Extending Exchange Online Deleted Items retention period

Many people are unaware of the fact that ALL (yes, I said ALL) Exchange Online plans are configured by default, to ONLY retain deleted items for 14 days. Yes, I said ALL Exchange Online plans, and I quote:

“How long deleted items are kept in the Deletions folder depends on the deleted item retention period that is set for the mailbox. An Exchange Online mailbox keeps deleted items for 14 days, by default. Use the Exchange Management Shell, as shown above, to change this setting, to increase the period up to a maximum of 30 days.”

this is from:

https://technet.microsoft.com/en-us/library/dn163584(v=exchg.160).aspx

You will also note that you can extend this to a maximum of 30 days using PowerShell, which is exactly what you should do IMMEDIATLY you add a user account I would suggest.

To do this you firstly need to connect to Exchange Online using PowerShell. Then to view the current retention periods run the following:

image

that should then display something like:

image

As you can see from the above, all the mailboxes listed are currently only set to a MAXIMUM of 14 days for retention (which is the default).

To extend this to the maximum of 30 days for ALL plans, execute the following command:

image

Now when you re-examine all the deletion period for all mailboxes you should see:

image

they have all been extended to the maximum of 30 days, which should make everyone much happier and provide you the ability to recovered deleted email data out to the maximum period of 30 days for ALL plans. After 30 days however, the deleted data will still be purged and unrecoverable.

If you wish to retain deleted email data beyond the maximum 30 days that can be provisioned generally you’ll need to add the legal hold service to the mailbox and ENABLE it! The legal hold service is available on Exchange Online Plan 2 mailboxes, E3 and E5 suites typically.

To my way of thinking, extending the deleted item retention period of all mailboxes in a tenant is something that should be done immediately and using the above PowerShell commands it is really easy to do. So there should be NO excuse!

Improved security is a shared responsibility

image

The Internet has ensured that everyone who is connected is connected together. Everyone being connected together has some massive advantages but it also makes us vulnerable to those who wish to exploit this fact. The reason we all get so much spam is because it is so easy and so cheap to send. However, after all these years, why is the dominate email traffic source always spam? It’s because it morphs and evolves to avoid detection. The same applies for other threats such as phishing.

Technology provides some great tools to deal with spam and phishing but they can’t remove 100% of the threats that are out there. Many also rely on people reporting attacks and suspect item in their inbox to security vendors so they can analyse the results and improve their own detection.

The problem with reporting incidents you come across in your own inbox has been a challenge. Who or where do you send your reports to? Now Microsoft has a free add in for Outlook that allows you to quickly and easily report spam and phishing directly to them.

To do this visit:

https://appsource.microsoft.com/en-us/product/office/WA104381180?src=office

and install the Report Message add in for Outlook to your environment.

image

Then when a suspect email is detected you can easily report it via a few clicks.

For more information about installing and configuring the Report Message add-in across your Office 365 environment see:

Enable the Report Message add-in

Don’t just sit there and ignore spam and phishing attacks. Report them and potentially help save someone else from becoming a victim! When you connect to the Internet you become part of a global community. Help the community fight back again those seeking to take advantage of others. The more we all report attacks the less there will be.

Join me in the fight to take back the Internet!

Check those Office 365 email forwards

One of the most common tasks that hackers perform after they have compromised accounts in Office 365 (usually via a poor password or phishing attack) is to set up an email forwarding rule on mailboxes so they receive a copy of emails to that user.

Thus, it is good security practice to ensure that you are aware of all the email forwarding configurations that are enabled on your tenant. To do this you simply need to run the following PowerShell command once you have connected to Exchange Online:

Get-Mailbox | select UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward

This will produce a result like:

image

which tells you whether forwarding has been enabled and to which address emails are being sent. Obviously, if you don;t recognise any of these you should investigate further.

There are plenty of ways to run this script on a regular basis but I’m not going to cover that here.

CIAOPS Need to Know Azure Webinar–March 2018

pexels-photo-325229

One of biggest challenges people have with Azure is determining pricing. So for March we’ll focus on understanding how pricing works with Azure and how you can optimize your spend There’ll also be news, updates and well as open Q & A so I’d love to see you attend.

You can register for free at:

March Azure Webinar Registrations

The details are:

CIAOPS Need to Know Azure Webinar – March 2018
Thursday 29th of March 2017
2pm – 3pm Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

There of course will also be open Q and A so make sure you bring your questions for me and I’ll do my best to answer them.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session.

