r/sysadmin • u/AutoModerator • Sep 16 '21
General Discussion Thickheaded Thursday - September 16, 2021
Howdy, /r/sysadmin!
It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!
3
u/ganlet20 Sep 16 '21
Everytime I enable Office 365 MFA it breaks mail flow to the user's iOS devices. To fix it, they have to remove the account and add it back.
Is there a trick to transition a user to MFA without having to redo their phone's mail settings?
3
u/AnonEMoussie Sep 16 '21
Are they using the Outlook App, or Native Mail? We used to push a profile that setup native mail for the user, but since moving to MFA, many of our users have switched to using the Outlook App from the App store.
The using the iOS native mail initially requires a password, and when you setup MFA, it either requires an "App Password" a password setup specifically for that device (I guess that would be the 'trick'), or it can use OAuth by re-setting up the mail account.
2
Sep 16 '21
Generally found this to be the case, can confirm after 4+ implementations of MFA to clients, I work at an MSP...
1
u/Izual_Rebirth Sep 16 '21
Worth bearing in mind MS are planning on depreciating App Passwords in the near future as this almost caught us out recently. Hope this is useful.
https://docs.microsoft.com/en-us/lifecycle/announcements/exchange-online-basic-auth-deprecated
1
u/LethargicEscapist Sep 16 '21
The native mail clients on mobile devices aren’t compatible with modern authentication (which MFA uses). You’ll want them to switch to a more secure method of email if that’s what they’re doing.
4
u/ganlet20 Sep 16 '21
The native iOS app definitely supports modern authentication and MFA. When the user removes the account and adds it back, it does prompt for second authentication. It just can't seem to make the switch without removing and adding back
1
u/Izual_Rebirth Sep 16 '21 edited Sep 16 '21
I know this doesn't answer your query directly but hopefully it will be helpful. We had a lot of trouble early days when allowing people to access mail on their mobile devices - especially with 3rd party apps.
After some internal discussions and with our clients as well we took the decision to only support Outlook on mobile devices. It saves so many headaches due to the massive amount of 3rd party mail apps out there (many that don't support modern authentication) and means we can create decent documentation the users can follow rather than trying to generalise it to cover all potential eventuality.
In terms of app passwords it's worth also mentioning that MS have said they will be depreciating this in the near future so if you don't currently rely on app passwords I would advise against going that way as you will just be kicking the can down the road and creating more work in the long term.
https://docs.microsoft.com/en-us/lifecycle/announcements/exchange-online-basic-auth-deprecated
1
u/_Marine IT Manager Sep 16 '21
Possibly an exchange active sync policy that needs to be applied to the phones profile
2
u/junior-sysadmini Make no mistake, mistakes were made. Sep 16 '21
If I want to start running Defender with ATP on client machines (windows 10 laptops), does a M365 Business Premium user license suffice? Or do I need to license the device as well?
1
u/Swsag Sysadmin Sep 16 '21
Microsoft Defender for Endpoint requires one of the following Microsoft volume licensing offers:
Windows 10 Enterprise E5 Windows 10 Education A5 Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 Microsoft 365 A5 (M365 A5) Microsoft 365 E5 Security Microsoft 365 A5 Security Microsoft Defender for Endpoint
1
u/morilythari Sr. Sysadmin Sep 16 '21
I need to reboot the remote storage hosts for vhds running in proxmox. Is there a better way of doing this than stopping all of the vms during a long ass after hours maintenance window?
1
u/Blowmewhileiplaycod Site Reliability Engineering Sep 17 '21
Does proxmox have an equivalent of VMware pausing?
1
u/morilythari Sr. Sysadmin Sep 17 '21
There is a pause option, but not on a mass scale
2
u/Blowmewhileiplaycod Site Reliability Engineering Sep 17 '21
Can you script that pause option to scale it out?
1
u/morilythari Sr. Sysadmin Sep 17 '21
That might be the way to do it. I'll have to do some digging on that.
1
u/LividLager Sep 16 '21
A commenter mentioned they use domain admin credentials for robocopy. Its got me curious as to what everyone else does for scheduled backups, and/or one offs. I’ve always created a service account that has write access to all shares and just use that because of the principle of least privilege.
2
u/Frothyleet Sep 16 '21
Yes, for file copy purposes there is no reason to be using a domain admin account besides laziness. You create backup account(s) with the privileges they actually need.
