Microsoft

OneDrive PC Folder Backup and Desktop Shortcut Duplicates

PC Folder Backup (which was previously known as Known Folder Redirect) is a rather useful feature that’s been added into OneDrive. It allows the redirection of users Desktop, Documents and Pictures folder for a user to live in a folder in OneDrive under the user’s profile (e.g. C:\Users\bgates\OneDrive – Contoso\Desktop ). This in turn causes OneDrive to automatically sync the data to the user’s OneDrive cloud based storage, and works a bit like having a roaming profile, without the many issues that plague actual roaming profiles.

Stephen Rose wrote a great post on how it all works with screenshots, check that out if you’re still looking at testing this solution.

An issue that I’ve come across while rolling out, was the duplication of desktop shortcuts. The problem is that OneDrive won’t match files that are ‘identical’ unless they’re Office documents; a local file called test.lnk on your desktop, and another file in OneDrive in the Desktop folder called test.lnk from a previous sync on a different computer will result in the new one being called test – Copy.lnk, and the older one synced back – you now have a test.lnk and test – Copy.lnk file on your desktop.

This wouldn’t normally happen when you log onto a computer for the first time, but many companies deploy shortcuts (usually through Group Policy). What happens is, you log onto a PC for the first time, Group Policy deploys the shortcuts to the desktop you need, then OneDrive kicks in and starts its PC Folder Backup process. I had 4 copies of each shortcut we were deploying before I noticed the mess that my desktop had become!

I’m definitely not alone in this problem. People on answers.microsoft.com were complaining about it, and there’s a user voice idea with 212 votes at the time of posting on this same problem.

I asked around and was determined to work out a reasonable solution:

You can’t just block .lnk files from OneDrive without causing end user errors for everyone trying to automatically sync those.

You can run a script at startup to delete any “* – Copy*.lnk” file on the user’s desktop after logon, but that’s really a hack solution and an absolute last resort.

You can use Group Policy Preferences to delete any “* – Copy*.lnk” from the user’s desktop which is slightly better than a script, but it won’t run at the right time – the user will see duplicates for ~90 minutes after logging in before they get cleaned up, each time they log onto a new PC (which shouldn’t happen THAT often).

You can’t deploy shortcuts once through Group Policy, because the setting to ‘Run once and don’t reapply’ is a per user/per PC setting (unless you have roaming profiles, but you can’t do roaming profiles and PC Folder Backup at the same time unless the folders are excluded from one or the other) – so each time a user logs onto a PC for the first time, it’ll still trigger the shortcut deploys.

The best solution I came up with (and by that, I mean I asked in the Windows Admins Discord and someone said ‘just do it this way’), was to use the Public desktop rather than the user’s desktop.

The Public desktop (located by default in C:\Users\Public\Desktop) are files that everyone who logs onto a PC gets, and because they’re not part of the actual user’s desktop, they’re untouched by PC Folder Backup.

Because I had live shortcuts to clean up too, I first created and tested deleting copies as mentioned above through Group Policy Preferences. I then:

  • Replaced any global shortcut a user needed to %CommonDesktopDir%\file.lnk – not in logged-on user’s context
  • Deleted any existing shortcut deployed from %DesktopDir%\file.lnk in the logged-on user’s context
  • Replaced any shortcut a specific user group needed to %CommonDesktopDir%\file.lnk – not in logged-on user’s context, with item level targeting
  • Deleted any shortcut that was only being deployed to a specific user group, but out of the scope of the above item level targeting from %CommonDesktopDir%\file.lnk

This slightly messy but workable method means the shortcuts will get juggled around if only certain users should see them, and they’ll all live in the Public folder.

I’ll update this if things change with PC Folder Backup, but for the time being this lets the project continue, and users won’t be impacted with shortcut duplicates.

How to Automate FTP Uploads with PSFTP

Many vendors and companies still transfer data via FTP. It could be transactional data, user data, or a myriad of other things. Hopefully they’re using SFTP or FTPS (which are different ways of achieving secure FTP transmissions) rather than FTP, for similar data transfer security reasons on HTTP vs HTTPS.

A common use case I come across, is user management. Uploading basic user data like names, email addresses and employee numbers so a vendor can update records in their cloud based product for your staff to use. If you’re using a cloud service and don’t have user automation sorted – then ask them how you can achieve it – it’s much more enjoyable to set up automation, than do repeating mindless tasks.

Assuming you have details on what to send and where, you’ll need to work out how to automate FTP uploads. Note that this is a much less secure method – you’re saving the password in plain text. Alternatives do exist such as what’s demonstrated in this YouTube video below using a Public Key and Private Key Pair, but require the ability to create a .ssh folder on the FTP server. I’d rather do it this way:

Getting the other end to do what you want isn’t always possible in the real world, so you need to consider the risks if you need to save a password in plain text somewhere (saved in a Scheduled Task as you’ll see below). They’re obtainable if someone can get onto the server (or a backup of the server, or connect to Task Scheduler remotely), which should be heavily locked down anyway, and the password for this might be saved in a password database those same staff members have access to anyway.

