Need to Know podcast–Episode 270

Join me for this episode with Microsoft MVP James Arber who’ll spend some time with us talk about Teams Voice. In short, he’ll help us demystify what it takes to get Microsoft Teams connected to the plain old telephone system. Microsoft’s world wide partner conference, Inspire is this week, and I’ll be tuning in to catch all the announcements from the event. I’ll bring you all those in the next episode, but not to be be outdone, I have a few handy links and news from the Microsoft Cloud to tide you over till then.

This episode was recorded using Microsoft Teams and produced with Camtasia 2020.

Brought to you by www.ciaopspatron.com

Take a listen and let us know what you think – feedback@needtoknow.cloud

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-270-james-arber/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

James Arber – Twitter, Linkedin

UCMadScientist.com

Teams and Skype for Business tools

@directorcia

Getting started with Microsoft Endpoint Manager

Three new voice features for Outlook mobile—now on iOS, and coming soon to Android

What’s new for admins in Microsoft 365 Apps for enterprise – June 2021

Enabling automation with Microsoft 365 Apps for enterprise

Get nostalgic with new Microsoft Teams backgrounds

New updates to the SharePoint admin center in Microsoft 365

Syncing M365 Message Center to Microsoft Planner

image

If you want to stay up to date with what Microsoft is developing and implementing with Microsoft 365, then you should be paying attention to information from the Microsoft 365 Message Center. You’ll find this in the Microsoft 365 Admin Center as shown above.

One of the options with this information is to have it delivered via email. To do this, select the Preferences cog as shown above.

image

Doing so will then display a number of configuration options on the right. Select the Email option from the menu at the top as shown.

image

You can now select whether to deliver these messages to the original tenant admin account, which is selected by default, but also up to two email addresses, which need to be separated by a semicolon. You can then select what emails you wish to received. Be warned, there are options for all Microsoft 365 services (like Exchange, SharePoint, Teams, etc) as well as major updates and privacy. Be careful of information overload here!

Select the Save button at the bottom of this dialog to update your preferences.

image

Another very handy option is to sync these messages with Microsoft Planner. To enable this option, select the Planner syncing menu item as shown above.

image

A dialog will now appear on the right, as shown above, that allows you to set up this process using a wizard. Simply select the Set up syncing button at the bottom of the page to commence this process off.

image

You’ll need to have a Microsoft Plan into which the Message Center will sync. If you don’t already have one, you can select the link on the page as shown to create one.

image

Your destination Microsoft Plan doesn’t need to be anything special. You need at least one bucket into which all the Message Center items will end up. In this case, that bucket will be the standard ‘To-do’ bucket.

image

Select the appropriate Microsoft Plan and the destination plan bucket, or select to create a new one.

Select the Next button at the bottom of the page to continue.

image

Like the email option, you now need to select which messages you wish to receive.

Select the Next button at the bottom of the page to continue.

image

You can now elect to import messages from a previous period i.e. messages already in the Message Center from the last X days.

Select the Next button at the bottom of the page to continue.

image

Review the settings.

Select the Next button at the bottom of the page to continue.

image

If you wish to set up an automatic process to sync the Message Center messages on a recurring basis, set the desired update time options and select the Create Flow with Power Automate button as shown.

image

Select the Continue button.

image

You’ll also need to sign in to allow access to the Message Center connector. Simply select the ‘+’ icon and the current account you are logged in with will be used. Ensure that a green check appears to the right of the Microsoft 365 message center as shown above.

image

Review the configuration and automatic syncing if enabled, and select the Done button to complete the process.

image

If you now visit the Power Automate service and look My Flows and Shared with me, you should see a Sync Microsoft 365 message center to Planner flow as shown above.

image

If you edit that Flow, you should see it simply has a recurrence trigger and a Sync messages to planner (preview) action, as shown above. The owners of this Flow will be the group associated with the Microsoft Plan you selected as your destination as well as the user who configured this process. You can always add more owners if you wish to this Flow. The Microsoft 365 message center connection will be authorised by the account you used to set up this process. This can also be altered if needed.

image

When Message Center data is synced to Planner it will look like the above, with all messages being delivered to the bucket that you nominated in the setup as individual tasks.

image

If you select any of these new Message Center tasks in Planner, they will appear as shown above, with details about the notification in the Notes of the task. These can now be used as any task would be inside Microsoft Planner.

As good as delivering Message Center information to Planner is, I feel that a better destination or this is actually Microsoft Teams. I’ll be covering off how to deliver it to a Microsoft Teams channel in an upcoming post, so stay tuned for that.

Security test script walk through video – Update 1

I have made some updates to my free security test script:

https://github.com/directorcia/Office365/blob/master/sec-test.ps1

The main improvement is the inclusion of a menu that allows you to select which test you want to run.

image

You can use the CTRL and SHIFT key to make multiple selections here.

The video also shows the results when the test script is run on a Windows 10 environment with Trend Micro and a Chrome browser.

Don’t forget to keep checking back for further script updates and improvements.

Windows Print Spooler Remote Code Execution Vulnerability–CVE-2021-34527

Information about this from Microsoft can be found here:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527

At the moment one of the work arounds is:

Option 2 – Disable inbound remote printing through Group Policy


You can also configure the settings via Group Policy as follows:


Computer Configuration / Administrative Templates / Printers


Disable the “Allow Print Spooler to accept client connections:” policy to block remote attacks.


You must restart the Print Spooler service for the group policy to take effect.


