HPlum78

You should wrap some red gels round it see how long it takes to get a proper diffuser on it...

@Ditto agree with your comments here I am just throwing my thoughts in to the pot as they are considerations all the same and it always leads to the comment around they can take a photo of the screen! There is only so much that a technical solution can be lent on to deliver sanity!

My only thought is the FOI request? How would you be able to say with any certainty that the info that may have to be disclosed based on one of these requests is complete if you allow this kind of communication out side of systems that you can manage? Another thought that follows is if you get a right to be forgot request, again makes it hard. Like I say neither maybe a concern but you could never be sure that something may come and bite you.... I would say a managed identity and think about if allowing forwarding to personal accounts fits in to your data classification policy I would imagine that some data shared with interested parties should not be automatically forwarded on to accounts that you have no control over.

Wow well that answers the question!

Huh they (MS) where looking in to that i had opened a ticket something to do with moving the config from exo to the admin portal... Use the PowerShell command directly as there is no way to do it in the GUI when that error comes up from memory. (providing that it can find the required DNS records on you servers that is) https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide The PS can be found in the above, but here it is: New-DkimSigningConfig -DomainName {Domain for which config is to be created} -KeySize 2048 -Enabled $True And the command reference is here: https://docs.microsoft.com/en-us/powershell/module/exchange/new-dkimsigningconfig?view=exchange-ps

Yeah @chaplic is right reject is one way to sort the men from the boys! (or drop a load of mail at the door)

Ain't checked your records @kennysarmy (on my phone and it's a pain) but here are a few resources that may help you guys: https://dmarcian.com/ Loads of good stuff here to help you create and test DKIM, DMARC and SPF https://mxtoolbox.com/SuperTool.aspx More tools for testing And MS in the portal have got the tool that will create your DKIM records and allow you to rotate the keys and such likes. And here is just one of many powershell scripts that you can point at the DMARC reporting mailbox to give you something readable. https://gallery.technet.microsoft.com/scriptcenter/Harvest-DMARC-items-for-9c0d911a

@Steve21 sorry trade discrimination act is who you need to take this up with... :-p

https://devblogs.microsoft.com/powershell/secretmanagement-and-secretstore-release-candidates/ Link to the announcement on this release also note the availability of the extensions to help you secure your secrets.

@chaplic is old school "Flow" for all you young folk out there it's PowerAutomate :-p

Surly this comes down to the data classification for the data that was/ is stored in the team and the policies that you organisation have set out for those.

I ain't used SIMS for well let's say some years.... Can it not just be pointed at an SMTP endpoint! Surly it don't have to load a client side app to mail these days?

Just had a quick look and can pump out to JSON and use PowerBI to consume the files from there you can use a dashboard to fluff the data in to something nice.

What's your default browser set to? Mind you I ain't seen this error for a long while but that's my first thought....

I thought I saw that MS had added some educational API endpoints that you can register in your tenant and then use some graph calls to build a picture of your user engagement and such likes? In fact i will Google that for you: https://docs.microsoft.com/en-us/graph/api/resources/education-overview?view=graph-rest-1.0 Don't know the entire ins and outs but it's a starter for 10...

I know you have said LAPS ain't the route but I am in this camp and if you want to be supported then it's the only option you have. It's not overly complex at all.. I would like to unpick the issue around access to a domain server? What are your thinking the risks are here?

Keyvault here mentioned it before and now has some direct integration with the PS secrets management module see here : https://devblogs.microsoft.com/powershell/secrets-management-module-vault-extensions/ You get all the goodness of MFA and the likes as well as being able to retrieve the secrets via code. Also the ability to get the vault to manage and request certs is worth investigating as well.

The only thing I would say is | into a for each and put the enable-remote mailbox in a try catch statement. Gives you some error trapping ability and the likes.

I would like to unpick why you are having to poke the sync engine inside of the 30 mins (password hash updates aside)? I don't poke the sync engine outside of our normal identity provisioning that often on the thick wedge of 50k identities. In fact i guess its only when an identity is put in the compromised account group and the scripts kick off to disable everything and revoke the tokens that we use the command to kick of a sync in anger.

And while I think (continue to think) about this are you now using the exo v2 module? As they have done a ton of work on these and have reduced the property bag that gets returned. So the v1 commands will return the thick wedge of 250 properties and the new commands return ~10, this has a dramatic effect on the performance of running the commands.

While I think about this (and the OPs issue) using a Graph call will actually solve the issue as it proxies the update to the user that needs updating https://docs.microsoft.com/en-us/graph/api/user-update-mailboxsettings?view=graph-rest-1.0&tabs=http The above gives some insights and to be fair will alleviate a lot of these issues (if a corresponding graph endpoint exists for the attribute you are trying to manipulate)

The | don't change the error (as noted in my earlier response) the object has moved its written in the error. Unless MS are going to rewrite how EXO works this will always be a thing and needs to be solved in your code....

https://docs.microsoft.com/en-us/exchange/mailbox-migration/migrate-mailboxes-across-tenants So the above gives some insights in to this.

On the TRV on all except the rad located in the room with the Thermostat. I will say yes and no you need to be sure what your boiler manufacturer says about this. If your boiler has a flow meter built in (it can tell if all the TRVs are set to the off position) then you can fit TRVs to all rads (Thermostat location still needs to be considered so not to have the boiler hunting/ cycling all of the time, as they work against each other.. ) for those that don't have a flow meter there will be a min and max distance from the boiler for a TRV uncontrolled rad that essentially stops you burning out the pump and damaging the heating matrix in the boiler.

My smart home journey started with hair straighteners.... My good wife was terrible for trying to burn the house down! So it all started from there for me. I have tried to stay away from Hubs but in saying that I have just built a zigbee hub on a Rpie so I can connect all compatible devices via that. I am now looking at smart TRVs but I want them to be able to talk to my nest Thermostat and because I have just installed a brand new boiler that is able to accept calls for heat directly from those. Just need to find some.