didn’t press the (#) key, the login process failed as below:
52

I tried to login again with the same user: 53

I received another call from Microsoft MFA, but this time I press (#) key:

54

Because I press the (#) key I confirmed for Microsoft that I am the same person who try to login now, so I successfully login to the server as below:

55 56

So in this article we tried to demonstrate how to install the MFA server and integrate it with the remote desktop connection (RPD).

In next part we will show you how to customize the MFA setup by using Fraud alert, changing the received call voice, generate a reports … etc.

Stay tuned 🙂

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin in a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also hold many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.
Ahmad is currently working in Specialized Technical Services Company (STS).
Find Ahmad at Facebook and LinkedIn

 

 

 

 

Secure terminal Services (RDP) using Azure Multi-factor Authentication (MFA) – Part 1

Hello Everyone,

In First article of this series, we discussed the general concept of Azure Multifactor Authentication, and how MFA participate in securing your on premise environment and Hybrid one if exist.

In this article we will go in more technical details about how to use Azure Multifactor Authentication using a real example.

One of my customers have a server which contains a highly secure data and only around 6 users have a remote desktop access to that server, the customer need to add more security layer for accessing this server.

I suggest the customer to use Azure MFA, since it will add a highly secure layer to the remote desktop access to the server in addition to the low cost of this service.

so let’s start the technical steps to do that, remember that we need to integrate remote desktop protocol access (RDP) with Azure MFA.

in this part we will prepare the Azure MFA provider and download the MFA server setup files, In next part we will deploy and configure the MFA server to secure the RDP.

First of all let’s summarize the requirements to implement this scenario:

1- we need an azure account (Azure Tenant) to configure and install the Azure setup, if you don’t have account you can sign up for one month as trial, for more info follow this link : https://azure.microsoft.com/en-us/pricing/free-trial/

2- integrate RPD protocol with Azure MFA is not supported in windows 2012 R2 (until the date of this article), which means if you need to integrate RPD with Azure MFA you need to install windows 2012 and earlier such as windows 2008 R2.

3- To secure the remote desktop protocol (RDP) with Azure Multifactor, you must install the Azure MFA server in the same RDP server, in other word assume you have a server called “SRV1”, then you should install the MFA setup in the “SRV1” server, if you look back to point #2 you can conclude that you cannot secure the RDP for windows 2012 R2 (until the date of this article).

This deployment called MFA stand alone server since all deployment will be on premise and no integration will be done between local AD and Azure AD.

Now, log in to your azure tenant using https://manage.windowsazure.com, go to active directory tab from left pane:

1

Now choose MULTI-FACTOR AUTH PROVIDERS option from the top options,

2

Click New:

3

MULTI-FACTOR AUTH PROVIDERS used to install the MFA server setup files, also the provider will be responsible for the usage calculations and you can customize your setup from the provide such as fraud alerts.

Now choose App Services -> Active Directory -> MULTI-FACTOR AUTH PROVIDERS – Quick Create.

5

Name: choose any meaning full name for your provider.
Usage Model: you have two options here, per user enabled and per authentication, this option cannot be changed later, if you need to change it later you must create new provider, the difference between the two model is how Microsoft will charge you, if you choose per enabled user then you will be charged for how many users using MFA regardless of how many actual authentication occurs, if you choose per authentication you will be charged every time the users try to authenticate using Azure MFA.
Directory: choose Don’t link a directory since we will install the stand alone MFA server without integration with Azure AD.

After you fill the required information, click create:

6

after less than minute a new provider will be available in your tenant as shown below:

7

Click in the provider just created, then click in the MANAGE button in the bottom of the portal page:

8

The MFA Management page will appear, click in Downloads button as below:

9
in the download server page, it’s list the supported OS versions for MFA server including windows 2012 R2 and this is not what I said before, be smart I mentioned that the RPD feature is not supported in windows 2012 R2 but there is a lot of features that work in windows 2012 R2, Now click in Generate Activation Credentials button to generate the credential which will be used to register your server in MFA provider during the setup.

10

Email and password credential will  be generated, these credential valid to be used within 10 minutes, if you take more than 10 min to start the setup you can re generate a new credentials.

11

Now click the download text to start the downloading of the MFA setup:

12

After the download complete, copy the setup file to the server you need to secure the RDP on it and double click on the setup to start the installation.

In Next Part we will continue our demo by installing the multifactor server and configuring it to secure remote desktop access.

