Loading ...

Category: Office 365

Change Office 365 Distribution Group Restriction

If an Office 365 Distribution Group is being synced from on-premise Active Directory environment then you cannot receive emails to that group from an external source by default. If you try to change the setting in Office 365 the following error appears:

The action ‘Set-DistributionGroup’, ‘RequireSenderAuthenticationEnabled’, can’t be performed on the object ‘[Your Distribution Group]’ because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

Office 365 Distribution Group Error

This can be changed using the ADSIEdit tool. Navigate through the Active Directory hierarchy and find the Distribution Group then right click and choose Properties. Scroll down to “msExchRequireAuthToSendTo” and change the setting to FALSE. Run a manual DirSync to effect the changes in Office 365.

Office 365 Distribution Group - ADSI Edit

Deploy Office 365 Desktop Apps

Recently had to deploy Office 365 Desktop Apps on a terminal server which did not work with the standard download from the web portal due to licensing issues. Only customers with Office 365 E3 licenses or greater are able to use the deployable version of the Office 365 Desktop Apps in a terminal server environment. Here are the steps needed to deploy the apps:

Deploy Office 365 Desktop Apps on Terminal Server

  • Download the Office Deployment Tool for Click-to-Run here.
  • Run and extract the tool to a folder on your Terminal Server.

    Office Deployment Tool

  1. Edit and configure the configuration XML file as follows including the \\[SERVER]\[SHARE]\ path:

    <Configuration>
    <Add SourcePath=”\\[SERVER]\[SHARE]\” OfficeClientEdition=”32″>
    <Product ID=”O365ProPlusRetail”>
    <Language ID=”en-us” />
    </Product>
    </Add>
    <Display Level=”None” AcceptEULA=”True” />
    <Property Name=”SharedComputerLicensing” Value=”1″ />
    </Configuration>

  2. Please visit this TechNet article for more details on the configuration file settings, like excluding apps from deployment.
  3. From an elevated Command Prompt, navigate to the folder extracted files are located in, and run the following to download the installation files:

    Setup.exe /download configuration.xml

    The Office365 ProPlus installation files will be downloaded to the specified share with the following structure.

    Office365 ProPlus installation files

  4. From an elevated Command Prompt, run following to install Office Click-to-Run:

    Setup.exe /configure configuration.xml

    When the installation is complete, the Office 2016 suite will be available for use.

  5. On starting the application, you will be prompted to Activate Office. Click Next and Sign in.

    Activate Office 365

  6. Once signed in, you are ready to go. Office will automatically activate and configure the applications. This is supposed to work similarly with deployment via Group Policy. If your company is using a terminal server for your remote access and need help to deploy Office 365 Desktop Apps, then contact us for assistance.

Share Users Office 365 Calendar

The old way to accomplish Exchange calendar sharing between users was to either connect to each individual users workstation to right click and share the calendar to users in the Global Access List (GAL) or to install their profile on your system and do the same. There have been some wonderful advances since the advent of Powershell that allow Office 365 calendar sharing permissions to be set remotely as follows:

How to share Office 365 Calendar via Powershell

1. Make sure the Windows Azure Active Directory Module for Windows PowerShell is installed properly

2. Open Windows Azure Active Directory Module for Windows PowerShell as administrator

3. Type in the following to run signed scripts for Exchange Online:

Set-ExecutionPolicy RemoteSigned

4. Type in the following to enter the administrative credentials for Office 365:

$creds = Get-Credential

5. Enter the Office 365 Administrator credentials then click "OK" button. 6. Type in the following to connect to Office 365 via PowerShell:

Import-Module MsOnline

Connect-MsolService -Credential $creds

7. Type in the following to connect to Exchange Online via Powershell:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection

Import-PSSession $Session

8. Type in the following command to change the calendar permissions:

Add-MailboxFolderPermission -Identity sharinguser@domain.com:\calendar -User recipient@domain.com -AccessRights Editor

Once this command has been executed for each individual recipient that will access the sharing users calendar, then you can have them right click to add the shared calendar in their Outlook. For a list of possible Access Rights see this great page by the University of Wisconsin. If your company is using Office 365 Calendar and needs help sharing them, then contact us for assistance.

