Testing Office365 Mail Rules

Recently I had to implement a tag for external emails. However, I wanted to test it out first and see what would be tagged.

I created my rule and set these settings:

Audit this rule… should be checked off but can be set to “Not specified” while the mode should be Test without Policy Tips.

Ok the rule.

Wait a day, then go to to the Reports section of Office365 Security & Compliance Center. On the Dashboard, click on the Exchange transport rule section.

Once there, click the dropdown for “Show data for” and choose your transport rule. This will only list transport rules where you have checked off Audit this rule with severity level: . No matter the setting, that must be checked off or you won’t see results here!

That’s it. Filter by sender, date, etc. and you’ll see the emails affected by the rule. Happy hunting!

Using the New Exchange Admin Center (2020 Edition)

I’ve noted this as the 2020 edition because simply… Microsoft loves to change their GUIs and portals. If you’ve worked with Office365 for a long time, you can remember the BPOS days and all the subsequent portals.

Anywho, the link for Exchange Admin is more in-line with the Sharepoint and Teams admin portals and is easier to remember: https://admin.exchange.microsoft.com/

As of this writing, it’s… pretty blank when you arrive there. You can still run message traces through here. One of the bigger changes is they’ve combined User and Shared Mailboxes under Mailboxes and put distribution lists and Office365 groups under Groups. Resource Mailboxes are under Resources.

As of now, I still work out of PowerShell or the old admin center. This will probably be finished by late next year… just in time for the next version of the EAC to apprear.

Huge Log Files in Microsoft Teams AppData

This was a fun one… I have a VM spun up in Microsoft Azure with one user who reported their 128GB Drive was filled.

I ran wiztree, my favorite tool, and found that in the AppData\Roaming\Microsoft\Teams folder, there were multiple files starting with old_logs that were 13mb big… except for one that was 103GB big! Deleted it and was on my way.

Activate macOS VNC Over SSH

I ran into this one today while working on a personal project. I had SSH access to a Mac Mini running Big Sur that I didn’t have hooked up to a monitor or keyboard. After digging around, I found I could enable VNC access via these commands.

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resouces/kickstart \
 -activate -configure -access -on \
 -configure -allowAccessFor -allUsers \
 -configure -restart -agent -privs -all

If that doesn’t work, this will set a custom password not tied to any user account:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart \
-activate -configure -access -on \
-clientopts -setvnclegacy -vnclegacy yes \
-clientopts -setvncpw -vncpw mypasswd \
-restart -agent -privs -all

When you’re done (since you don’t want to leave it enabled 24/7 for security reasons), disable with:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart \
-deactivate -configure -access -off

Powershell One-Liner: Find all PST files on a workstation

For reasons I don’t want to get into, I’ve had to locate all PST files on a number of workstations. Plugging this one line Powershell command into our RMM, I was able to see what workstations had what files and upload them to Office365 for safe(r) keeping.

gci -path c:\ -recurse -include *.pst -erroraction 'silentlycontinue'|select-object fullname,lastwritetime | fl fullname

Managing Alerts for Non-Certified Dell Drives in OpenManage

The pricing for Dell physical drives, especially in servers is often outrageously expensive. Of course, they come with Dell ProSupport so often the price is worth it. Sometimes though, you’ll need to buy and use drives that are not from Dell. If you do this, OpenManage will throw alerts about being non-certified, which will throw off monitoring. Here is the fix:

Open stsvc.ini located in either C:\Program Files\Dell\SysMgt\sm or C:\Program Files (x86)\Dell\SysMgt\sm depending on whether you have the 32-bit/64-bit version. Next, look for the section near the top that reads

; nonDellCertified flag for blocking all non-dell certified alerts.

Change NonDellCertifiedFlag=yes to NonDellCertifiedFlag=no and save the file. Lastly, restart the Dell OpenManage service, called DSM SA Data Manager, in your Services Manager. Voila!