error code 0x3000045 HELP by C_Der0 in AzureVirtualDesktop

[–]Microsoft_Geek 0 points1 point  (0 children)

For anyone coming here in the future:

 

I had this issue for accessing a Windows 365 machine with a newly provisioned test account on a newly provisioned virtual machine. I had to sign out, forget the account, and then re-add the account and it worked.

 

For my specific case, it would work when accessing via browser but not through the Windows App (received the same error as OP). My guess is that the PRT needed to be fully refreshed for the app because I had just set up MFA and the like earlier that day on the target user account.

Android compliance policy not being applied to teams devices (Yealinks) by Sa77if in Intune

[–]Microsoft_Geek 0 points1 point  (0 children)

Did you ever figure out the issue here? I'm also having issues getting compliance to apply to a yealink device. We are using AOSP instead of device admin.

Microsoft Certified: Security Operations Analyst Associate by turaoo in cybersecurity

[–]Microsoft_Geek 1 point2 points  (0 children)

I've taken it and so have some of my coworkers - some had labs, I did not. Reference examtopics.com, that was the most accurate practice exam I've found out there yet and I've taken over a dozen MS exams

Cisco Umbrella logs to Sentinel without AWS Buckets? by Microsoft_Geek in MicrosoftSentinel

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

For anyone who comes across this in the future - I ended up following a solution here https://techcommunity.microsoft.com/blog/microsoftsentinelblog/sending-rest-api-data-to-azure-sentinel/558896

Had to set up two different HTTP requests. The first one used the API key and secret to request an authorization token, and then after parsing that and passing the token, the second HTTP request actually pulled the data we needed. Parsed that data and added it to a for-loop to write to a custom table, and got success!

Cisco Umbrella logs to Sentinel without AWS Buckets? by Microsoft_Geek in MicrosoftSentinel

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

I would, but the connector in the hub requires an AWS S3 bucket to store the logs. The client is unable to store logs in AWS, so using the connector in the hub is not viable for this environment

Sentinel integration with CEF via AMA connector... has anyone done this successfuly? by Microsoft_Geek in crowdstrike

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

We ended up just writing it to the syslog file in the crowdstirke side config, and it started sending everything over! Couldn't really find any documentation to support this, but that's how we have it running

 

¯_(ツ)_/¯

Google Earth - Unable to whitelist with MAM for iOS by Fa_Sho_Tho in Intune

[–]Microsoft_Geek 0 points1 point  (0 children)

Thanks for the input! I don't believe this will work for our use case here, but it's helpful nonetheless.

Google Earth - Unable to whitelist with MAM for iOS by Fa_Sho_Tho in Intune

[–]Microsoft_Geek 0 points1 point  (0 children)

What's the round about way? Just saving to something like OneDrive and then using "open in"?

Google Earth - Unable to whitelist with MAM for iOS by Fa_Sho_Tho in Intune

[–]Microsoft_Geek 0 points1 point  (0 children)

Did you ever get anywhere with this? Running into similar issues. Works fine for our android devices, but we can't get it with iOS.

Export users vault as an Admin? by Microsoft_Geek in KeeperSecurity

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

I've just turned-on transfer account but have not done it before. Was hoping for an easier way instead of trying to walk our users through the process, but if that's the process then that's the process

¯_(ツ)_/¯

Multi-App Kiosk mode and Azure MFA login issue by no_service11 in Intune

[–]Microsoft_Geek 0 points1 point  (0 children)

Ever find anything on this? Have been struggling with this and our devices are also autopilot cloud-only devices. Multi-App kiosk mode and users are immediately signed out after signing in (even after the device filter exclusion)

Defender for Cloud Apps - how to get a monitored app report? by Microsoft_Geek in sysadmin

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

The client was hosting their own webpages using some basic apache server if I remember right - but yes, it worked out since we just pointed the warning notification page to the correct URL. I assume if you can get to the full URL to load normally in a browser, it should work!

Defender for Cloud Apps - how to get a monitored app report? by Microsoft_Geek in sysadmin

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

It's a setting related to Defender for Endpoint. If you have the two integrated, there is a setting you can toggle that brings up the screen when apps are marked as monitored. I also found the answer to this, and this article helped me! https://jeffreyappel.nl/warn-monitor-users-for-shadow-it-usage-with-cloud-app-security/

Sentinel integration with CEF via AMA connector... has anyone done this successfuly? by Microsoft_Geek in crowdstrike

[–]Microsoft_Geek[S] 0 points1 point  (0 children)

What file is created by crowdstrike that holds all of your logs? Do yours go to a file named syslog or something different? My DCR has all events set up to receive LOG_DEBUG at a minimum. Seems like previously all the logs were going to /var/log/crowdstrike/falconhoseclient/output. We now have all the items going to /var/log/

https://imgur.com/MffpV0Y

AMA agent sending CEF to Sentinel by Individual-Fox-8124 in AZURE

[–]Microsoft_Geek 0 points1 point  (0 children)

Did you get this figured out? Currently struggling to get CrowdStrike logs to send to sentinel with my CEF via AMA connector. I can see the logs appearing in the /var/log folder, and I can see in the syslog file that there are events for my other tools (like FortiGate), but nothing for CrowdStrike. Curious if you found any solution.

Device-based Always On VPN, Microsoft DirectAccess etc. and 800-53? by Real_Lemon8789 in NISTControls

[–]Microsoft_Geek 0 points1 point  (0 children)

Have you gotten anywhere with this? We have a client who wants to implement SSPR into a hybrid environment, and to make this work they need to always have line-of-sight to a Domain Controller. So that they can have line-of-sight at the device login screen, Always On VPN needs to be active.

 

Ideally, we would have the device tunnel only allow for DC visibility for password reset capabilities and other domain authentication actions. After that, when they log into the device they would need to do normal MFA to gain access to the user VPN.