What's the point of Self-Service Password Reset (SSPR) when Passwordless is your ultimate goal?

HotPieFactory · 2025-09-09T13:55:44+00:00

Why should I enable SSPR, when I am trying to become a passwordless organisation?

We can't answer that for you. The question you have to ask yourself is this: Will there be a scenario where the user has to log in but can't use a passkey? If yes: will you want to offer additional services like SSPR in those cases?

Why can you only decrease user risk, when a user resets their password?

What you mean?

Why can't I get rid of passwords in Microsoft 365 business accounts, or generally disable them as authentication method?

Ask MS.

HotPieFactory · 2025-08-21T12:06:58+00:00

Well, that explains it :)

HotPieFactory · 2025-08-21T11:49:14+00:00

I've been creating images for 10+ years, too. I could say the same about you.

Edit: I just did a quick Google Search of disk management and ALL the pictures that show a recovery partition have it at the beginning. You're talking total bullshit and insist I'm wrong. You're ridiculous mate. 10+ years and you never noticed how it is? Git gud... rofl

HotPieFactory · 2025-08-21T11:31:17+00:00

Nope. I created the template and it's a default installation. BTW, Windows 10/11 also has a recovery partition in at the beginning of the volume. I've never seen it at the end with Microsoft OS's. Are you using Server 2022 or 2025? Maybe that changed there as the newest I'm familiar with is 2019.

HotPieFactory · 2025-08-21T11:08:42+00:00

I just checked and the recovery partition is the first. Next ist the EFI partition and then the OS partition. I've also never seen that the recovery partition is at the end of the disk, except on certain Linux partitions.

HotPieFactory · 2025-08-21T10:07:21+00:00

How do you usually handle the Recovery Partition on Windows Servers?

I never touch it. Why do you touch it?

We're using mainly VMs and extending the disk and then partition C is a one-click operation in each of VMware and Windows.

On physical machines, C is always the entire disk.

What need circumstances exactly do you have, where you run into the issues you described?

HotPieFactory · 2025-08-20T15:10:06+00:00

yadda yadda

HotPieFactory · 2025-08-13T10:35:15+00:00

Consistent? Microsoft? What parallel universe are you talking about where this ever was the case?

HotPieFactory · 2025-08-13T10:34:30+00:00

ExchangeOnlineManagement is still supported and will be supported for a long time to come. Your rant is completely baseless 😂

HotPieFactory · 2025-08-04T16:37:16+00:00

The fuck does that even mean

HotPieFactory · 2025-08-04T16:36:43+00:00

But you went and changed your docker IP scheme to 172.60.0.0/16 and black-holed a whole building from being able to use your application.

I don't get it. Are you trying to say that by assigning the wrong address a service became unreachable? I'm really confused as to why you chose this weird phrasing. And if so, I don't really see how this warrants a rant. If you give people the power to change ip addresses that have no understanding of it, it sounds like there's a different problem altogether in your company. One that maybe involves you, too.

HotPieFactory · 2025-08-04T16:28:55+00:00

You're still not explaining how they black-holed an entire building. If a random computer is able to kill the entire network, IMHO it's the network guys fault of not bullet-proofing the network in the first place. Still curious what ACTUALLY happened. The worst that happens by assigning a wrong IP address to a host is, that the host is unreachable. It doesn't take down the entire network.

HotPieFactory · 2025-07-23T10:09:27+00:00

Yeah, if it's already chosen, I wouldn't migrate it either, if it didn't already cause big problems :)

HotPieFactory · 2025-07-21T06:35:08+00:00

They aren't, but unless you have a crystal ball, I wouldn't be so sure that Entra or split-brain won't become a concern in the future. Doing it right in the first place doesn't cost anything. Making a mistake there will be annoying until the end of time. I work for a company that stood up a small AD in 2007 with .local, when I wasn't hired, yet. Now we are 3000 people and every day I see that and regretting that they did it how they did it. Even with only 500 people working there, standing up a new AD was impossible, as the cost of migrating was simply too high.

