@Dashrender said in Managing Distribution Groups in an Exchange Hybrid Environment: @EddieJennings said in Managing Distribution Groups in an Exchange Hybrid Environment: I ought to have clarified. DUO MFA comes into play with Outlook for our mailboxes that are in Exchange Online. On-prem mailboxes (the few we have left aren't subject to DUO). Are those that are left on prem - are they actual users? If so, I'm curious why they can't be migrated? Eventually all users will be migrated, so, yes, we still have real users on-prem. This is outside the scope of the original question / scenario, but I've learned a good bit during this process with much of that learning validating a few things I already knew, such as the value of taking the necessary time to plan, and prep the environment for migration (removing unnecessary objects, etc.).

So far the rebuild appears to be still working. It ran all night. No complaints yet.

As above what they are are saying is that using Hybrid AD is fine with a domain name that is not the same as long as you add the UPN in Active Directory Domain Trusts and then you adjust all the users in the domain to match that domain either manually or scripted. https://docs.microsoft.com/en-us/office365/enterprise/prepare-a-non-routable-domain-for-directory-synchronization My only concern with this is that you might not need to sync AD but if you are already setup then it is kinda hard to revert.

I have not dealt with this much, however I have seen sharing groups get their members removed completely.

I was only looking at exchange online plan 1, but possibly also Azure AD functionality since I was getting into O365 by a toe.

@black3dynamite said in Disable Windows PIN Azure AD Joined PCs: Not sure if we are allowed to post Spiceworks url here anymore but this came from user called SauceOverflow. There is one registry key you can set and you also need to delete a file. Disabling Windows Hello does not disable an existing PIN. Remove existing PIN Delete the following folder: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC\ Disable Windows Hello (disables PIN, Face, whatever sigin prompt and setup) [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork] "Enabled"=dword:00000000 Awesome. Will give this a try!

Azure AD's Use of SAML Protocol

@scottalanmiller said in SSO with Azure & On-Prem AD: Have not tried that. Would be awesome to see working. I'd love to have had more time to play with it than being given the go-ahead at 3 pm on Friday to have it done by Tuesday morning at 8 am. After cleaning up the Server 2016 that was an attempt @ ADFS by the on-site that assumed A records are auto-created because Azure is integrated and AD, AD Connect, IIS, and SQL would be "OK" on the same server.

@dashrender said in IT Environment update questions: @scottalanmiller said in IT Environment update questions: @msff-amman-itofficer said in IT Environment update questions: @dashrender said in Greenfield (OK not really) setup questions: Additional options: use something like Salt to create network mappings for the computers. I am interested to hear about: "Salt to create network mappings for the computers." Since salt works only when minions connected, and for reason my NAS and windows clients loses the connections every 2-3 days and requires the user to re-input username/password (maybe related to Windows limtiation) how will you effectively use salt for that purpose ? just put script to run at user login ? any other neat ways to do this ? Salt is meant to run continuously. For example, mine run every 10 minutes or so to verify the environment. So if a mapped drive failed, it would be fixed again in a few minutes. The same goes for GPO. It refreshes every 15 min I think by default. Every 90 minutes with a 30 minute flux. So every 60-120 minutes for GPO.

@coliver said in Azure AD Open Source Alternative: @StrongBad said in Azure AD Open Source Alternative: Samba 4 does what AD does, for free. But I'm not aware of anything that does what Azure AD does using open source software that you can host yourself. Does anyone know if something exists? I guess what are you looking for? Azure AD is basically hosted AD with some limitations as to client management. It's a totally different technology. Azure AD is a competitor with hosted AD. It's not AD in any way. Very different technologies. One is a LAN design and one is LANless as well.

I solved this by removing all but one profile on the machine, then running sysprep /oobe /generalize /reboot Then during the mini setup I joined to Azure AD.

@njbair Thanks for joining the community to share your appreciation. I'm glad I posted the steps I took to resolve the issue because if you would have asked me today how I fixed it I'm not sure I could have remembered.

@Jstear said in Azure AD Authentication with NextCloud: @travisdh1 possibly, but I would like to attach it to an existing on premise server. https://help.nextcloud.com/t/backblaze-b2-sync/1323 Well, sure. I guess I should keep reminding people about my location. Online services like storage don't work because of the price we'd have to pay for a connection. Making the server and storage both online (preferably in the same data center) is just so much easier.

@Mike-Davis said in Azure AD Connect and populating a new AD Forest: With powershell you can rename a UPN suffix. Pretty easy with powershell: https://blogs.technet.microsoft.com/canitpro/2015/07/07/step-by-step-changing-the-upn-suffix-for-an-entire-domain-via-powershell/ Thanks @Mike-Davis, this is one of the pieces to the puzzle that I was missing.

@jospoortvliet said: with regards to the VHDX, we decided to remove the VHDX for now, we can't built it due to a server problem... It'll be back but that can take a while. Sorry! Hope the other formats suffice. Thanks for your feedback ! I think that that was for the other thread.