HPlum78

I have covered this in past posts, so I will give some broad brush strokes here. SSO is not the same as authentication or authorisation they are all distinct but we in the world of IT tend to use them interchangeably. MFA on the other hand is a mechanism to protect your organisation and your users identities from nefarious activity (it is neither responsible for authentication nor authorisation). So as for your concern around SSO, I will put it like this for all of those systems that require a login if you use application identities the bigger risk to you is that your users are probably just using the same passwords as they use for their AD account! And these are being stored in another place. My next statement may split the crowd but those applications in the most part will be far less secure than AD and using AD to authenticate against (I am deliberately not throwing in cloud based auth here) as kerberos with the correct browser settings is essentially what is traditionally what we call SSO. There are a number of protocols that are available to use for authentication you mention OAuth (Oauth2) but there are others that can be leveraged including but not limited to to SAML (multiple versions), openid connect WS-Fed.. The list goes on. Azure AD can support a number of authentication methods that should support most of your applications and you should look at hooking your applications up and leveraging these capabilities. If you find an on premise application that cannot support modern auth then you should look at putting these behind an app proxy this allows you to leverage all the Cloudy auth goodness along with MFA and let's you remove the server from having a direct Internet connection. You are also in a position to leverage conditional access policies (if you use Azure) to allow you to say things like if the request comes from a known device and IP address subnet then don't challenge this via MFA and such likes. I could go on and on and have started to drift (like I do) but happy to talk directly in more detail.

Not looked at the code but adding Domain Admins full control says that you have accounts in that group on a day to day basis @cdCache As per the recommendation the Domain Admin group should have no users in it in day to day operation, if you need a group with access to all of your users data (and that's a big IF) then create a group for that purpose and keep it empty untill you need some access also monitor and alert on the group for accounts being added/ removed like you do for all the other highly priv groups in your domains.

First question is are you seeing any 13509 events?

I will say what I always say here, and that's you will not realise any saving by leveraging IaaS. You will be best served by looking at what you can migrate to either PaaS or SaaS. So for instance if you are running IIS on one of those VMs spin a PaaS instance up and migrate the website(s). That said you do need architect these so you are minimising any cross site dependencies.

What is in the %systemroot%\debug\dcpromoui* logs? Also anything in the event logs?

Totally missed the posts around DHCP! Can you be sure that you have not statically assigned ip addresses to devices and left those in the DHCP pool?

@kieran1990 so other guesses are ipv 6 has been disabled or you have multiple NIC installed and the bindings are not correct or unused NICs are not disabled...

That also don't match up with what you describe in your initial post, the randomly lose network interest me and think that needs unpicking initially. Especially if the DC in question is still running as expected also you should be able to take a DC outage without impacting your clients (I would hope).

Yeah that's a race condition where the DNS service starts faster than AD essentially. I would guess that you are pointing DNS to the local loop back adapter rather than the DC's private address.

https://github.com/martijnvangeffen/DMARC-report/blob/master/Create-DMARCreport.ps1 We use the above powershell.

SMB version....

https://www.nominet.uk/uk-domains/additional-domains/ See above nominet are the people to contact.

If Bromcom can provision into Azure AD then you could get it provisioned in to an on prem AD infrastructure If absolutely required. Good spot mind.

So cloud HR systems have started to provision directly into Azure AD and then if required into on prem AD. I can only guess that cloud MIS providers are looking at doing the same? Would be worth putting the question to the likes of Bromcom/ iSAMs Et al to see if they are looking @ this.

Initial thoughts on just a quick glance at the code is you are essentially trying to multi hop within winrm and you are probably finding that you are not allowed to do right off the bat... https://docs.microsoft.com/en-us/windows/win32/winrm/multi-hop-support Also (I am busy and was only trying to point you in a direction here!) but if you used a bit of try{} catch{} wizardry in your code and you could then see any errors being thrown. $RemoteResults = Invoke-Command - xxx - scriptblock{ Try{ New-psdrive xxx } Catch{ Return $_ } Do the things that ain't going to throw an error.. } Sorry last edit any errors will be returned to the $RemoteResults var.

On a side note are those who are using Azure (hybrid AD sync) set up this yet: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy Take a look.

I also note we have dragged in SSPR here an all, next year will be the 10 year anniversary of our SSPR implementation and in all that time we have seen exactly 0 account compromises from its use, the biggest issue was getting the balance of questions/ challenges right (How to challenge a password reset still is but more on that later) as people generally forgot the answers to the challenges! But overall it has stopped 90% of users who registered for SSPR contacting IT Services for a pwd reset. Setting the password reset email to the account that you need to reset the password for is a chicken and egg scenario and is really not a thing in the world of SSPR! Need to understand what the risks are and what you are trying to mitigate against, if you think that the biggest risk is a user leaving themselves logged in and little Johnny gaining access that's one risk and actually in the scheme of things is not a massive risk at that (and you will have policies in place to deal with this). If the risk is about external actors compromising an identity, then managing multiple identities in multiple places is a much bigger risk and using FID to control access to your applications is a much better option as MS/ Google know far more about nefarious activity than your IT departments will ever do. Also the ability to leverage conditional access/ MFA and all the other goodness that comes from one identity is massive (for those using cloud identities that is). Even for your internal MIS implementations (and not limited to) you should consider using app proxy to leverage Azure AD for signing in (I guess Google has something similar) as again you gain all the goodness of FID access. Right it's Six nations coming up and I have things to fix and kids to feed! But happy to talk more about this as I love identity management....

https://www.sharepointeurope.com/ ESPC21 is online again this year and you can access the content free, TBH it's worth the €49 to get access to the pro track. Link above will get you there sign up...

The question asked for MIS and cloud services, are you hosting/ having your MIS hosted in the cloud? If so then SSO (and I use the term knowing we swap SSO and FID) then you should be using "SSO" as I don't think/ hope that for cloud hosted services anyone is creating an application identity for their users? And if you are I hope that you are not arguing that it "seems" more secure than using actual "SSO"! Loads to unpick here, but Taskmaster is on... :-)

We do allow SSPR for both our staff and students via MIM and also have a subset that are able to do this via azure and we are looking to roll this out to all and decommission the MIM SSPR setup we have. And the answer is yes you can limit who can use SSPR via a group, but we do not allow any privileged accounts (admin) to do this as that could end badly!

An update to AAD has caused a global outage, the office team said it would be back in 15 mins but no one told the Azure team so Azure and O365 been down since 19:15 this afternoon....

GO GO GO GO and their off... Yeah alway will be the voice of F1.

https://plumsail.com/sharepoint-helpdesk So the above is a good ticketing system and you can use forms and power apps (flow) to automate tasks like teams creation and such likes. Loads of stuff you can do to stream line stuff here. Not saying that you cannot do this with other (as I have been known to) but it's all in office 365.

Would need to take a look at the command your running to be able to shed any light on it as based on what you are saying it should have removed the mail.

Maybe we will see the promised hybrid replacement so that we can get shot of on prem exchange installs... This may help focus some minds.