Setup Microsoft Mobile Device Management (MDM)

Recently had some issues where another tech company was unable to properly setup MDM for their clients, so reviewed the documentation and their current efforts then came to the conclusion that they had skipped a couple steps in the initial setup that were causing the issue. Here is the proper initial setup steps:

Activate Mobile Device Management in Office 365

1. Sign in to Office 365 as an administrative user
2. Click on the Admin pane
3. Click on Mobile Management on the list to the left hand side
4. Click on the “Get Started” button
5. Wait awhile (5 minutes to 2 hours) for the setup to complete

Configure Initial Domain DNS Settings

1. Back in the Mobile Management section, look for the red x circle and click on “Manage settings”
2. First to configure custom DNS needed for automatic configuration, click on the “Set up” next to “Configure domains for MDM”
3. Click on the primary domain used for Autodiscover, etc. then click on “Domain settings”
4. Under “Domain purpose” click on “Change domain purpose”
5. Put a check next to “Mobile Device Management for Office 365” then click on “Next”
6. Take note of the following cname records:

enterpriseregistration enterpriseregistration.windows.net 3600
enterpriseenrollment enterpriseenrollment.manage.microsoft.com 3600

7. Enter these into the customers custom DNS records along with any others that are listed on that page which weren't entered previously.
8. Return to this page to confirm that the DNS settings have changed properly.

Configure Apple Push Notification (APN) Certificate

1. Back in the Mobile Management section, look for the red x circle and click on “Manage settings”
2. Click on “Set up” next to “Configure an APNs Certificate for iOS devices” to request the needed certificate to manage Apple devices.
3. Click on “Download your CSR file” to save the file locally then click “Next”
4. Click on “Apple APNS Portal” to open the Apple Push Certificates Portal
5. Sign in with a valid (hopefully domain associated) Apple ID
6. Click on the “Create a Certificate” button
7. Agree to the Terms of Use
8. Upload the Certificate Signing Request (CSR) that was save locally earlier
9. Download the new Mobile Device Management certifcate and save it locally
10. Go back to the “Install Apple Push Notification Certificate” page and click “Next”
11. Upload the new Mobile Device Management certifcate tjat was saved locally from Apple

Configure Basic Mobile Device Management Policy

1. Create a Security Group in Active directory that will be used to apply the MDM policy and run DirSync manually.
2. Back in the Mobile Management section, click on “Manage device security policies and access rules”
3. Click on the + to add a new policy
4. Give the policy a name and click “Next”
5. On the pop-up page leave the defaults and check next to “Require managing email profile (required for selective wipe on iOS)”
6. Also select “Block access and report violation” to keep users off the network until they comply with the new policy then click “Next”
7. On the following page there are additional option that give additional security but are not required, when done click “Next”
8. Change selection to “Yes” and chose the Security Group in Active Directory that will be used for MDM enforcement then click “Next”
9. Click on “Finish” to begin enforcing this new policy

The next time any user opens an associated Office App on their supported devices it will ask them to start the enrollment process which goes through a compliance check which usually requires them to delete their current Exchange Active Sync profile to continue.

Special thanks to the guys at ExchangeServerPro.com for their blog entry with the basics. Also a thanks to the Microsoft Office Blog Team for their detailed look at MDM policy setup.
If your company is using Office 365 or has a Bring Your Own Device (BYOD) policy which need mobile device management, then contact us for assistance.

Create Office 365 Shared Calendars

Often when migrating a client from on-premise Exchange server to the Office 365 platform, the company will have an Exchange pubic folder shared calendar or two that are used for various reasons. Here is the steps for creating the new kind of Office 365 shared calendars:

Creating a Public Folder Mailbox

1. Open the Office 365 portal with an administrative user
2. Open the Admin panel
3. Open the Exchange Admin panel
4. Click on Public Folders, then on the Public Folder Mailboxes
5. Click on the + symbol then give the new Public Folder Mailbox a name and click Save

Creating the Root Public Folder

1. Still in the Public Folders section click on Public Folders at the top
2. Click on the + symbol then give the new Public Folder Mailbox a name and click Save
3. Click on the new Public Folder then on the right hand side click on Manage under Folder permissions
4. Add all administrator users to the Folder Permissions

Creating the Shared Calendar Public Folder

1. Open Outlook on administrative users workstation who will be the "Owner" of the folder
2. Click on Folders at the bottom and expand into the new root Public Folder
3. Right click on the root and choose Add New Folder
4. Give it a name and choose Calendar Items under folder contains then click OK
5. Right click on the new Public Calendar click on Properties then on Permissions tab
6. Add all users who will be accessing the calendar and appropriate permissions for them

Adding the Calendar folder to Outlook

1. Open Outlook on each users workstation
2. Click on Folders at the bottom and expand into the new Public Calendar
3. Right click on the Public Calendar and choose Add to Favorites which then makes it listed under their calendar tab.

If your company is migrating from on-premise Exchange to Office 365 or are in need of an Office 365 Shared Calendars setup, then contact us for assistance.

