HPlum78

So you should probably set up a server just for the WAP service to sit on, or at least that's what I would recommend and that's if you are going to allow access to your application from outside of your network. You will need a Service communications cert if you are going to allow access to your services from outside of your org you will need to get yourself an EV cert from your cert supplier.

the AD FS service is what your internal clients will connect to and what that is saying is that you cannot have the proxy service installed on the same server (the WAP proxy service for AD FS is essentially what your external clients would connect to) This is the reason your are seeing that error you have highlighted above:- Here is the best practise guide:- https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs

Setup some health agents the other day for logging access to various application:- 100k sign-ins in less than 24 hrs! not bad going.....

My initial thought was around spectre/ meltdown patching, have you applied the relevant updates to your SQL environment? has this also been done on the hyper v hosts and VMs? as well as being enabled?

Yeah I am with @DavidYoung like I said 5 lines off automation :-P

Sound like a DNS Scavenging issue. Some useful info here https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc757041(v=ws.10)

Notes rather than a PS command(s) first is the initial post from @DaveP the Get-ADComputer -Filter * -Properties * you should really try not to run any command with a -Filter * and -Properties * it is just bad (ask Don Jones for his thoughts on running that very command). It can be scoped with little effort as all the details are in the command and would look like Get-ADComputer -Filter * -Properties Name, LastLogonDate | Sort LastLogonDate | FT Name, LastLogonDate -Autosize | Out-File C:\ComputerLastLogonDate.txt next is for @Latham that scares me and that's all am I going to say on that!

My first thought would be PS:- $UserHomeFldrAD = Get-ADUser -Filter * -Properties HomeDirectory | ?{$_.HomeDirectory -ne $null} | select HomeDirectory $UserHomeFldrShare = Get-ChildItem -Path \\dev.domain.ac.uk\root\staff\home\a\ -Directory | select FullName Compare-Object $UserHomeFldrAD $UserHomeFldrShare To be honest its about 5 more lines away from being an automated script......

Movie files don't dedupe very well you can run the following Measure-DedupFileMetadata this will give you an indication of what you can get back by enabling dedupe on a volume. oh and encrypted files...

Don't think of files as files they are chunks of data, the file that the users sees is just a list of pointers to those chunks. Look at the second link it gives an animated view of what happens when files are on a deduped volume.

In a little more depth - The data is broken into chunks each chunk is looked at to identify duplicate chunks and then only one chunk is maintained and compressed. Any redundant chunks are replaced with a reference to a single copy of the chunk and each file is replaced with a reparse point that references its data chunks. You essentially end up with a chunk store, optimized files, un-optimized files and the free space due to the chuck data size and the compression used. If a user edits/ makes changes their copy of the file its only the delta that is stored not a complete copy of the original file. This will save you space your backup solution will need to be able to backup a deduplicated volume mind. In fact here is some useful info - https://msdn.microsoft.com/en-us/library/hh769303(v=vs.85).aspx and even more detail here https://docs.microsoft.com/en-us/windows-server/storage/data-deduplication/understand

My first thought on this is not to use a DC for your Root CA, I would try to keep the root CA offline and only power it up when required. Some useful info here https://social.technet.microsoft.com/wiki/contents/articles/2900.offline-root-certification-authority-ca.aspx and here https://technet.microsoft.com/en-us/library/cc700804.aspx Above are some screen grabs of a chalk and talk with MS I had recently.

What we are talking about is identity management, I would say that having a shared account no matter how restrictive is not cutting it for auditing and accountability reasons unless you are keeping a detailed log of the actual soft mushy bit (the individual) that is being given the shared account details and in that log the times and dates that those have had access to the account. If you are then surly its easier to create an account? On that note it would be wise to use identity types, so have a identity of supply teacher/ work experience/ staff..... and then have groups, leverage the power of AD and scripts to manage what access is granted to those identities indeed a lot of the leg work for managing access should be based on what is in your golden sources for Staff/ Student/ Externals data, the lion share of your groups can be built and based on whats in your HR/ Staff solutions. Then all you are doing as IT is assigning the correct permissions to those groups. If you are using cloudy based offerings from MS you can filter out users/ groups that should not be synced to your tenant but you could also allow the sync and use other methods of applying the required license for the services an identity type should have access to (a script can do this, do not sit in front of the portal assigning licenses to your users!) Anyhow I can talk identity management and the whole life cycle for an identity all day long.

Ask the NHS about running OS's that are no longer supported!?

https://gallery.technet.microsoft.com/scriptcenter/Remove-UserProfile-Remove-96e27a3b

Passwords will not be a thing, watch this space..... https://fidoalliance.org/about/overview/ FIDO Alliance and W3C Achieve Major Standards Milestone in Global Effort Towards Simpler, Stronger Authentication on the Web

@unixman_again minds and all that!

Just for info https://www.theregister.co.uk/2018/04/26/microsoft_office_365_spam_outage/

One other thought have you ran that netdom command on all of your DC's. Do they all report the same? You may have to break out ADSI edit here.....

Here is a good GUI tool https://www.microsoft.com/en-gb/download/details.aspx?id=30005

https://technet.microsoft.com/en-us/library/aa998249(v=exchg.80).aspx https://technet.microsoft.com/en-us/library/aa998231(v=exchg.80).aspx These may help.

I am guessing that you have had a look into the DB errors and run through some diag with Eseutil?

You can have multiple edb's on the same disk, and the clients will not need any config the users may get prompted telling them to restart the client.

Nothing on the health dashboards for O365/ Azure, I am able to log in without issue.

@psydii I am only messing I knew what you was getting at :-P yeah I had assumed that two disks are being used for the OS/ some other purpose but its unclear so I have just guessed and made assumptions thus far, but we are all doing that as we do not have info on RAM/ Drive/ CPU config and if its an application server as well as an SQL server......