Freshly brewed with Microsoft Azure and Microsoft 365

Tag: PowerShell

Are you looking for information about PowerShell in Microsoft Azure and Microsoft 365? In this archive you will find all our posts about PowerShell.

Seamless Upgrade of Windows Server on Azure: Best Practices and Step-by-Step Guide

Microsoft Azure supports in-place upgrade to Windows Server 2019 and Windows Server 2022. All data, server roles and settings are taken over in the process. For a successful in-place upgrade there are a few requirements.

This guide shows how to successfully perform a direct upgrade to a newer Windows Server version.

Windows LAPS in Microsoft Intune

Windows LAPS (Local Administrator Password Solution) provides centralized, simple, and secure management of local administrator passwords through Microsoft Intune. Each device receives its own, time-limited local administrator password. Windows LAPS independently manages the administrator passwords in terms of expiration and rotation. The passwords are stored either in Microsoft Entra ID (formerly Azure Active Directory) or in the local Active Directory.

The centralized management of all local administrator passwords simplifies control and monitoring. The time-controlled rotation of passwords significantly reduces their exposure duration. In addition, access to the stored passwords is strictly controlled, which makes unauthorized access more difficult and overall increases the security of the network environment.

Azure AD: Roll over Kerberos decryption key

Users can use the same credentials for on-premises and cloud-based services with Seamless SSO. There is no need for recurring prompts to enter credentials between services. The necessary data are automatically synced between Active Directory and Azure Active Directory.

When configuring Seamless SSO, the computer account “AZUREADSSOACC” is created. For security reasons, the Kerberos encryption key for this account should be rolled over every 30 days.

Reviewing user registrations for multi-factor authentication

To perform a security audit, it is necessary to review the registered multi-factor authentication methods of each user in the Microsoft Tenant. This can help identify and address potential vulnerabilities before they are exploited. Additionally, this evaluation can be used to inform users of potentially more convenient MFA methods they could use instead of their current methods.

Azure AD Connect: Enforcing TLS 1.2

Azure AD Connect no longer supports the following protocols because they are considered insecure.

  • TLS 1.0
  • TLS 1.1
  • 3DES (TLS_RSA_WITH_3DES_EDE_CBC_SHA)

the following services may be affected by the deactivation of the protocols:

  • Azure AD Connect
  • Azure AD-PowerShell
  • Passthrough Authentication Agents (PTA)
  • Applications with Azure AD integration

With TLS 1.2, Azure AD Connect remains executable.

Page 2 of 2

Powered by WordPress & Theme by Anders Norén