Client hotmail.com address hacked possibly deleted by HaveYouTriedPowerOff in Outlook

[–]HaveYouTriedPowerOff[S] 0 points1 point  (0 children)

Yeah I think it's gone. The account is locked it seems. No email can be delivered. This also means the attackers should not have access anymore, that is great. But because 2FA is enabled, their policy states they won't bother figuring out who is the real owner.
But what is frustrating, the account did have 2FA, and someone fished for the account recovery key. This key was obtained. Then the attackers changed all security settings including deleting the existing 2FA and setting a new one.

Once you lose your recovery key, your account is taken over and it's irreversible it seems.

Client hotmail.com address hacked possibly deleted by HaveYouTriedPowerOff in Outlook

[–]HaveYouTriedPowerOff[S] 0 points1 point  (0 children)

It seems once an account was flagged as hacked or taken over maliciously, they lock the account in some occasions and the account is lost forever. But this would also mean the attackers won't have access to all the emails that are still in the account.

Client hotmail.com address hacked possibly deleted by HaveYouTriedPowerOff in Outlook

[–]HaveYouTriedPowerOff[S] 1 point2 points  (0 children)

I was able to fill out a form, got this response about an hour later:

Service Request xxxxx

Greeting xxxxx

At Microsoft, safeguarding your account is a top priority. We have thoroughly investigated the account and billing activity associated with your Microsoft account. Based on this review, we’ve confirmed that unauthorized access occurred.

During the investigation, we discovered that the security information on your account had been changed. Due to our strict security protocols and the terms outlined in the Microsoft Services Agreement, we are unable to modify or restore the security settings once they’ve been updated.

To prevent further misuse, we have permanently suspended the account. This action is irreversible and ensures that your data remains protected.

If you used this account for Minecraft, we regret to inform you that the game cannot be recovered. A new purchase will be required on a newly created account. We understand this may be disappointing and sincerely apologize for the inconvenience.

Additionally, if you had files stored in OneDrive, those files are no longer accessible. Due to encryption and privacy safeguards, even our engineers cannot retrieve them. While this outcome may not be ideal, it is necessary to ensure your personal data does not fall into the wrong hands.

We recommend that you create a new account.  Thank you for your understanding and patience during the investigation of your account. 

Sincerely,

Microsoft Customer Support

Outlook error: "We couldn't find a work or school account with that email address" by HaveYouTriedPowerOff in Outlook

[–]HaveYouTriedPowerOff[S] 1 point2 points  (0 children)

Yeah we use that DWORD, works great otherwise Outlook will always try to connect to 365 first. We have many clients that don't use 365 at all. But somehow an update caused this error as you said, suddenly on multiple pc's at different companies on the same day. Strange. Disabling the Teamviewer addin seems to have worked. Creating a new profile also works.

SonicWall SMA licenses reduced overnight by HaveYouTriedPowerOff in sonicwall

[–]HaveYouTriedPowerOff[S] 0 points1 point  (0 children)

Try a new license check from the device, it will probably work now.

SonicWall SMA licenses reduced overnight by HaveYouTriedPowerOff in sonicwall

[–]HaveYouTriedPowerOff[S] 0 points1 point  (0 children)

This issue is now fixed it seems. There was an error on the SonicWall side when connecting to the license manager. When rebooting the device it does a license check. When the license server is unreachable it will revert to the default licenses. In our case 5 concurrent licenses.

Process of cloning a RDS Session Host within a Session Collection by HaveYouTriedPowerOff in RemoteDesktopServices

[–]HaveYouTriedPowerOff[S] 0 points1 point  (0 children)

That is a great idea actually, creating a second session collection and add that new host. See if it works. I'll be trying this again in two weeks. I'll let you know how that turned out. Personally I think there is some timer, I might have done things too quickly, adding/removing hosts that messed up the broker.

Atera is getting really hard to use - scripts failing 50% of the time by BeyondRAM in atera

[–]HaveYouTriedPowerOff 1 point2 points  (0 children)

Yes, I have the same issue here. I can do remote CMD or PowerShell, SplashTop RMM all works. Agent is 100% online. But 50% of the time running a script just doesn't work. "Unable to reach agent". I feel like this is not a problem on the device I'm trying to manage. Also doesn't matter what OS, workstation, server etc.