So keep tuned 🙂

About Blogger …

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin in a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also hold many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.
Ahmad is currently working in Specialized Technical Services Company (STS).
Find Ahmad at Facebook and LinkedIn

 

 

 

SalesForce with ADFS Integration for SSO – IOS devices cannot access the SalesForce page

Hello All,

Ahmad Yasin

In this article, we will discuss a small topic but it’s very important for most of the companies that Integrate Salesforce with Active directory Federation Service (ADFS) to achieve single Sign on (SSO).

For some reason, I tried to deployed ADFS with SalesForce to achieve SSO following below article from SalesForce site:

https://developer.salesforce.com/page/Single_Sign-On_with_Force.com_and_Microsoft_Active_Directory_Federation_Services

Note: we will not discuss how to integrate SalesForce with ADFS in this article, for the deployment guide see: https://developer.salesforce.com/page/Single_Sign-On_with_Force.com_and_Microsoft_Active_Directory_Federation_Services

After complete the integration between SalesForce and ADFS everything works as expected except the IOS devices. when the user try to access the SalesForce pagethey login to the SalesFroce page, then click on STS to reach the ADFS Page:

My ADFS URL is sts.mydummieslab.com as appears below, it will ask for on-premises credential as below:


After entered the credential, Damn, i got below error:

 

Dummies STS

An error occurred

An error occurred. Contact your administrator for more information.

Error details

  • Activity ID: 00000000-0000-0000-7100-00800000009a
  • Error time: Fri, 28 Apr 2017 16:59:06 GMT
  • Cookie: enabled

User agent string: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1

As usual, i went to Google and bing my best friends and start searching, unfortunately, i didn’t find something that can help directly, but while am reading i find one important article which is: http://kb.tableau.com/articles/issue/error-saml-protocol-parameter-relaystate-was-not-found-or-not-valid-using-adfs-saml-with-ios ; this article mentioned the same error with different application but with IOS also, what i noticed in the article that the reason of the issue as per the Article is: iOS and OS X browsers, such as mobile and desktop Safari, truncate cookies larger than 4KB, which are required by Microsoft ADFS.

Above reason make me think in different way, for that I started to collect Fiddler traces to see whats happening in the Network level, configuring Fiddler to collect traces from IOS devices explained very well in Fiddler Article: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForiOS

Note: I am not a fiddler specialist but i am doing my best to analysis the traces, if you find that i mentioned something wrong in the analysis don’t blame me 🙂

After collected the logs i found that the size of the packets (Cookies) exceed 4KB which maybe the cause in our case as below snapshots:

for now, i knew that there is some limitation in the cookies size and it seems (as per my understanding for Fiddler) that the size is more than 4KB, Then i start thinking what to do now ! Again went to my best friends Google and Bing but nothing found, suddenly i say ok let me try to change the HTTP Method used in the SalesForce, i am very lucky that i thought in this way because changes the SalesForce HTTP method from HTTP Post to HTTP redirect solve the issue totally, let me explain what i did exactly:

From the ADFS side, i made sure that the default configurations is the same and not changed as below:

Go to the SalesForce relying part that you already configured in the ADFS per SalesForce Article and make sure that the HTTP method binding is Set to POST as below:

From SalesForce admin page, open the single sign on configuration page, click on Edit to modify the SAML Single Sign on Setting as below:

You will find that the Service Provider Initiated Request Binding is set to HTTP Post as below (This configuration mentioned in the SalesFroce Article):

Now, this is the modification that you need to do, Just change Service Provider Initiated Request Binding to HTTP Redirect and save the configuration as below:

After that, Try the IOS it will work like a charm and of course in addition to other OS’s like windows and Android.

I don’t have enough info why this change solve the issue but at least it’s solve it 🙂 🙂

Ahmad Yasin

Ahmad Yasin (MCSA office 365, MCSE, Messaging, Azure certified)

Ahmad Yasin is a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.

Find Ahmad at Facebook and LinkedIn.

 

 

Azure ADConnect Export Failed with Permission-issue error (Insufficient access rights to perform this operation)

Hello Guys,

while i am working in one of the ADConnect deployment, we faced an issue in the export operation with error “Permission-Issue” for some users as appears in below snapshot:

from above console, when we clicked on the one of the effected users to expand the error, we got below snapshot with an error “Insufficient access rights to perform this operation” as appears below:

when we went to the AD users and computers, we noticed that all effected users have disabled inheritance permission as appear below (since the button enable inheritance appears this mean the inheritance is disabled):

Simply, enabling the inheritance solve the issue and the ADConnect was able to export these identities.