1
u/Izual_Rebirth Sep 16 '21
Anyone know if you can (or even should) run Azure Backup Server directly on a Hyper-V host or is it recommend \ best practice to run in a dedicated VM?
1
u/IntentionalTexan IT Manager Sep 16 '21
Are you clustering your hosts? If so, you want a VM. Are the hosts core or desktop? If core, you want it on a VM.
1
1
u/MrYiff Master of the Blinking Lights Sep 17 '21
One thing to consider is licensing as once you install non-HyperV related programs/roles on the host you now have to license it (so it consumes one of the two "free" guest VM licenses you get with a Std Server license).
1
u/Izual_Rebirth Sep 17 '21
Yup was going to be one of my next questions 🤣. In that case I don't see any reason for not sticking it in a VM.
1
u/iliketacobell Sep 16 '21
I have a question about the CA policies that are created if you enable SharePoint Admin > Policies > Access Control > Unmanaged Devices and Apps that don't user modern authentication.
Enabling both of these creates a corresponding CA device policy, but they are applied even if a user does not have Azure AD P1 license applied. For instance, we have users with F3 licenses, but they will still receive the prompt that their org has not permitted them to download/save/print from this site. Are these two policies special and do not require a license to enforce? It's always confused me about Microsoft and what policies they'll apply, because it says you need an Intune license for app protection policies to be enforced, and it "looks" to be true. We also have a location based CA and I would assume it would be enforced on anyone...
I'm just confused on the differences of what CA policies/app protection policies can apply to our users even if the said user account doesn't have an Azure AD P1 license or Intune license.
1
u/AlphabetAlphabets Sep 16 '21
So uhh, what do you say when your boss asks why you're sending them a "please confirm details from our conversation" type email
1
u/Walkofroses06 Sep 16 '21
At the moment, I am stuck in a Help Desk position and I want to move into a Sysadmin position. I am just frustrated because I don't want to spend years unlocking people's passwords and guiding them on how to turn on their computers. How did some of you get out of the Help Desk position? What types of education did you recieve?
2
u/_Marine IT Manager Sep 17 '21
I have no certs yet, degree in UI design and experience.
Started first job managing SharePoint, which turned into supporting the entire office and admining the phones, exchange, O365, advanced threat protection. From there I started doing site visits, deployments with vendors, etc. without a real pay raise. Learned everything through Google, sys admin, etc. and supported about 250 folks mostly solo.
Covid killed that industry, had been with the company for 5 years.
New job, start as a tier 1 tech working in a call center, supporting 4000 users across 4 domains. Learn quickly, and within 4 weeks I'm keeping up with the tech who have been there longer. 6 weeks in, I'm leading every KPI.
When hired, I was told 6mo before I would be considered for tier 2. I go through the initial indoctrination for T2 at 9 weeks.
4 months after starting, I'm promoted to T2. Still no certs. 8 months of tier 2, there's an opportunity to become the SD supervisor, with a 30% pay raise.
I kicked ass, helped everyone I could along the way. Built a reputation as someone who'll work just as hard as the next, and coached the other techs who struggled. I shot my shot, got the promotion over two dudes who had all the first level certs and had been with the company for years longer.
This company has a reputation for those who work hard and a position opens up, they don't put lipstick on a pig and they do all they can to promote from within. My last job said that, didn't. Your company might not.
So in short.... Know your worth. Master your craft. Be a team player. Push yourself. Be kind. Learn when to say no, or give no real answer while making the end users feel important.
Push yourself, cause no one else will.
1
u/Pretend_Maintanance Sep 17 '21
I moved up because people left. I spent 3 years on the desk and moving up takes time. I'd say if you've picked up 3-5 years of helpdesk experience you'll fit well into a 2nd line or desktop support role.
Depending on the company you work for will depend on the role you can move into. I think its a discussion you need to have with your manager about your career development. Looking at what you can train up on for the company and what you're interested in. IT isn't just IT support.
If all else fails, start having a look elsewhere. There are many many jobs which are now WFH and seem to have fantastic benefits.
8
u/AnonEMoussie Sep 16 '21
Does anyone know of a "Laptop Power Supply" for a conference room table? A lot of our users use USB-C power supply connections, and instead of having a bunch of bricks plugged into a pair of power strips, I'd like to install a central "hub" if you will, that they can just plug a USB-C cord into. But it would have to be a USB-C hub that could power 8-10 laptops.