If those credentials were obtained by another party, what could they do? If the FTP site cleans up the data instantly that’s uploaded, then they could potentially upload whatever they wanted. Look at a worst case and decide if you’re comfortable with having the account credentials saved this way, or need to find another approach.

Again, consider these risks, try to implement the most secure method you can, and raise any concerns with management/your boss. Assuming this is a scenario where you can’t do it more securely:

Instructions

First, you’ll need software. I use PSFTP – part of PuTTY, a free and open source solution. Download the full installer, as there’s a few components of PuTTY we need.

Next, you’ll need the login details of the FTP site:
Host: e.g. sftp.contoso.com
Username
Password

Open a Command Prompt, navigate to the location that contains sftp.exe and type:

sftp username@host -pw password

You’ll probably first be prompted with a message saying ‘The server’s host key is not cached in the registry’ with some details on the fingerprint. If you’re sure you’re connecting to the right server, you can say ‘y’ to ‘Store key in cache’. Once saved, you won’t be prompted for this on the same computer/user.

At this stage, we’re just making sure you can sign in and get past the key stage. If this works, you’ll now need to work on a batch file to pass through all the commands you want to do.

In this example, I’ll be going into a folder and uploading a file. Open notepad and type your commands, which you can first test in your active connection:

cd inbound
mput filename.csv
quit

Pretty simple stuff. Save your notepad file (we’ll call it batchfile.txt), and if you haven’t already disconnected from your SFTP session, do so with the ‘quit’ command.

Connect back to the SFTP site, but this time we’ll specify the batch file to rin after connecting:

sftp username@host -pw password -b batchfile.txt -batch

I’ve also added -batch on the end to specify it’s an automated batch job – this will cause SFTP to exit on a prompt, rather than be running forever waiting for an input. You can try without -batch first if you want to test and see the prompts, but you’ll need to run this command manually rather than triggering from a Scheduled Task.

If this works as expected, great! You can automate the SFTP task – the final step is to schedule it to run, which I usually use the native Scheduled Tasks in Windows to do.

If your scheduled task is running under a different account than what you tested with, then you’ll need to do that initial host key saving – easiest way is to launch Command Prompt as that user, and connect to the FTP site.

Service health dashboard email notifications GA

Email alerts for Microsoft 365 Service Health incidents is now Generally Available! (as fellow MVP Greig Sheridan pointed out, although it’s GA, it’s gradually rolling out from December 2019 to March 2020 – but I already have this in my live tenant) In case you missed this one, there’s now an easy way to configure email alerts to go out when there’s an outage of some sort in the Microsoft 365 space.

Personally I’m used to checking out the portal once I hear about a complaint and seeing what might be broken. Instead, I’ll now see emails to keep across what’s going on in the Microsoft world, as well as have a ticket raised via email to helpdesk, so any potential user affecting outages are identified earlier in the troubleshooting process.

The advisory is MC196504 for those who want to read about it in the ‘Microsoft 365 admin center Message center’, but all you need to do to enable it is:

From the new Microsoft 365 admin center, go to Health > Service Health. Under the All services tab, click the Preferences button:

This will pop out a side window:

From this page, you can enter up to 2 email addresses – so if you want it to go to more than 2 recipients, use a distribution group. You can choose the services you want to receive alerts about (all are ticked by default), and as it will advise when saving, it may take up to 8 hours to apply.

This one’s a pretty simple feature, but one I’m very glad to see. Set it up for yourself today!

The Current State of Edgium

Update 16th Jan 2020: The New Edge is now live! You can download from here” https://www.microsoft.com/en-us/edge?form=MO12GC&OCID=MO12GC and more details here: https://blogs.windows.com/windowsexperience/2020/01/15/new-year-new-browser-the-new-microsoft-edge-is-out-of-preview-and-now-available-for-download/

Original Article:

“Edgium” or ‘The next version of Microsoft Edge’ is Microsoft’s rebuild of the Microsoft Edge browser, built on the open-source Chromium platform. I recently decided to start using it and see the current state of Edgium (which I’ll call it that for the rest of this post for clarification’s sake).

Microsoft Edge was met with a lot of resistance when launched – and although there were reasonable claims about it being the fastest browser around, there were a lot of features lacking and sites that wouldn’t work with it.

Here’s why Microsoft decided to abandon Edge as it is. It’s interesting to note that on mobile devices, they were already using an open-source foundation from the start, and for the desktop version there’s a focus on making sure all web standards are adopted.

You can download Microsoft Edge Beta right now and install it in parallel with the old Edge – or you can install the build that replaces old Edge direct from Microsoft here (keep in mind you can’t uninstall from this). The Beta is good if you want to have a play around before committing.

The expirience I’ve had so far is rock solid. There are some ways where it loosk and feels like Chrome, and others where it’s more Edgey. The import options (for me at least) just worked – I could import everything from browser history, favorites and saved passwords and pick which Chrome profile I wanted to import it from.