Now, the important question is why to enable the inheritance !

the answer is very simple, Disable Inheritance means that the account no longer inherits permissions from a parent object (I.E. an OU), in most cases this happens when the object were added to privileged group such as domain admins group.

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin is a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.

Find Ahmad at Facebook and LinkedIn.

 

 

Understanding the Importance of MRS Proxy in Hybrid deployment Model – Office 365

Hello office 365 Admins,

Ahmad Yasin

In one of the projects we worked on, we had an exchange 2013 servers and we tried to set up the hybrid configuration wizard (HCW) in order to migrate mailboxes to office 365, as usual we installed AD Connect and synced users to Azure active directory.

All HCW prerequisites was met such as verifying the domain, Public Certificate … etc. we started the hybrid configuration wizard but unfortunately the wizard completed with a warning as below:

HCW8078: Migration Endpoint could not be created.
Microsoft.Exchange .Migration.MigrationServerConnectionFailedException
“The connection to the server mail.mydomain.edu.jo could not be completed.”
Microsoft.Exchange.MailboxReplicationService.RemoteTransientException:
The Call to ‘https://mail.mydomain.edu.jo/EWS/MRSProxy.svc’ failed. Error Details:
The Http Request was forbidden with client authentication schema ‘Negotiate’. –>
The remote server returned an error :(403) forbidden.

new error AA

First of all, let’s start our troubleshooting by access the URL mentioned in the error details which is in red color to see if we can access the URL using the browser, so if I try to access the URL it will ask me for credential, once I entered any domain user I receive the below response:

error AA
So from Above response we can notice that something wrong happened while trying to access the URL which cause the Hybrid configuration wizard to notify us by a warning.

before we fix the error let’s demonstrate why HCW trying to access this URL while configuring the Hybrid deployment !

MRS Proxy stands for mailbox replication service proxy which is used for cross forest mailbox move and remote move migration between on premise exchange and exchange online (Office 365), which means that this service is using while exchange requested to initiate the Migration process, In exchange 2013 this service is included in the mailbox servers and during the cross forest and remote migration the client access server act as a proxy for incoming move request for the mailbox server, the ability for client access server to accept the move request is disabled by default to reduce the attack surface, to allow it to accept the incoming move request you should enable the MRS proxy endpoint.

So even the wizard show a warning not failure, if you decide not to fix the warning the Migration request will be failed when you try to move a mailbox to office 365 ( Exchange online).

So to enable the MRS proxy in exchange 2013, login to the ECP page, go to servers -> Virtual directories and double click in EWS virtual directories as below:

4

Once you open the virtual directory, check the enable MRS proxy Endpoint option then click save:

5

If you have more than one client access server, be sure to enable the MRS proxy in all servers.

if you need to use exchange PowerShell to enable it execute the below command (replace the server name with your CAS server):

Set-WebServicesVirtualDirectory -Identity “MyCASSErver\EWS (Default Web Site)” -MRSProxyEnabled $true

For Exchange 2010, you can enable it using below command (replace the server name with your CAS server):

Set-WebServicesVirtualDirectory -Identity “MYCASSErver\EWS (Default Web Site)” -MRSProxyEnabled $true -MRSProxyMaxConnections 50

Once you enable it, I prefer to reset the iis by execute below command using CMD:

iisreser /force

Once you finish the Migration it’s highly recommended to disable MRS to reduce the attack surface of your organization.

After that you can run the hybrid configuration wizard, In My case it was a strange story since when I checked the MRS Proxy it was enabled, so to solve my problem I disabled it and re-enabled it Again, once I did this I tried to access the URL again and I got something similar to below result:

6

Finally, I ran the hybrid configuration wizard and it was completed successfully and the Migration of mailboxes went smoothly.

About Blogger …

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin in a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also holds many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.
Ahmad is currently working in Specialized Technical Services Company (STS).
Find Ahmad at Facebook and LinkedIn.

