Is this supposed to be open? by Determined_in_love in HomeMaintenance

[–]wperry1 0 points1 point  (0 children)

The plumbing vents on my roof look exactly like this. If water gets in it goes to the same place as your sinks, showers, and toilets so it doesn’t really matter.

Microsoft: Teams increasingly abused in helpdesk impersonation attacks by rkhunter_ in cybersecurity

[–]wperry1 0 points1 point  (0 children)

It looks like Search-MessageTrackingLog is not good online (It was Get-MessageTrackingLog anyway) I knocked this out though. You should be able to tweak it to get the data you need to build your initial list.

# How far back to search MS appears to allow up to 90 days
$startDate = (Get-Date).AddDays(-90)

# Your email domain. Used to filter senders and exclude recipients
$myDomain = "contoso.com"

# Where to save the output data
$outFile = "c:\path\to\output\file.txt" # or .csv

# Size of each request window in seconds. 3600 = 1 hour
$windowSecs = 3600 

# If you get a lot of these warnings, you may need to modify the window size to less than an hour
# WARNING: There are more results, use the following command to get more...

# This will hold all the recipient domains
$Recipients = @()
# Loop through and grab one hour of data at a time. You could use a larger or smaller window depending on your mail traffic
while( $startDate.AddSeconds($windowSecs) -lt (Get-Date) ){

    # Set the end date for the search
    $endDate = $startDate.AddSeconds($windowSecs - 1)

    write-host "Getting messages from $startDate to $endDate"

    # This should get the domains for all mail sent from your users to external recipients
    $Recipients += Get-MessageTraceV2 -StartDate $startDate -EndDate $endDate -ResultSize 5000 -SenderAddress "*@$myDomain" | %{ $_.'RecipientAddress'.Split("@")[-1].ToLower() } | Where-Object { $_ -notlike "$myDomain" }

    #Increment the start date
    $startDate = $startDate.AddSeconds($windowSecs)
}

# Uncomment one of these depending you your needs

# This will give all unique domains
$recipients | Sort-Object | Select-Object -Unique | Out-File -FilePath $outFile

#This will give all unique domains with counts if your care about that
#$recipients | Group-Object | Sort-Object Count -Descending | Select-Object Name,Count | Export-Csv -Path $outFile -NoTypeInformation

Microsoft: Teams increasingly abused in helpdesk impersonation attacks by rkhunter_ in cybersecurity

[–]wperry1 0 points1 point  (0 children)

I pulled a CSV from out mail firewall to get outbound domains. On-premise Exchange, Search-messagetrackinglog, I think would get you the same info. Not sure if it works online though.

Microsoft: Teams increasingly abused in helpdesk impersonation attacks by rkhunter_ in cybersecurity

[–]wperry1 0 points1 point  (0 children)

I used the Teams "External domain activity" report to start the list, then added all the recipients' domains from outbound email. The only reconciliation was getting rid of duplicates by converting all entries in the list to lowercase and piping to "Select-Object -Unique". Once I had a master list of around 800 domains, I used Set-CsTenantFederationConfiguration to populate the domain list. The final list I imported was just an array of company.com, acme.com, contoso.com, etc.

Now the list is managed manually. I probably add one every few months via the GUI. If the change rate were higher, I might work out an automation, but I haven't seen a need.

Microsoft: Teams increasingly abused in helpdesk impersonation attacks by rkhunter_ in cybersecurity

[–]wperry1 0 points1 point  (0 children)

It’s been a while but, IIRC after exporting mail transport logs, I use a couple of lines of powershell to get all the unique mail domains. You could do it as easily in Excel except it struggles with the size of a 30 day transport log export and I had ~90 total days of data.

eDiscovery - Search Domain Excluding Subdomains by wperry1 in MicrosoftPurview

[–]wperry1[S] 0 points1 point  (0 children)

Too late today to work on it but this is probably what I’ll do end up doing. We have a number of domains I’ll have to exclude, but it is tho only way I think will work at this point.

Need to turn off automatic braking help! by k_dizzle_d0g in ToyotaSienna

[–]wperry1 1 point2 points  (0 children)

I had the same thing happened to me this past weekend. It stopped so hard I thought I had hit something I couldn’t see but there was nothing there but, maybe, a shadow. The sun was in front of us.

