Removing Multiple Blocked Senders from EOP

Along with an Office 365 subscription, you get Microsoft’s mail filtering solution Exchange Online Protection (EOP).  You can also subscribe to EOP if you are running on on-premises mail solution.

One nice feature of EOP is that it can be configured to detect and block outbound spam.  IF When a user account gets compromised (or maybe you have legitimate spammers) Microsoft can block the ability for the account to send any more outbound mail until you have addressed the account and unblocked it.  This is great until you have an outbreak of compromised accounts, likely due to phishing victims, and need to remove multiple blocked addresses.  So how can we do this?

Continue reading

Get-AzureADMSDeletedGroup is not recognized

While playing around with Office 365 Groups expiration and the AzureADPreview module in PowerShell, I ran into the error below:

The term ‘Get-AzureADMSDeletedGroup’ is not recognized as the name of a cmdlet, function, script file, or operable program.

After a bit of trial and error, and some searching I found an important note in the Azure Active Directory PowerShell Module documentation.  The documentation notes that the preview module cannot be installed on the same machine as the production module.  I didn’t seem to have an issue actually doing the installation using the PowerShellGet Module, and tab completion for the cmdlets even worked, but the cmdlets would not work.

Indeed, after uninstalling the production module (Uninstall-Module AzureAD), I was able to work with the preview cmdlets.

ConfigMgr 1702 Rollup Update Deployment Gotchas

Microsoft released a Rollup Update for Configuration Manager v1702 this week to address multiple issues.  One specific issue that affected many deployments was related to operating system deployment:

Starting with System Center Configuration Manager, version 1702, unknown computers that are started from media or PXE may not find task sequences targeted to them. This issue may occur if the Previous button on the “Select a task sequence to run” page is selected on the unknown computer.

There are already great examples of how to install this update, but there are a couple of key gotchas I ran into during deployment.

Continue reading

Using a Separate Domain for Office 365 Groups

Office 365 Groups, sometimes referred to as Unified Groups, have been around for a while now.  Groups are excellent for collaboration, and allowing the end user to be in control of their own collaboration experience.  Groups are bad news for IT workers who need control or are resistant to change.  The latter group of IT workers will need to get on board though as it is evident that much of the Microsoft Office 365 ecosystem will be intertwined with Groups going forward.

For the past year, I have restricted group creation in production.  There are a multitude of reasons for not using Groups upon their initial release but, ultimately, it was lack of enterprise controls.  Most of those limitations have been remediated and the time for Groups is now.

In an effort to keep some form of structure around Groups, using a multi-domain approach is useful.

Continue reading

Exporting Data from OneDrive or SharePoint Online for eDiscovery Cases

Most, if not all, organizations will encounter a time when electronic data discovery is required for one reason or another.  Typically these reasons include review by Legal or HR personnel.  In these times of need, the eDiscovery functionality in Office 365 can help facilitate the requests.  Data from Exchange and SharePoint Online can be extracted, or placed on “hold” so that even deleted information is retained.  Obtaining the data from Exchange Online is fairly straightforward, but there are some caveats to getting data from OneDrive.  NOTE: The same process outlined below can be used for any SharePoint Online site.  Instead of using a OneDrive URL, the site URL would be used instead.

Continue reading

SCCM Client Stuck in Provisioning Mode

I was recently called to investigate an issue with failed client installations on newly imaged Windows 10 machines.  The symptoms were as follows:

  • Opening Configuration Manager from the Control Panel of the affected computer is missing tabs.  Typically only the General, Components, Actions, Site, Cache, and Network tabs are displayed.
  • The tabs that are displayed in Configuration Manager on the computer are incomplete as well.


  • The registry key HKLM\Software\Microsoft\CCM\CcmExec\ProvisioningMode is set to True

Regedit Provisioing mode SCCM 2012 client

Continue reading