 

 

 

 

 

 

AD Connect objects deletion threshold – office 365

Hello Office 365 Admins,

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

while we are working in one project to Migrate exchange 2013 to office 365 (Exchange online), we started to sync the users to azure active directory using AD Connect tool, for some reasons unfortunately we synced around 3000 users to azure active directory by Mistake, so we tried to exclude the un-correct OU’s by do OU’s filtering in AD Connect and force the sync again in order to delete these objects from azure active directory, but again unfortunately these users still appear and have a synced status in Azure AD even we excluded it from the filtering.

so we decided to look to the event viewer logs in the AD Connect server, after reading the logs we found the below error appear in the logs as below:

Source : Directory Synchronization, Event ID:  906

Description: unable to process this synchronization cycle in azure active directory because the object deletion threshold was met or exceed

new error

So AD Connect have a threshold for deletion object to prevent accidental delete a bulk of objects by mistake, so it’s try to help you to prevent delete a large number of objects by mistake.

this threshold equal to 500 objects as stated in Microsoft articles, so by default you cannot delete 500 or more objects in one shot but if you have a case like me and you need to delete more than this number at same time you can simply disable this feature from azure AD PowerShell using below command:

Disable-ADSyncExportDeletionThreshold

error2

to learn how to connect to office 365 PowerShell, follow this link: https://technet.microsoft.com/en-us/library/jj984289(v=exchg.160).aspx

 

after the deletion complete we recommend to re-enable this feature using PowerShell using below command:

Enable-ADSyncExportDeletionThreshold

that’s All 🙂

 

About Blogger …

 

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin (MCSA office 365, MCSE : Messaging, Azure Certified)

Ahmad Yasin in a Microsoft Cloud Engineer and the Owner & publisher of AzureDummies blog. He also hold many certificates in office 365 and windows azure including Developing Microsoft Azure Solutions, Implementing Microsoft Azure Infrastructure Solutions and MCSA office 365.
Ahmad is currently working in Specialized Technical Services Company (STS).
Find Ahmad at Facebook and LinkedIn

 

 

 

 

 

Windows Integration with RSA Security Analytics using WinRM over HTTPS – Step by Step Guide

Hello RSA Admins,

As most of you know, integrating the windows event source with RSA security analytics is not that easy “straight forward”, or it’s hard to do it from the first time without any error, that’s because the integration depends on the windows configuration in the first place, and the windows vary from an infrastructure to another, mainly the error you’ll get is WINRM errors, certificate issues and HTTPS listener creation problems.

In this article I will show a new integration methodology, and not the one that RSA shows in their docs.

I am going to do it completely from the certificate creation till the logs received in the RSA SA, in a few steps.

1- Run MMC, Ctrl+m and add the certificate management, and select Computer Account, and Next.
1

2- Select Local Computer and finish:

2

3- Under certificates- Personal, right click and select Request New Certificate…

3

4-  Next, Next, and Select Web Server, and click on More information is required….

4

5- Under Subject tab, select for the Subject Name Type: Common Name, and in the Value: Type the event source FQDN, and select add.

5

6- Under General Tab, type the FQDN in the friendly name field.

6

7- Under Private Key tab, Key Options, select Make Private key exportable, and Allow private key to be archived, Apply -> OK -> Enroll.

7

8- View Certificate, and copy the Thumbprint.

8

9- Copy the winrmconfig.ps1 to the C: directory and run the following command on the PowerShell as administrator,

Command 1- Set-ExecutionPolicy Unrestricted à Y

Command 2- Powershell -File winrmconfig.ps1 -Action enable -ListenerType https -Port 5986 -User rsa@sts.services.local -ThumbPrint ac4c1fa34a1285ffa41f6aa3b84f00cc79dd7ac6

Where: -Action enable: to enable the listener, -User: a domain user with normal privilege to run the service, -ThumbPrint: is the certificate thumbprint that we copy before.

 

And here is the magic happen 😉

9

10- Now go to RSA LogCollector, View, Config, Event Source tab.

Select Windows, and Kerberos Realm Configuration.

10

11- Add event source name to the KDC Host Name, not FQDN, and save.

11

12- Change to windows -config, and make sure that the Authorization Method set to Negotiate, and the user name is what we used in the script.

12

13- Now add a new Source, and test the connection 😉

13

14- Check out if the logs were received.

14

That’s All, Done 🙂

 

Amin Khalil (VMware VCP-DCV, VCPC, VTSP, RSA Security Analytics)

Amin Khalil (VMware VCP-DCV, VCPC, VTSP, RSA Security Analytics)

Amin Khalil is a Technology Expert Engineer and publisher at AzureDummies blog. He also hold many certificates in VMWARE, RSA Security, EMC and Dell.
Amin is currently working in Specialized Technical Services Company (STS).