CIAOPS Need to Know Office 365 Webinar–March

laptop-eyes-technology-computer

In light of the recent Australia Data Breach Legislation and the upcoming GDPR policies in Europe the March webinar will focus on security in Office 365. You’ll learn what is available and how ton configure it. There will be the usual news, updates and Q & A on Office 365.

You can register for free at:

March Webinar Registrations

The details are:

CIAOPS Need to Know Webinar – March 2018
Thursday 29th of March 2018
11am – 12am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

There of course will also be open Q and A so make sure you bring your questions for me and I’ll do my best to answer them.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session.

Why following best practices in Azure is a good idea

Over my time I have seen so many Azure solutions built in ways that are contrary to agreed best practices. Why does this happen? Typically, it is because people bring old concepts and methodologies to new environments like Azure. Yes, many of the fundaments are the same. Things like TCP/IP, networking and the like are the same as on premises but others are very, very different.

One of the key differences when it comes to storage with Azure Virtual Machines (VMs) is the disk topology. When you spin up an Azure VM you typically get two drives, C: and D:. C: is the boot partition and holds the operating system while D: is a temporary or caching disk that gets recreated upon every reboot.

image

Above you can see an example of a topology from an Azure machine. You will see that D: has the label ‘Temporary Storage’.

image

A closer looks at D: reveals the contents shown above.

image

If you look at the contents of the warning file you see the above. Note the first line which says (in capitals):

WARNING: THIS IS A TEMPORARY DISK

Why am I emphasising this? I can’t tell you the number of people I have seen bring previous practices to Azure and put production data (such as Active Directory Databases) onto this temporary drive because ‘this is the way they have always done it”. That unfortunately, is only going to end in tears.

Best practice when it comes to Azure is to always add data disks to Azure and start the labelling from F:. Yes, there is an additional cost for adding data disks but that cost is small compared to the flexibility you gain.

Case in point. I have a nested virtualisation server running in Azure that hosts a number of machines for testing. This machine has two data disks striped together for storage and performance optimisation. Using striping is another change from the ‘de-facto’ that I’ll look at in an upcoming article.

Unfortunately, when I put on some recent Windows updates the machine decided it no longer wanted to boot. I tried all the troubleshooting tips to get the system to boot but to no avail.

image

I therefore went in to the disk configuration of the failed machine and ‘detached’ the existing data disks, which as you can see, you can do from the Azure portal, although there are also PowerShell commands to accomplish this.

With the data disks ‘freed’ from the original failed machine, I proceeded to create a new virtual machine to mirror the original failed host. After doing this I went to the disks area of the new machine and selected the option to Add data disk. However, instead of specifying to create new clean disk, I elected to use existing disks and select the ones that I had detached from the failed original.

When I now looked at the new machine, with the existing disk attached, I found that the striping environment was already in place and needed no further configuration. All I needed to do was to restore my virtual machines that were on the data disks using the Hyper V manager. All really simple.

If I had installed everything on the C: drive then I would have lost the lot and would have needed to rebuild every virtual machine in that Hyper V environment from scratch. That would have cost me a lot of time, where in fact the total recovery time here was only a matter of minutes. That’s a BIG difference!

The moral of this tale is that a new environment like Azure does operate in a different manner from previous technologies. It is generally not appropriate to always bring old practices to a new environment without taking time to understand the ‘best practices’ for a new environment. Doing things the same old way just because this is the ‘way it’s always done’ can lead to a lot of pain and heartache. On the contrary, when you take the time to understand any new environment and follow best practices for that environment, things tend to be much easier as the above hopefully illustrates. This applies as much to Azure as it does Office 365. New technologies need new approaches and new best practices.

In summary, please oh please DON’T put your production data on C: or D: with Azure virtual machines.

February Azure Webinar Resources

Here are the slides from the February Azure webinar where we took a look at Azure networking.

https://www.slideshare.net/directorcia/ciaops-need-to-know-azure-webinar-february-2018

The recording is also available at:

http://www.ciaopsacademy.com.au/p/need-to-know-azure-webinars

which CIAOPS patrons get free access to as part of their subscription.

This webinar set more of the ground work for upcoming monthly webinars that will go deeper into Azure features and abilities.

So make sure you sign up for next month’s webinar.

February Office 365 Webinar Resources

Good to see such large numbers for this month’s webinar. Obviously, a topic of great interest to many.

Slide from this month’s webinar are at:

https://www.slideshare.net/directorcia/ciaops-need-to-know-office-365-webinar-february-2018

f you are not a CIAOPS patron you want to view or download a full copy of the video from the session you can do so here:

http://www.ciaopsacademy.com.au/p/need-to-know-webinars

We looked at PowerApps in this session

Watch out for next month’s webinar.