T O P

Getting Started with Google Gemini

We’ve begun rolling out Gemini and it’s been moving quickly in terms of updates and rollout. Here are our current settings that are letting users use it. Make sure your legal and compliance teams approve first!

Apps

User Access

Make sure you have a Gemini license, or your data may be used to train models

Service Status

Turn it on for OUs or just groups

Google Groups – Emails are Bouncing

I’ve encountered this error in a few circumstances – users in Google Groups will have a red triangle and the text “Emails are Bouncing” that stops them from receiving any Google Group emails – definitely not good! I’ve seen this when former employees’ accounts are deactivated but not removed from Google Groups and then re-hired or activated later.

The fix is either remove and re-add them to their Google Group via GAM OR to have the employee go to groups.google.com, click the gear icon in the upper right, and click Global Settings.

From there, they should see under “Bounce Status” that their email is flagged as bouncing and a link that says “Resend request to recheck status” or something like that. After that, they’ll see a message that says “your email is not flagged as bouncing”. That’s it!

Bypass / Remove Windows Evaluation Restart

I ran into this one recently on a VM I run for Windows – I let the evaluation license expire but couldn’t recreate a new VM.

Even though I am logged in with an administor account, I do not have access to disable the service that checks and reboots the computer. To disable this service, you can do the following:

  1. Download PsExec tools from Microsoft site here
  2. After downloading, extract the files to any folder
  3. open cmd and Run as administrator
  4. cd to the folder path
  5. execute psexec -i -s cmd.exe
  6. This will open another cmd prompt as shown below :

7. Now type whoami to confirm you are the system (as shown below)

Type services.msc as shown above

9. This will open services and now you can navigate to Windows License Monitoring Service and disable it

10. Restart the VM or computer and the service will be disabled, won’t start, and your machine will be good to go!

Office365: Order & Precedence of Protection Rules

Deep within Microsoft’s documentation ecosystem lies this document – the order in which various spam filters are applied to incoming emails!

The order of processing for the email protection type: This order isn’t configurable, and is described in the following table:

OrderEmail protectionCategoryWhere to manage
1MalwareCAT:MALWConfigure anti-malware policies in EOP
2High confidence phishingCAT:HPHSHConfigure anti-spam policies in EOP
3PhishingCAT:PHSHConfigure anti-spam policies in EOP
4High confidence spamCAT:HSPMConfigure anti-spam policies in EOP
5SpoofingCAT:SPOOFSpoof intelligence insight in EOP
6*User impersonation (protected users)CAT:UIMPConfigure anti-phishing policies in Microsoft Defender for Office 365
7*Domain impersonation (protected domains)CAT:DIMPConfigure anti-phishing policies in Microsoft Defender for Office 365
8*Mailbox intelligence (contact graph)CAT:GIMPConfigure anti-phishing policies in Microsoft Defender for Office 365
9SpamCAT:SPMConfigure anti-spam policies in EOP
10BulkCAT:BULKConfigure anti-spam policies in EOP

Finding Windows Services That Are Stopped That Should Be Started With Powershell

This was a scriptlet that got heavy use on servers and even in our RMM. It can report back services on Windows servers and desktops are are in the Stopped state that are set to Auto or Enabled.

GWMI is short for Get-WmiObject

GWMI win32_service -Filter "startmode = 'auto' AND state != 'running'"  | select DisplayName, Name, StartMode, State, ExitCode | ft -auto