Impact of workaround This policy will block the remote attack vector by preventing inbound remote printing operations. The system will no longer function as a print server, but local printing to a directly attached device will still be possible.

You can also make that settings change via Endpoint Manager and Intune.

image

You’ll need to ensure you have an Administrative template (ADMX) profile in the Device Configuration profiles. If not, then simply create one.

image

In that Administrative policy settings do a search for ‘spool’ or the like. You should find the above setting under \printers – Allow Print Spooler to accept client connections, which you should then set to Disable as shown.

if you then save the policy it should be pushed out to all machines. According to the CVE, you’ll also need to restart the spooler service as well. You can do this with the following PowerShell command once the policy has taken effect:

restart-service –name spooler

Perhaps a reboot is easier anyway?

You’ll need to be careful about potential disabling existing printing configurations with shared machines, so it will be best to monitor the impact just in case.

Hopefully, a patch will become available soon for this but even when it does, I think leaving the setting disabled in general is a good idea!

CIAOPS Need to Know Microsoft 365 Webinar – July

laptop-eyes-technology-computer

Last months attempt at using Microsoft Teams Webinars went well and I’ll be continuing to use this going forward. Registration for this month is here:

https://bit.ly/n2k2107

Shortly after this you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite!

This month we’ll dive into email security with Microsoft 365, particularly the best practice configurations for Exchange Online. So please join us for this and all the latest news from the Microsoft Cloud.

You can register for the regular monthly webinar here:

July Webinar Registrations

The details are:

CIAOPS Need to Know Webinar – July 2021
Friday 30th of July 2021
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

Security test script walk through video

I’ve create this video to give you a basic walk through of the free security testing PowerShell script I’ve created. You’ll find the script here:

https://github.com/directorcia/Office365/blob/master/sec-test.ps1

In the video you’ll see how to quickly get and run the script as well the results it generates on a stand alone Windows 10 device.

Apart from Windows 10, PowerShell and Word there are no special requirements and it can be used on stand alone, domain or Azure Ad joined, etc. It doesn’t matter. It is designed to help you better evaluate your security posture.

10 years an MVP

MVP_Logo_Horizontal_Preferred_Cyan300_RGB_300ppi

image

I am happy to report that I have been renewed as an MVP for 2021-22. That now makes me a 10 year veteran of the program. I am very proud of that achievement in an ever changing technology environment.

As always, thanks to Microsoft for the recognition, for the last, and every other year. I am proud and honoured to be part of the MVP community and the amazing people there. The MVP community, as always, is an inspiring place to be and a group of individuals who love sharing, learning and helping others. Their influence and interactions continue to help me improve both professionally and personally.

I need to also thank everyone who takes the time to do things like read and comment on my blog, watch my YouTube channel, use my Github repo, attend events where I speak and more. Thanks everyone, I really do appreciate it. It is always good to understand the impact you are having out there.

Going forward, it seems we are in for more uncertain times, and we all know technology will continue to rapidly evolve. The best mindset to use is to look at both of these as a challenge not a burden. I appreciate that maybe difficult but you’d be amazed at what an open minded approach can achieve. Change what you can and be at peace with what you can’t, is a good recipe to strive for.

Once again, thanks to Microsoft for this award. I will continue to work hard to live up to the expectations of program going forward and thanks to everyone else out there who has been part of this journey with me.

Is security working? PowerShell script

I was inspired by this article:

How to make sure your antivirus is working without any malware

to create an simple automated process to test security settings and alerts for the Microsoft Cloud environment. I have thus created this script:

https://github.com/directorcia/Office365/blob/master/sec-test.ps1

which you can download for free from my Github repo.

You can run the script by launching PowerShell and running

.\sec-test.ps1

image

You don’t need to run the script as an administrator or with elevate privileges.

The first thing the script will attempt to do is download the EICAR testing file and save it locally as a file called eicar.com.txt.

image

Your security should prevent this and that file should not appear on your machine, which the script will verify, as shown above.

image

Your environment should also generate some sort of alert. In my case, one such alert appeared in Azure Sentinel.

image

Next, the script will attempt to create a new file in current directory called eicar1.com.txt with a signature that should be detected by your environment.

The script will then check the local Windows Defender logs for mention of the file eicar1.com.txt. If you are using a third party AV solution you’ll need to manually dig around in the logs to confirm this action has been detected. However, if you use Windows Defender, I have done that for you as you see above. The results are returned in order with Item 1 being the latest.

image

The script will then check to see whether the file eicar1.com.txt has been created. In most cases, the file will exist but it should be of zero length ensuring the creation process was terminated. If the eicar1.com.txt file exists and does not have a length of zero, then you’ll need to take action.

image

Next, the script will attempt to do a process dump for LSASS.EXE. To achieve this you’ll need to have SysInternals Procdump in the currently directory. If procdump.exe is not located in the current directory, you’ll be prompted to download it into the current directory.

The script will then try a process dump of LSASS.EXE using the command:

.\procdump.exe -ma lsass.exe lsass.dmp

The dump process should fail as shown above.

image

The final check is to prompt you for an email address and then attempt to login to Microsoft 365 using this.

image

Doing so should generate a log or alert as shown above that you can view and verify.

The aim of the scripts is largely to check that your security configuration is correctly enabled and configured. Generally, all the tests here should fail and all should report some where that can review to ensure your configuration is correct. Remember, good security is not to ‘assume’ and never test, it is to regularly test and understand where to look for specific types of alerts.

As I come up with more things to test, I’ll add them to the script, so make sure you check to see whether I have updated it in the future.