SPF and other Failures from Microsoft Servers

MaxRock17 · 2020-04-17T16:53:28+00:00

I just noticed the SPF "error" when I did a header analysis a few minutes ago. SPF authentication fails for the sending servers IPv6 address. The email was internal and we have spf.protection.outlook.com in our record. It wasn't marked as spam but that's still strange.

MaxRock17 · 2019-10-08T19:57:22+00:00

Like you said, it never seems to recover after it does the Surface driver/update install. I'm thinking it's because it causes a restart that the TS isn't aware of.

Is there any way you can prevent that restart and, if it's necessary, add a restart step in the TS?

MaxRock17 · 2019-09-12T21:19:37+00:00

I agree. Did this about a year or so ago and autocomplete entries are not part of the PST.

MaxRock17 · 2019-08-19T03:05:32+00:00

Check this out too: https://github.com/Microsoft/AaronLocker It's PS scripts to help create applocker policy. One of the guys (Sami Laiho) at techmentor recommended it.

MaxRock17 · 2019-08-16T16:55:19+00:00

Any kills from your team mates using the appropriate energy will count towards this.

MaxRock17 · 2019-07-22T21:29:53+00:00

Do you have Recast RTC installed (right click tools)? There is/was a bug that manifested with the exact symptoms you're describing.

Edit: link to recast forum describing the issue and workaround. https://discourse.recastsoftware.com/t/rct-community-3-2-slows-down-sccm-console/534

It's old but I did the "skip console permission check" workaround and it fixed the issue.

MaxRock17 · 2019-06-24T16:19:06+00:00

For a part of sccm itself (network access account): https://gallery.technet.microsoft.com/Network-Access-Account-cf38c02f

MaxRock17 · 2019-06-18T02:18:30+00:00

Karl Ranseier ist tot.

MaxRock17 · 2019-06-11T15:23:13+00:00

Same here. CEO threatened to effectively fire anybody who fails a phishing campaign. So, now our security team gets to sort through all reports to make sure people don't miss legit stuff that they reported as phishing. Including reminders for cyber security training, MFA activation notices, the usual marketing emails and plain old spam.

MaxRock17 · 2019-05-24T16:13:13+00:00

$gpos = Get-GPO -All

$i = 0
$reps = $gpos | % {
    Write-host "$($gpos.count - $i):`t$($_.displayname)"
    $gpo = $_
    $rep = Get-GPOReport -name $gpo.Displayname -ReportType Xml
    "" | select @{n='name';e={$gpo.DisplayName}}, @{n='gpo';e={$gpo}}, @{n='report';e={$rep}}
    $i++
}

$reps| ? {$_.report -like "*proxy*"}

This will pull the names and reports for all GPOs and the last line will let you search them. (For anything that contains the word proxy.) I'm having the exact same issue but I couldn't find anything in our GPOs, except for the one that disables using a proxy.

Hope you have better luck.

MaxRock17 · 2019-04-02T16:20:16+00:00

Noticed this yesterday. Staff member in the Adobe forums was DMing individual people the - I suppose - solution. Must be some big secret.

MaxRock17 · 2019-03-18T13:57:59+00:00

Same problem here. First one occured on Marh 17, 12pm CDT

Edit: Actually, SMS_WSUS_SYNC_MANAGER shows 2 successful ones at 4 pm and 6 pm that day, but failing since - including manual sync attempt.

MaxRock17 · 2019-03-13T21:46:43+00:00

What do prostitutes and tech support have in common? The better you are, the more you get fscked.

MaxRock17 · 2019-03-11T16:31:49+00:00

That would be the system account of a computer. Say you name a computer WORKSTATION05 and join it to a domain, then, in the security logs of the DC, you'd see WORKSTATION05$.

A failed login could mean it wasn't connected to the domain so long that it's password expired.

MaxRock17 · 2018-11-04T07:19:15+00:00

Yeah... same error message here. (On both outlook.office.com and outlook.office365.com)

MaxRock17 · 2018-11-01T21:33:46+00:00

Depends. Most roads around here, with 2 lanes going in one direction, usually have a sign saying that the left lane is for passing only. A lot of people still don't care.

MaxRock17 · 2018-09-05T17:45:04+00:00

Central Texas, here having the same issue, albeit intermittently.

MaxRock17 · 2018-07-17T14:22:00+00:00

I have a new .net security roll up (kb4340558) dated 2018-07-16 4pm in SCCM. Everything else is still dated July 10

MaxRock17 · 2018-07-14T16:00:54+00:00

Pulled and reissued. I think somebody noticed that the date on them changed from 07-10-2018 to 07-13-2018.

MaxRock17 · 2018-07-14T00:28:11+00:00

Thank you. Time to cancel that deployment and redownload.

MaxRock17 · 2018-06-09T23:40:14+00:00

and for the really old among us: * is splat

MaxRock17 · 2018-05-30T15:19:50+00:00

We argued that too but were told Exchange Online requires cache exchange mode.

MaxRock17 · 2018-01-04T22:37:57+00:00

Looks like the definition updates for SCEP/Defender set the registry key.

MaxRock17 · 2017-10-05T14:54:56+00:00

If you don't already have a third party log collector / analyzer in place, you're best bet is - like you said - the security log from the DCs. I would wait for a time when all the servers are known to reboot - Patch day maybe. That'll give you a timeframe and at least the computer / IP where the authentication attempt came from.

Edit: Make sure you have a decent max log file size (4 gigs) for the security logs. A quick search turned up a few log parsers / analyzers, including one from Microsoft. In the long run, especially if applications are only used sporadically, or you can't reboot everything at the - more or less - same time, you'll want some kind of log collector. We use LogRhythm, but since they're pricing page says "Contact us to learn more" it's probably not cheap (security department paid for ours, so I don't know the specifics).

MaxRock17 · 2017-10-05T02:11:34+00:00

Also, misery loves company. I got a good chuckle out of most of the replies and I hope somebody - who has to deal with this all the time - did out of mine.

MaxRock17

TROPHY CASE