Bruce's Blog

Bruce's Blog

Getting started with KQL advanced hunting queries in Microsoft Defender

Getting started with KQL advanced hunting queries in Microsoft Defender

Microsoft Defender advanced hunting is a powerful feature that allows you to proactively hunt for threats across your endpoints and cloud apps using the Kusto Query Language (KQL). KQL is a rich and expressive language that lets you manipulate and analyze data in a specialized schema. In this blog post,

Make working with netsh captures easier with etl2pcapng

Make working with netsh captures easier with etl2pcapng

In one of my prior posts I explained how to convert a .etl packet capture generated by netsh into a .cap file that can be read by WireShark. Two years ago, a far simpler solution was made available called etl2pcapng.exe which can be downloaded from Microsoft's github

Changing screen resolution of Linux VMs on Hyper-V

When you host Linux VMs on Hyper-V you will very quickly find that changing the default screen resolution is not something that can be done easily. For a default install of a Linux desktop, you will be presented with a resolution of 1024 x 768 which while usable isn'

Exchange ApplicationImpersonation != SMTP Impersonation

Exchange ApplicationImpersonation != SMTP Impersonation

Recently I was troubleshooting an issue where a service account was granted the Exchange RBAC ApplicationImpersonation role for another account. The following PowerShell cmdlets were used to configure the impersonation permissions: New-ManagementScope -Name "Generic Mailboxes" -RecipientRestrictionFilter "DisplayName -like 'Generic*'" New-ManagementRoleAssignment -Name "Impersonate Generic

How to verify certificates with openssl

Troubleshooting

How to verify certificates with openssl

From time to time it may be necessary to verify what certificate is being presented by the server that you are connecting to. Sometimes this is a SMTP server or it could be a web server. While there are multiple methods that can be used to validate a certificate presented

The case of the missing Meeting Room

The case of the missing Meeting Room

I was working recently on an issue where a small number of meeting room mailboxes needed to be hidden from the Global Address List in Exchange Online. This is normally accomplished by setting the HiddenFromAddressListsEnabled attribute on the mailbox to $True and within a short period of time it is

Telecommuting with slow internet

Telecommuting with slow internet

While broadband internet has become prevalent across most parts of North America the quality and speeds are not always sufficient. My internet for the past 6+ years has been limited to 5 Mbps down & 512 Kbps upload, thankfully it has since increased to 15 Mbps down & 512 Kbps

Exchange server and EMS startup issues

Exchange server and EMS startup issues

"So I just installed Exchange on my server and I'm unable to connect locally via Exchange Management Shell (EMS) or Exchange Control Panel (ECP). Here is the error that I get in EMS.Do you have any ideas?" This is a question that I get frequently

Useful Commands - Pt 3.

Useful Commands - Pt 3.

In this installment of useful commands we will look at checking SSLBindings, viewing installed software and checking Exchange Transport Rule update times. Command 5 Recently while working on a issue where IIS certificate bindings were getting reset on Exchange. When working on a single server this isn't too

Useful Commands - Pt 2.

Useful Commands - Pt 2.

In this installment of useful commands we will look at monitoring Mailboxes for item counts and size as well as managing wireless LAN profiles. Command #3 Getting a count of how many items are in a mailbox can be accomplished very easily using Exchange PowerShell. Get-MailboxFolderStatistics -Identity testuser | Where-Object {$_.Identity

Ensuring Exchange services are running in a lab

Ensuring Exchange services are running in a lab

In my job having access to a fully functional Exchange environment is highly beneficial as it allows me to test out various things in a non-production environment. Unfortunately this presents a bit of a challenge though as I need to balance out functionality as well as personal cost. Last summer

Working with netsh network traces

Troubleshooting

Working with netsh network traces

In my previous post regarding useful commands I showed how to perform a packet capture between a client machine and a remote machine using IP filters. When the capture is complete you will end up with a .etl file which requires Microsoft Message Analyzer. Collecting a capture: As a refresher

Useful commands

Troubleshooting

Useful commands

Today it occurred to me that there are commands and code snippets that I keep having to hunt down that I should start documenting for myself but also for others who might benefit from having them. Below is what I hope to be the beginning of an ongoing series of

Summer vacation

Summer vacation

This summer as a family we travelled out west to Revelstoke, BC. Along the way we spent a few days in different places along the way. Our first outing was in the Drumheller area, starting with the Atlas coal mine. I would highly recommend if your in the area to

Welcome

Welcome my personal blog. I haven't decided on a theme for this site or how frequently I will post. As a starter you will find a link to my personal weather station. Please stay tuned!