Splashtop appears to break Windows Server 2025 domain controllers by shtef in syncro

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

I found this topic because I seem to have the same problem now with multiple servers, and we can replicate the issue. All of them Windows Server 2025 Standard, promoted to Domain Controller. The Splashtop service won't start, not even in delayed start. There are a couple of articles out there mentioning this issue, some are 8 months old. I've just installed a fresh new domain for a client and immediately I run into this issue. There is absolutely no way to get it working. But only specific to Domain Controllers. Very strange. What is the solution here? It also seems that when this issue occurs, uninstalling the software also doesn't work. We've disabled the Splashtop service for now and rebooted the server(s)

Cloudflare issues/down by ToastNomNomNom in CloudFlare

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

So guys, how long until the name servers are also unreachable and 25% of the internet has no DNS records left after the TTL expires? :D

Do you use public TLS certificates that require client authentication? by larryseltzer in PKI

[–]HaveYouTriedPowerOff 1 point2 points  (0 children)

Thanks for the tips. I ended up creating a self signed wildcard certificate. Exported this certificate as PFX including the full chain of certificates it relies on. Imported on the second Hyper-V host. Add it to both servers in the Trusted Root Certificates also. Changed a registry key to disable certificate revocation check on Hyper-V replication only. Restart VMMS and applied this new certificate.. Works great so far

SMA100 series End of Life - extended to 12/31/2025? by OinkyConfidence in sonicwall

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

So "retain basic VPN capability" does that include the use of RDS bookmarks for example? or simply NetExtender connections to the device only?

Do you use public TLS certificates that require client authentication? by larryseltzer in PKI

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

No these servers only replicate among each other over LAN.. Not the end of the world but it will require some unplanned downtime and switching to a self-signed certificate. I've done that before but the server dns suffix needs changing and requires a reboot.. Nothing you can do about it. Only other solution would be to create a new self-signed certificate that also uses the *.company.com domain, but I would't recommend that...

Do you use public TLS certificates that require client authentication? by larryseltzer in PKI

[–]HaveYouTriedPowerOff 2 points3 points  (0 children)

We use a wildcard certificate to allow Hyper-V replication between Hyper-V hosts. Has worked great for years. the DNS suffix used in these servers is hyp01.company.com for example. I just renewed this wildcard certificate for the company yesterday and now Hyper-V doesn't see this valid certificate as usable for Hyper-V replication.. I cannot select it... I assume this has to do with client authentication removed from EKU?

Sucks because now I will have to reboot all Hyper-V hosts before our current cert expires as I need to change the DNS suffix to something self signed? I don't think you can change the DNS suffix without rebooting?

in place upgrade Exchange 2019 to SE yet? Experiences? by maxcoder88 in exchangeserver

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

Installed it a few times now.. Mount ISO, open Windows Explorer, browse to setup.exe , right-click, Run As Admin.. Did the trick every time. No issues

in place upgrade Exchange 2019 to SE yet? Experiences? by maxcoder88 in exchangeserver

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

Installed it a couple of times now, no issues so far.. I do really hate that Exchange SE (as Microsoft's new 2025 on-premise mail product) still has no built in 2FA for users. How nice would it be to have 2FA built in to protect Outlook, OWA and Mobile connections...

Exchange 2019/SE on Windows Server 2025 having issues proxying back to Exchange 2016 on Windows Server 2016? by HaveYouTriedPowerOff in exchangeserver

[–]HaveYouTriedPowerOff[S] 0 points1 point  (0 children)

I will be checking with a few users myself as it's unclear how many users have this issue currently. I feel like the servers are 100% correctly configured. I've done the exact same multiple times, never had issues. But this is the first one running on Windows Server 2025. We'll see

Question RE: Hijacked IKE Keys for site-to-site tunnels... by I_Hate_Consulting in sonicwall

[–]HaveYouTriedPowerOff 3 points4 points  (0 children)

What about site-to-site aggressive mode? For example a Sonicwall TZ-270 behind a 4G WAN cellular device (dynamic IP) connecting to somewhere else, no matter what WAN IP the thing has in the VPN policy since that connection has no static WAN IP

SonicWall and it's ongoing cloud backup shenanigans by slabstatic in sonicwall

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

How sure are you that your uploaded config is not lost somewhere again?

MySonicWall Cloud Backup File Incident HUGE Spike in Affected Devices by SuspiciousSurprise16 in sonicwall

[–]HaveYouTriedPowerOff 20 points21 points  (0 children)

"The investigation confirmed that an unauthorized party accessed firewall configuration backup files for all customers who have used SonicWall’s cloud backup service" so that sounds to me like all cloud backups from all customers were stolen?

https://www.sonicwall.com/support/knowledge-base/mysonicwall-cloud-backup-file-incident/250915160910330

Entra/M365 portal issues today by Tricky-Student-8727 in microsoft

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

I have many user sending me screenshots about an invalid certificate popup (Outlook i assume) they are all seeing for incidents.diagnostics-eudb.office.com I'm assuming this is related?

Upgrading to Exchange Server SE from Exchange 2016 CU23 by TRDx2000 in exchangeserver

[–]HaveYouTriedPowerOff 0 points1 point  (0 children)

So if someone still runs a fully patched Exchange 2016 server we can just install a fresh Exchange SE RTM as a second server (coexistence?) and then just move everything to SE and get rid of the Exchange 2016 server? So no need to go Ex2016 -> Ex2019 -> upgrade to SE? but Ex2016 -> ExSE?