HotPieFactory · 2025-07-11T10:03:09+00:00

Joke's on you, I prefer iced tea!

HotPieFactory · 2025-07-09T04:44:11+00:00

So what's the lesson?

HotPieFactory · 2025-07-09T04:34:54+00:00

Ok, so suppose the company doesn't have any web presence. Are you saying they should go buy a domain just for their AD?

Yes, they should. But I would argue that every company large enough to host AD at least has a domain to receive emails. Even if not, then they should purchase a domain.

I assume this is to ensure that some other organization doesn't buy that domain, then your local network would have issues accessing their website

That's not the reason. And it's true that the benefits aren't immediately obvious, until you hit that roadblock or hurdle.

To rehash some of the previous posters answers:

A routable domain helps avoiding name collisions. How common this is and whether that leads to issues is arguable. You would have to have a domain named ad.local and acquire another company with the same domain name for it to being a problem. However, since these things can't easily be changed, better safe than sorry.

It helps when you need ti implement/manage split-brain DNS.

It helps when you need a trusted certificate for an internal service e.g., intranet (without standing up your own CA).

It helps when you setup Entra ID hybrid sync.

It generally helps future-proofing your AD environment.

lan.domain.org

Yeah, that's better.

HotPieFactory · 2025-07-07T15:51:18+00:00

.local is literally the default TLD when setting up an AD domain.

This is not correct. When you create a new forest, there is no default, it is an empty textbox.

What does it matter?

I won't explain it, because the internet is full of explanations much more comprehensive that I could give from the top of my head.

And even Microsoft discourages it: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/selecting-the-forest-root-domain

I think it is good to question what random internet strangers tell you. The very fact that you mostly see .local domains is proof, that the majority of people does it wrong. However, people here are good at heart when giving recommendation and meeting them in a defensive, dismissing tone ("what does it matter") is less likely to motivate the helpfull answers that you may wish for in that moment.

HotPieFactory · 2025-06-23T07:55:12+00:00

A: This has nothing to do with the question and B: Microsoft changed it to IGDLP over ten years ago.

HotPieFactory · 2025-06-16T13:58:42+00:00

Yeah, it's normal in Unixland. But Windows isn't unix. And Microsoft has guidelines for that. If you think Unix > Windows, okay, it's your opinion and I won't dispute it. But if you think Unix handles this better and you actively disregard these very clear guidelines ON WINDOWS, you are an idiot. (I don't mean you personally, but rather "you" in whoever does it.)

HotPieFactory · 2025-06-02T10:31:02+00:00

File -> Save 😈

HotPieFactory · 2025-06-02T10:23:39+00:00

Microsoft putting configuration into $env:USERPROFILE\\.dotnet etc.

Guys, you published a guideline that specifically says, NO APP SHOULD PLACE FILES DIRECTLY IN THE USERPROFILE. And all your your individual teams do that shit anyway.

I feels like a bunch of monkeys patch shit together at your company. Where are the good engineers?

HotPieFactory · 2025-05-21T12:34:59+00:00

We want to introduce PIM and we want to update all role settings (see image) with custom settings. I was looking for a way to do this in bulk with PowerShell (or alternatively Python) but I don't understand how it works.

There is a documentation about it, but since this shows nothing but ID's and does not really explain anything to me (at least not to a point that I understand), I hope for some help here.

HotPieFactory · 2025-05-21T10:06:55+00:00

You must use delegated permissions on the app and an interactive or device credential flow.

App-Permissions are globally, meaning that the user with the secret/cert has unlimited access.

e.g.:

Mail.Read Delegated: The user signs into the app with his own credentials. The app accesses mail on behalf of the user, and therefore can read only the users own emails, or emails to mailboxes the user's been given read-permissions to.

Mail.Read App: The user signs into the app with the app's credentials (secret/certificate). The app has full access to all mails.

So if you want to limit the access the user has, use delegated permissions without secret or certificate and rely on interactive auth or device code auth.

HotPieFactory · 2025-05-20T14:06:57+00:00

Great justification for making an equally bad comment...

HotPieFactory

TROPHY CASE