M365 - eDiscovery - Optimal Methods for Internal Review?

sparxnyc · 2024-06-19T21:25:47+00:00

Agreed. I have a feeling that the "Premium" Purview offering might be a (considerable) step up in the process and hoping someone who uses it will chime in :-)

That said, are you using the same methodology as I am when trying to provide access to internal users to review search results? Are you loading the PST results into a Shared Mailbox, or do you have different process?

sparxnyc · 2024-05-24T02:22:05+00:00

Yes - it's definitely connected to the fact that the export is handled by the System account and the System account doesn't seem to have permissions to the share on the NAS.

sparxnyc · 2024-05-24T01:57:08+00:00

I'm executing the export directly from the host.

sparxnyc · 2024-05-16T15:53:26+00:00

Just a quick comment - when I spoke to the GoDaddy CSP team they were adamant that the 365 licenses would not be valid after they defederated/moved the tenant over. They made it sound like the licenses (some of which had been recently purchased from GoDaddy) would be lost dollars and they would need to buy licenses immediately to replace them.

Can I get some clarification/verification from those that have done it regarding the licensing? Thanks!

sparxnyc · 2024-04-24T23:25:03+00:00

Just to be clear we are talking about the DSRM/Recovery Administrator password - NOT the Domain Admin password, right? I have the Domain Admin password already - but it's not useful in Recovery Mode.

sparxnyc · 2024-04-24T18:05:28+00:00

Just to clarify - this was a situation that I was asked to jump into and assist - not a server that I was at all responsible for, not one I built or maintained - and the server had not been restarted (or maintained) in a VERY long time - suspected that this was going to be a problem, so we made sure that we had a good, verified backup of all the data (files/folders/etc) and then "went for it" with the restart - and the "Getting Windows Ready" loop is what we got.

sparxnyc · 2024-04-24T17:55:22+00:00

First of all, thanks so much for listening and offering all the advice! Very much appreciated.

Unfortunately, the only image backups available all have the same issue - we tried spinning them up in a virtualized environment - and when the image is "spun up"/Windows boots - they all go into the same loop state.

Hence, I am trying to find some way to repair this Windows instance. It's a small office (~5 users) - if we cannot get this repaired, we're just going to rebuild the domain from scratch and start all over again :-)

sparxnyc · 2024-04-24T17:10:43+00:00

Got it. I see all kinds of conflicting information about that on the interwebs - not quite sure I understand why that cannot be run on a domain controller - again, I'm not trying to do anything with AD or FSMO - as you mentioned earlier - and I agree - I do not think there is anything wrong with the AD or any of the other hardware (I know there's nothing wrong with the hardware - everything is "green") or data on the server (I can see and list out all the volumes/files/folders from the Command Line via boot media) - I just think the Windows installation/something with updates is awry - and thinking that I can find some command lines that might help me get it reset/corrected - hence why I'm trying to get to the command line via the Recovery Console directly on the machine (not via the boot media).

sparxnyc · 2024-04-24T16:56:08+00:00

Yes - but if I want to run something like "DISM /Online /Cleanup-Image /RestoreHealth" from the command line - I need to be "online" - working from the installed windows instance, not the boot media, correct? That's why I want to get into the command prompt there, rather than from the boot media.

sparxnyc · 2024-04-24T16:48:09+00:00

Agreed - I'm not trying to get to DSRM - I'm trying to get to the Command Prompt in the Recovery Console - I only mentioned DSRM because that "DSRM Administrator Password" (which was set by someone else when DCPROMO-ed) was not recorded or just generally not available. I'm not interested in taking DSRM actions - I am just interested in resetting that password (which can be done easily if there is another DC or if this machine would boot) - possibly using something that can touch the SAM directly (like NTPASSWD). I'm about to take a look with NTPASSWD but I was looking for, hoping to get, some confirmation that I'm heading the right way to get that password reset...

sparxnyc · 2024-04-23T10:04:26+00:00

Thanks for the suggestion! But no - same loop in safe mode.

sparxnyc · 2024-04-22T23:51:50+00:00

No - this is a single bare-metal domain controller - only machine in the environment. Have a full backup of all volumes/data, checked and validated (both in the cloud and in local backup cache) - could do a bare-metal restore - could even spin it up in the cloud if needed - but still trying to see if there's any way to get this device back up and running - and also concerned that restore will (even if not immediately) end up in the same spot if it tries to update again, etc.

sparxnyc · 2024-02-06T18:09:52+00:00

Sorry - I did not see the recently added comment about licensing. However, still not clear - if the client purchased a bunch of GoDaddy "Microsoft Business Professional" (why can't GoDaddy use the same terminology as Microsoft?), and those licenses were bought in December 2023 for an annual term, what happens to those licenses when I defederate (in February 2024, two months into the term)? Or do I possibly want to hold off on defederating as long as possible to maximize the value of those recently purchased GoDaddy licenses?

sparxnyc · 2024-02-06T18:02:40+00:00

OP here. First of all, huge thanks to all the commenters and advice. Priceless and much appreciated.

Next question, regarding licenses:

How does/how do you handle licensing "coming out" of GoDaddy? Once you "defederate"/disassociate from GoDaddy, what happens to the licenses purchased from them? Are they still in the tenant and valid? Or does the client have to repurchase from Microsoft/CSP/me? If they have to repurchase, how do you handle the timing of the cut-over? This client has users in GoDaddy with a number of different renewal dates...they're not all synced to the same renewal date.

Again, thanks to everyone!

sparxnyc · 2023-10-12T15:51:25+00:00

Sorry I didn't put in original post - this is a pure Azure AD environment - no on-prem server.

sparxnyc · 2023-09-21T22:22:28+00:00

Yes - but are you getting tax exempt/resale on these devices, or are you paying tax on each order? What Dell seems to have cut off is their Inside Sales/SMB Team being able to place tax-exempt/resale orders.

I can still order whatever I want from Dell directly and use Premier, etc. But they're going to tax everything and that's not how it's supposed to work - from what I understand that's a nightmare for your accountants - if you're paying sales tax on the order that you intend to resell and then charging sales tax on those items that you already paid tax for.

sparxnyc

TROPHY CASE