HPlum78

See here, MS say here that younger student should be password only... https://learn.microsoft.com/en-us/microsoft-365/education/deploy/design-credential-authentication-strategies Also this outlines security defaults and when/ what age a tenant would be for them to roll it out: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?WT.mc_id=Portal-Microsoft_AAD_IAM

So there is no single answer to this as it depends on a lot of factors, there has been a lot of movement in this area in recent years and months (in some cases). Here is the best place to start: https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/overview This outlines all of the options that are available in this area, and links of to those options to give more detail. One that maybe useful here is the Multitenant organization stuff that has been GA'd in the past week or so (not that i have had a chance to look at it in any detail) here are some extra resources on just that: https://redmondmag.com/Articles/2024/04/25/Multi-Tenant-Organization-Hooks-Released-for-Microsoft-365.aspx https://techcommunity.microsoft.com/t5/microsoft-entra-blog/collaborate-across-m365-tenants-with-entra-id-multi-tenant/ba-p/4120309 As for if an actual AD forest/ domain trust is worth while well again it depends on what you are trying to achieve and if you have resources such as a file share on physical servers that you want to make available to users across each forest/ domain (depending on the trust configuration), I am not going to reinvent the wheel here as again it really depends on what you are trying to achieve in this space. This is the gospel on this: https://learn.microsoft.com/en-us/entra/identity/domain-services/concepts-forest-trust High level I want to connect two Tenants/ Forests and Domains together is easy to say but the detail is in the devil here!

This mail address is owned by the organisation then I would think hard about just blindly forwarding emails on to an external address, for two reasons firstly the external sender is thinking that they are contacting someone within your organisation and secondly you need to be sure that any communications that are taking place are able to be followed (not saying anything untoward would go on but...). So I would also be forwarding those incoming mails to a moderated mailbox that the organisation owns along with an automatic reply stating that mail to the address is being automatically forwarded to an external address and if your mail is regarding blah blah... (you get the picture)

Just as a side note there is a limit to the number of connections to a mailbox / shared mailbox, I have seen issues with my own eyes if you go over 25 concurrent connections.

Yeah Locktite Threadlocker is the what to use, go blue unless you want to be heating the screws up to ~ 250c to get them out if it comes to removing them in the future.

This is also affecting a number of schools around Leicestershire an all, my guess is that their is some shard service and because the council has taken some action its had an impact on those schools as well. All the schools in the Embrace Trust seem to be impacted: https://www.embracemat.org/ All of the individual websites have a banner on them that refer to ongoing IT issues.

I take it that md in you post is really mx? and yeah if your mail is hosted in M365/ Google you will not be able to leverage PTR for validation in an SPF record, as a side note SPF records are limited to 10 DNS lookups so be mindful of that limitation as well (only mention this as you say "V=spf1 a md ptr IP4:12.14.10.10/20 ip4:10.20.30.10 and list goes on"). Here is some useful information around SPF (site is also good for DKIM and DMARC): https://dmarcian.com/spf-syntax-table/

There are some setting in Exchange that govern how mail is sent to a single destination like exchange online or while using Exchange in a hybrid setup and relaying messages through on-prem exchange: SmtpConnectorQueueMessageCountThresholdForConcurrentConnections - set in the EdgeTransport.exe.config file the default is something I cannot remember but you can set this to 2 from memory (I will let you look it up as you need to add a line to that file to override the default) changing this essentually puts less messages on the queue as Exchange will create more parallel queues. MaxPerDomainOutboundConnections - again not sure of the default but you can increase this using set-transportservice cmlet and setting it to a higher value (one that I look after is set to 40 and i bet that I would have taken that from some documentation) and as @chaplic says: https://techcommunity.microsoft.com/t5/exchange-team-blog/throttling-and-blocking-email-from-persistently-vulnerable/ba-p/3815328 Timeline is here: https://techcommunity.microsoft.com/t5/exchange-team-blog/update-on-transport-enforcement-system-in-exchange-online/ba-p/3827774 But unless you are running Ex2013 this should not be a thing YET! Oh and you lot made me look here is a link to what I outlined above! https://learn.microsoft.com/en-us/exchange/troubleshoot/mailflow/email-stuck-queues

And that being said the OP is talking about GA Role and MS are not one of those companies that have that licensing structure so in this case it is not a thing (and for those that still do that for Admin staff then I would be having a conversation and still would not be convinced! as traceability is more important than cost) I have made a statement there not fully knowing how this is architected so I don't know if the OP is saying that each of the 50 schools has it's own tenant with a GA in each rather than each admin having a priv account in each tenant (if this is the case and they are all under the same umbrella trust then this should be looked at) or they are all in the same tenant but even with all that said sharing a GA account with multiple should not be a thing in my mind.