At the Edgium end, I’ve then created multiple profiles and imported each relevant profile across to match the experience I was having on Chrome. Multiple profiles is great when you’re doing things in Microsoft 365 and have multiple accounts (user and admin) and different tenants to access.

Also, Edgium fully supports Chrome extensions. Old Edge did have extensions too, but very few. Edgium will prompt, asking if you want to allow 3rd party extensions, and then you add them just like you would in Chrome:

The settings area of Edgium in my opinion, is much better than Chrome:

Google Chrome Settings Page
Microsoft Edgium Settings Page

There’s also already Group Policy ADM/ADMX files ready to use which gives IT Administrators a lot of control over the browser, which is worth putting in place and going through before you even consider piloting Edgium.

For IT Admins, also check out the security baseline you should use, currently in draft form.

Edgium also has an Internet Explorer mode, so hopefully this can end up with Edgium replacing Chrome, Internet Explorer and Old Edge with a single browser – it might take a while of course, but for a company looking to control the user experience a bit more and not manage lots of browsers, it’s looking hopeful.

At the time of writing there’s no announced release date of Edgium, but it’s expected to completely replace Edge – so it’s worth getting used to it early. I’m sure there will be some changes between here and launch, but it should all be small changes.

Personally I’ve made the move from Chrome to Edge and haven’t hit an issue yet. Old Edge is on the way out, and overall this seems to be a positive decision for all involved. Let’s see how

Managing Unified Messaging Users in Exchange Online

error
The phone number you entered has already been registered by someone else.

This is the standard error you’ll see in the Exchange admin center when trying to enable Unified Messaging on an extension that already has it enabled.

When a user departs you’d expect that when you change the user mailbox to a shared mailbox and drop the licensing, Unified Messaging should go. However, in Exchange Online the mailbox will still be Unified Messaging (UM) enabled, and hang onto the extension it had.

You probably won’t even notice this until you go to enable UM on another mailbox using that same extension, which leads to the error at the top of this article.

The first challenge is to find the Shared Mailbox that is holding onto the extension. After connecting to Exchange Online in PowerShell, you can run this command:

get-ummailbox | select name, phonenumber | out-gridview

This will show a nice gridview of all your mailboxes and what UM extension they have. You can search/filter this view to find the cuplrit.

If you want to see which of your mailboxes are Shared and have UM enabled, run this command:

Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize:Unlimited -filter {umenabled -eq "true"}

Knowing this mailbox, you’d expect it should be easy to turn off UM. This wouldn’t be too much of a problem if you could just disable UM like you can on a normal mailbox, but in Exchange admin center this isn’t an option at all when it’s a shared mailbox.

Trying to disable UM via PowerShell with the ‘Disable-UMMailbox’ command also won’t work, as you’ll get a license error:

License validation error: the action 'Disable-UMMailbox', 'Identity', can't be performed on the user 'Test User'
 with license 'BPOS_S_Standard'.
     + CategoryInfo          : NotSpecified: (:) [Disable-UMMailbox], RuleValidationException
     + FullyQualifiedErrorId : [Server=SYXPR01MB1901,RequestId=dfc62192-8270-4a65-b582-c7f327d6e7e2,TimeStamp=15/10/201
    9 6:24:33 AM] [FailureCategory=Cmdlet-RuleValidationException] DDB44050,Microsoft.Exchange.Management.Tasks.UM.Dis
   ableUMMailbox
     + PSComputerName        : outlook.office365.com

To fix this, you could use the Exchange admin center GUI along with the Microsoft 365 Portal, but it’s easier to run all the steps required via PowerShell:

First apply a license to the shared mailbox account that includes Exchange Online. You can see what licenses are available to you with this PowerShell command used by the MsolService cmdlet:

 Get-MsolAccountSku

Then, apply a license with this command against the shared mailbox and the AccountSkuID from the previous command:

Set-MsolUserLicense -UserPrincipalName "UPN OF SHARED MAILBOX" -AddLicenses "tenant:licensename"

Once applied, you’ll then need to change the mailbox to a Regular mailbox rather than Shared:

Set-Mailbox "UPN OF SHARED MAILBOX" -Type Regular

After a while, Unified Messaging may drop off by itself if you allocated a license that doesn’t support it (such as Exchange Online Plan 1 or Exchange Online Kiosk, or you can force it off with this command:

Disable-UMMailbox -Identity  "UPN OF SHARED MAILBOX"

Finally you can now enable UM on that other mailbox that was getting the error on the extension being in use. Easily done via the Exchange admin center GUI.

Two last steps are then to reverse what you did – take the license away from the shared mailbox, and make it a shared mailbox again:

Set-MsolUserLicense -UserPrincipalName "UPN OF SHARED MAILBOX" -RemoveLicenses "tenant:licensename"

Set-Mailbox "UPN OF SHARED MAILBOX" -Type Shared