Office 365 Email Distribution Group

Had a client that was using Office 365 Directory Synchronization (DirSync) to manage their users / groups in Office 365 via the local Active Directory which meant that there was not end-user manageability of those groups. A user asked to have a new email distribution list created that they could manage, so performed the following to make that happen:

Create an Office 365 Email Distribution Group

1. Open Active Directory Users and Computers.
2. Navigate to where in the hierarchy that the Distribution Group will be created.
3. Right click on the Organizational Unit where it is to be created and choose New then Group.
4. Give the Group a name and leave the default Group scope of Global and change Group type to Distribution then click OK button.
5. Double click on the new group to open it. Type in the email address to use then click on the Attribute Editor tab.
6. Scroll down and double click on the proxyAddresses item. Add the email in the format SMTP:[username@domain.com] then click on the Add button and OK button.
7. Click on the Managed By tab and click on the Change button to search for the user who will be the group administrator.
8. Click OK button then run a manual DirSync to send the changes to the cloud.
9. Open the group administrators Outlook.
10. Click on the Address Book button.
11. In the Address Book drop down list choose the Global Address Book (this may take some time to download the update).
12. Find the newly created Distribution Group and double click to open then click on the Modify Members button to add users.
If your company is using Office 365 and needs end users to manage their Office 365 Email Distribution Group, then contact us for assistance.

Office 365 / Active Directory User Changes Name

There is often the case that a female user will have a name change due to change in marital status. Here is the basics of how to change their name in both Active Directory and Office 365.

Active Directory User Changes Name objects

  1. Open Active Directory Users and Computers
  2. Find the user needing the changed name, right click on them and choose the “Rename” option.
  3. Change the user’s name as needed then press Enter then in the window that opens make all the further changes needed and click the “OK” button.
  4. Click on the View menu at the top and check the “Advanced Features” option.
  5. Double click on the users new name to open their Properties. Change the email address if needed in the General tab.
  6. Choose the “Attribute Editor” tab, scroll down the list to “proxyAddress” attribute and double click it. Click on the current SMTP:old.email@company.com and click the “Remove” button then change it to a smtp:old.email@company.com then click the “Add” button.
  7. Type in SMTP:new.email@company.com for the user and then click the “Add” button. Click the “OK” button on this window and the one beneath it.
  8. Make sure to also rename the users Redirected Folder if there is one created via Group Policy
  9. Run a manual sync of the DirSync tool via the Microsoft Forefront Identity Manager console.

Changes to Office 365

  1. Make sure the Windows Azure Active Directory Module for Windows PowerShell is installed properly
  2. Open Windows Azure Active Directory Module for Windows PowerShell as administrator
  3. Type in the following to run signed scripts for Exchange Online:

    Set-ExecutionPolicy RemoteSigned

  4. Type in the following to enter the administrative credentials for Office 365:

    $creds = Get-Credential

  5. Enter the Office 365 Administrator credentials then click “OK” button.
  6. Type in the following to connect to Office 365 via PowerShell:

    Import-Module MsOnline

    Connect-MsolService -Credential $creds

  7. Type in the following to connect to Exchange Online via Powershell:

    $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection

    Import-PSSession $Session

  8. Type in the following to change the username for login to Office 365:

    Set-MsolUserPrincipalName -UserPrincipalName old.email@company.com -NewUserPrincipalName new.email@company.com

  9. Login to the portal as administrator and make sure the changes have take effect.

If your company has an Active Directory user changes name in your domain or Office 365 user changes name, then contact us for assistance.

Problems Reinstalling Office 365 DirSync

This has happened to me countless times in the field and it is time to write up the process on my own. Either the client has an older version of the DirSync tool installed or there is some sort of errors that require reinstalling Office 365 DirSync. Special thanks go to Joseph Turley for the original write up on which this is based.

Uninstall Old AADSync Tool

If the server is running an older version of AADSync then below is a list of applications that are to be removed:

  • Microsoft Azure AD Sync
  • Microsoft Online Services Sign-in Assistant [Restart is required]
  • Forefront Identity Manager Windows Azure Active Directory Connector

There should then be a reboot of the server to finish these uninstallations. Additionally, the Azure AD Sync Scheduler scheduled task needs to be removed from the Task Scheduler to complete the removal of AADSync. There are also several user accounts in Active Directory Users and Computers that will need to be removed either titled something like “AAD…” or “ADSync…” for the reinstall to work properly. Also need to remove the folders named something like “C: > Program Files > Microsoft Azure AD…” before attempting to start the new installer. There might also be some leftovers in the registry that need to be removed as follows:

  • HKEY_CLASSES_ROOT\TypeLib\{1EE655FB-EC8A-4CFE-BFE7-E8D46BC87B6A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AD Sync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server Local DB
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSOLCoExistence
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrosoftAzureADConnectionTool
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0311B5B5-B05D-47A0-89D8-98AED5A0D204}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Azure AD Sync Scheduler
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\AzureActiveDirectoryDirectorySyncTool
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DirectorySyncTool_RASAPI32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DirectorySyncTool_RASMANCS