I cannot tell what is happening here, is this someone just poking a bear or have I hit my head and woke up in the 00's? Sharing accounts let alone ones with any kind of Admin role(s) is a no (and there is no exceptions here!). Stop that and do anything else!

So you could take my tagging example above, tag the message as student and then have a subsequent rule that looks if the user is in a synced group that is set to drop the mail or forward it to a moderation mailbox. This way you can block and unblock from your local AD group so not having to login to EOL/ each time you want to manage that group /rule. You can also script it so that when a user is added to the group a sync is kicked off (if you are still using Entra AD Sync) and an email is sent to the student / head of year/ parents and such likes.

And here is a book that I have mentioned on occasion that is worth reading: How to Find a Wolf in Siberia: or, How to Troubleshoot Almost Anything https://www.amazon.co.uk/How-Find-Wolf-Siberia-Troubleshoot/dp/1720156409 happy fault finding...

If you split your mail domains in to something like [email protected] and have staff as [email protected]? (or however your domain is configured) its an inbox rule on the staff side, if not you can setup a mail flow rule to tag mails from students in the header of the message. So something along the lines of Apply this rule if - The Sender - Is a member of this group... Do the following Modify the message properties - set a message header - SchoolName, Value: Student. Then again the staff have the ability to put a rule in place for messages with that in the header. These in my mind are safer than just drop all mail on the floor, or having someone have to release mail from students. Also like Pete says, there should be consequences for those unable to be sensible. Using technology as the judge, jury and executioner is not the way to go and that way madness lies.

MS do support in-place OS upgrades for Domain Controllers although over the years they have lets say flipped and flopped on the best approach for this, the current documentation that I can find here https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers guides you in the way of introducing the new OS version and then migrating to the newly deployed OS. Now that Broadcom has acquired VMware I am going to bet with the licensing changes that will come most schools will not have the money to run VMware when it comes to renewal (but hay that's the Broadcom way!) so core install on the new server and Hyper-V may well be the way... that said I don't know the spec of the new server and what the architecture needs to look like.

Wow for an older Domain that's not burned through the RID pool at all... our domain is no where near 23 years old and we have burned through more than you have, that said our Domain is clearly way busier than most...

I dont know how busy your domain is but interested to see how much of the RID pool is left? Dcdiag.exe /TEST:RidManager /v | find /i "Available RID Pool for the Domain" if your not running that from a DC then you need to add the /s: Dcdiag.exe /s: /TEST:RidManager /v | find /i "Available RID Pool for the Domain" We do in-place now the migration was to get us out of a very unique problem.... and here is the reason we ended up in that very unique position: https://www.oreilly.com/library/view/active-directory-second/0596004664/pr01s05.html

MS recommend that its set to 180 days, interesting comment on the age of your domain 23 years! we here had the oldest Domain that MS knew of and was built on pre production server 2000 (I think MS said it was 2 months older than their own domain) we had to get out of band schema updates. We migrated a fair few years ago now to a new domain built on server 2008 as none of us wanted to carry on with the out of band schema updates!

Fair enough like I said was unsure of the use so clearly practical.

My first thought is why you think that you need to be in the team(s) at all? Would like to see your service wrapper for this before I could comment any further.

Have not been keeping up, so still not able to connect? what is this server doing? I will use a Jeff Snover saying here "Cattle not Pets" and that's to say if it's poorly take it out back and put a bullet in its head... I know that we have a desire to root cause every issue and if it was more than one server (VM) I would be saying lets do just that, but for one server just stand up a new one and move on that's the smarter way to deal with these kind of issues. (I have made a lot of assumptions here, so it may not be as simple as that sounds).

Bit off topic, but what would be really useful in group write back is the ability to use it to write back into Builtin Local groups. Then we would be able to leverage PIM in EntraID and have the members of these groups updated based on those groups and requests.

Are you able to remote connect to the Event logs on it? (or look at the logs in a central log store) might be able to get a better clue from those...

Just stopping the services on the server will just cause you more/ different issues and you need to clean the components up properly.

No the one in staging mode will not be exporting, it will (should) be syncing.

What is the sync service saying on the servers? only one should be (will be) exporting to the tenant connector (the one in staging mode will only be doing the delta's), also not sure that running v1.x and 2.x is supported but not looked it up.