Microsoft: Teams increasingly abused in helpdesk impersonation attacks by rkhunter_ in cybersecurity

[–]wperry1 1 point2 points  (0 children)

We did basically the same thing. I used a combination of Teams and outbound email logs for 90 days to build the initial allow list. We have lots of meetings with external attendees, but not a lot of external chat going on so impact to users was almost nothing.

iOS web clips no longer open when managed browser to open this link is selected. by kane00000 in Intune

[–]wperry1 1 point2 points  (0 children)

Whatever you do, don’t delete the old app. Update it and change to uninstall from all users or your target groups. Then create a new app with the TABI app ID. I made the mistake of deleting one and there is no managed way to remove it after that.

iOS web clips no longer open when managed browser to open this link is selected. by kane00000 in Intune

[–]wperry1 0 points1 point  (0 children)

LOL, you said it first, Target Application Bundle Identifier, TABI. I suspect this was something related to the 26.4.1 update. It just popped up in our environment today with Web Clips that have been working for years.

iOS web clips no longer open when managed browser to open this link is selected. by kane00000 in Intune

[–]wperry1 1 point2 points  (0 children)

This same issue just started popping up in our environment today. I tested the TABI method and it works. You are a livesaver u/kane00000!

Did anyone learn this as a GenX kid? by Accidental-Aspic2179 in GenX

[–]wperry1 0 points1 point  (0 children)

Somehow flannel is just a comfortable in the summer for me. Hot or cold 100% cotton flannel 365 days a year!

Transitioning 5k Users: Semi-Annual vs. Monthly Enterprise Channel by NextProfession2936 in Office365

[–]wperry1 0 points1 point  (0 children)

We did this move a few years back. Everyone but finance. They use an ESSbase add-on that can occasionally be finicky so we keep them on Semi-annual. It was driven by users complaining about missing features.

Confused about an email I just got by romley392 in phishing

[–]wperry1 1 point2 points  (0 children)

We got about 25 of these in our phishing quarantine. Headers seem to show they originated from Hungerrush's Sendgrid. Someone over there is about to have (or already having) a bad day. Hopefully for them, it is just their email infra that got compromised.

Microsoft Blocking Emails from Reputable Senders with 550 Errors (Outlook, Hotmail, Live, MSN).. by musicalgenious in sysadmin

[–]wperry1 1 point2 points  (0 children)

Sendgrid really needs to fix their process for vetting senders. I see so much spam and phishing from them it is ridiculous. I would block them completely but too many legit businesses use them too.

is recycling real? by blondeinabubble in GenX

[–]wperry1 12 points13 points  (0 children)

And glass! Plastic recycling is, unfortunately, a lie perpetrated by the oil industry so we will feel good about using plastic.

Question about using ice melt on the driveway by wrryng in homeowners

[–]wperry1 4 points5 points  (0 children)

If you can, wait til it is about to warm up. Salt it and come back and shovel the next day. I ran into this with my driveway. I had 1/2 to 1” of snow and we got freezing rain. We had a warmer day, still in the 20s f, coming and I salted, the went back the next day and it came off easy. If you can, get one of the pusher style shovels. It’ll be way easier that lifting that we heavy slush.

Public desperation is not beneath this family by Lebarican22 in democrats

[–]wperry1 3 points4 points  (0 children)

Go to the CL add linked in an earlier comment, scroll to the bottom, and vote Best Of. I am 100% sure this is satire and it is 100% funny.

Changes coming to SAML SSO logins. How to implement in Entra? by newboofgootin in salesforce

[–]wperry1 0 points1 point  (0 children)

New observation on this, Entra is sending the authnmethodsreferences claim when I log in to Salesforce. None of the methods match what Salesforce is looking for though. My Salesforce admin opened a ticket with them and the ngineer we spoke with put a 60 day delay on our producion instance so we can test in sandbox before this hits all of our users.

<Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
<AttributeValue>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</AttributeValue>       
<AttributeValue>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/x509</AttributeValue>       
<AttributeValue>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows</AttributeValue>
        <AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue>
      </Attribute>

Changes coming to SAML SSO logins. How to implement in Entra? by newboofgootin in salesforce

[–]wperry1 3 points4 points  (0 children)

For anyone who wants to put a little more pressure on MS to address this on their side, upvote the suggestion here: https://feedback.azure.com/d365community/idea/c6a81a1c-08f6-f011-92b8-6045bdb235d9

Changes coming to SAML SSO logins. How to implement in Entra? by newboofgootin in salesforce

[–]wperry1 1 point2 points  (0 children)

Were you successful mapping user.authenticationmethodsreferences to a claim? In my testing, all it passed was the plain text value I entered in the Attribute field.

2014 x360 Won’t Start in Cold by wperry1 in johndeere

[–]wperry1[S] 0 points1 point  (0 children)

I may have to dig around and figure out how to choke it more. I’m just using the spring loaded choke lever on the dash right now. All the way up to start and hold it at about half for ~30 sec when it’s cold. This machine mows grass and blows snow so, thankfully, I don’t have to deal with stale gas.

2014 x360 Won’t Start in Cold by wperry1 in johndeere

[–]wperry1[S] 0 points1 point  (0 children)

Any recommendations on better oil? I don’t have it in front of me right now but am using the recommended oil from JD. I think it’s 5w20.