Uninstall Newer DirSync Tool

If the server is running a more current version of DirSync then below is a list of applications that are to be removed:

  • Windows Azure Active Directory Sync Tool
  • Microsoft Online Services Sign-in Assistant [Restart is required]
  • Forefront Identity Manager Synchronization Service

There should then be a reboot of the server to finish these uninstallations. There are several user accounts in Active Directory Users and Computers that will need to be removed either titled something like “AAD…” or “ADSync…” or “FIMSync…” for the reinstall to work properly. Also need to remove the folders named something like “C: > Program Files > Windows Azure…” and the database files located in a folder named something like “C: > Program Files > Microsoft SQL Server > MSSQL**.MSONLINE > MSSQL > DATA > FIMSync…” before attempting to start the installer.

Reinstalling Office 365 DirSync Tool

  • Log into the customer’s Office365 portal as a global administrator.
  • Click on the Admin tile
  • Click on the Users item in the left pane to expand it then click on Active Users
  • At the top of the main pane next to “Active Directory synchronization:” click on Manage
  • Make sure the at Active Directory synchronization is activated
  • Download the Directory Sync tool by clicking on Download button
  • Double click the installer
  • Type in your Office365 global administrator credentials then click “Next >” button
  • Type in your domain administrator credentials then click “Next >” button
  • Ignore the page on Hybrid and click “Next >” button
  • Make sure the box next to Active Directory Password Sync is checked and then click “Next >” button
  • Click on Install then on Finish to complete the install

Another handy thing to do after the installation is complete is to make a shortcut on the desktop for the miisclient software that monitors the sync process. It is located at “c: > Program Files > Windows Azure Active Directory Sync > SYNCBUS > Synchronization Service > UIShell > miisclient.exe” (this also allows for manual syncs when needed).
If your company needs help reinstalling Office 365 DirSync or help setting up Active Directory Password Sync for single sign-on, then contact us for assistance.

Configure Server 2012 Office 365 SMTP Relay

Install Windows Server 2012 SMTP Relay Feature

  1. Login as an administrator.
  2. Go the the start screen and type “Server Manager”
  3. Click on Manage and choose “Add roles and Features”.
  4. Click “Next >” (Check the box to skip this in the future)
  5. Make sure “Role-based or feature-based installation” is selected then click “Next >”
  6. Choose the appropriate server then click “Next >”
  7. Make no changes to the “Roles” page then click “Next >”
  8. On the “Features” page scroll down and check the box by “SMTP Server”
  9. Click “Add Features” (required for SMTP Server) then click “Next >”
  10. Click “Install” then wait for the install to finish then click “Close”.

Configure Windows Server 2012 SMTP Relay

  1. Go the the start screen and type “Server Manager”.
  2. In the Tools menu select “Internet Information Services (IIS) 6.0 Manager”
  3. Expand the tree until [SMTP Virtual Server #1] is shown then right click and choose “Rename” (as appropriate)
  4. Right click again and choose “Properties”.
  5. Click on the “Access” tab then click the “Connection…” button
  6. Select “All except the list below” then click “OK”
  7. Click on the “Relay…” then select “All except the list below” then click “OK”
  8. Click on the “Delivery” tab then click the “Outbound Security” button
  9. Select “Basic Authentication” and type in the username and password of Office365 user – this can be different than what is used on the device as long as the alternate address on the device is an alias of this user.
  10. Check “TLS encryption” then click “OK”
  11. Click the “Outbound connections” button then change “TCP port” to 587 then click “OK”
  12. Click the “Advanced” button then fill in the FQDN of the internal server (add custom DNS for future changes)
  13. Fill in “Smart host” with SMTP.office365.com – the name of the Office365 SMTP server then click “OK” twice

Warning! You have an open relay now. Use this setup to check the email notification system. When you see it’s fully functional go back to the “Access” tab and narrow down the “Connection” settings to the necessary systems. When no other system needs to relay, just check “Only the list below” and grant “127.0.0.1” access.

Configure External DNS for SPF protection

Go to the domain registrar’s website to update DNS records. Edit / create a sender policy framework (SPF) record. In the entry, include the external IP address. The finished string looks similar to this, where 10.0.0.2 is your public IP address:

v=spf1 ip4:10.0.0.2 include:spf.protection.outlook.com ~all

Note:
Skipping this step might cause email to be sent to recipients’ junk mail folders.
If your company is using Office 365 and needs an Office 365 SMTP relay setup for use by a network device like a multi-function printer, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2024- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]
And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10