22.10.24

"Some of these settings are hidden or managed by your organization" message showing on Privacy Settings page

 Here is how you fix the problem of "managed" when your PC IS NOT MANAGED!!! (Some are).

1. Open a powershell or cmd windows (With Admin rights)

How to open a cmd or powershell windows. 
- Click start - Find Windows Powershell folder in the application tree.

- RIGHT CLICK on the Windows powershell that only say powershell (Not Powershell ISE, x86).
2. Choose open with admin rights.

3. Copy all these commands. And paste them into the powershell

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f

reg delete "HKCU\Software\Policies" /f

reg delete "HKLM\Software\Microsoft\Policies" /f

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f

reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f

reg delete "HKLM\Software\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f

4. Reboot your system. <---skip this and it does not work

Check the setting that had "managed by" in yellow text. If its gone = fixed and its policies you change with a tool that creates a registry mix that Microsoft yet have to fix.

Defederating GoDaddy 365

SUMMARY AND BACKGROUND

Customers can purchase a Microsoft 365 subscription direct with GoDaddy along with their primary domain. When this occurs, GoDaddy federates this domain and tenant, making it unable to transfer under the CSP program or Direct to Microsoft. Moving and defederating this account has been a major pain point and area of confusion which this blog post addresses. 

In the solutions proposed in this guide you can perform the following:

  • Defederate the tenant without migrating
  • Never have to call GoDaddy
  • Keep user accounts vs deleting them
  • Have no downtime

High level-steps:

A. Prepare your End Users

B. Become a Tenant Admin in GoDaddy

C. Remove Federation with GoDaddy

D. Reset Users Passwords

E. Add a CSP Provider or Move Direct to Microsoft

F. Provision Licensing into the Account

G. Remove GoDaddy as Delegated Admin

H. Cancel GoDaddy Subscription 

Prepare Your End Users

  • Defederating requires users to reset their passwords in order to be able to login to their account. You will need to have a password list to distribute to them or have them provide you passwords beforehand. You could just reset them all to a temporary password after federation and then they can change to whatever they want after.
  • Define a date and time in which you will be defederating. I recommend during non-business hours even though there is no downtime in mail flow with this solution. Provide end users with this information.
  • Since users may run into activation prompts within their office apps and outlook during the license transition, provide them documentation for how to sign back in after the license switch has taken place. For office apps they can simply go to File>Account>Sign Out>Sign In.
  • In outlook, users will be prompted to re-enter their new password after its changed:

Become a Tenant Admin in GoDaddy

When a user sets up a 365 account directly with GoDaddy, they set up the initial user as an “admin” user but this user is redirected to the GoDaddy portal when trying to access the admin tab when going to Office.com. For this reason, we need to gain access to the true Global Admin so that we can perform the necessary powershell scripts to defederate the tenant.

  1. Login to Portal.Azure.com with the admin user that was set up when the account was first created and click on the 3 lines in the top left corner
  2. Click on Azure Active Directory. Then click on Users when the new tabs open up
  3. Here you should see a user label with admin@.onmicrosoft.com Ex:

Click on this user and reset their password. If you already have access to this user, you can disregard this step. 

Once you have copied the temporary password, place it in a notepad and open an incognito window in the browser. In the browser, go to office.com and sign in with that username and temporary password. Establish a new password. With this completed, you now have a user that can run the necessary powershell commands in the future steps.

Remove Federation with GoDaddy

We can use the following PowerShell cmdlets to defederate the tenant. Note that you need to run PowerShell as administrator. 

Write-Host "Checking for MSGraph module..."

$Module = Get-Module -Name "Microsoft.Graph.Identity.DirectoryManagement" -ListAvailable

if ($Module -eq $null) {
    
        Write-Host "MSGraph module not found, installing MSGraph"
        Install-Module -name Microsoft.Graph.Identity.DirectoryManagement
    
    }
Connect-MgGraph -Scopes "Directory.Read.All","Domain.Read.All","Domain.ReadWrite.All","Directory.AccessAsUser.All"
#Enter the Admin credentials from "Become a tenant Admin in GoDaddy"
 
Get-MgDomain
#See that the domain is “federated”#

Update-MgDomain -DomainId "<InsertFederatedDomain>" -Authentication Managed

An example of a DomainId is “tminus365.com”. This would be the domain that was listed as federated that you want to covert to managed.  After this is complete you will get a new commandline. You can run Get-MgDomain again and see that your domain is now “managed”. 

Supporting CMDLET docs:

Reset Users Password

You can do this manually one user at a time if there aren’t many users in the account or you could use a powershell script to bulk update everyone passwords form a CSV file. If you plan to do them manually, then you can simply login to office.com as the admin we derived from section B and now that the tenant is defederated, you will be able to click into the admin tile and access the Users section like you are familiar with. Otherwise, you can connect to Powershell as administrator and run the powershell script below:
##########Connect to MsGraph##########
Write-Host "Checking for MSGraph module..."

$Module = Get-Module -Name "Microsoft.Graph.Users.Actionst" -ListAvailable

if ($Module -eq $null) {
    
        Write-Host "MSGraph module not found, installing MSGraph"
        Install-Module -name Microsoft.Graph.Users.Actions
    
    }
Connect-MgGraph
#Enter the Admin credentials from "Become a tenant Admin in GoDaddy"

############# Define CSV path of Users and Group ##################

$UserPath = Read-Host -Prompt "Enter File Path For CSV list of users"

#####Create CSV template with headers of Userprincipalname and Password#######

Import-Csv -Path $UserPath |%{Update-MgUserPassword -UserId $_.UserPrincipalName –NewPassword $_.Password}

Add a new Provider and Provision Licensing

Now that the tenant is defederated, you can add a CSP provider with their delegated admin link or go direct to Microsoft. 

For CSP: 

Paste the appropriate link in a browser and sign into the tenant with the Global Admin credentials if you are not already logged in. Accept the relationship. After the acceptance, reload the page and you will see a new CSP listed. 

Order licensing for this customer. If you are not changing the subscription, then all you would need to do is provision the same amount of seats as you have today, remove them as delegated admin, and cancel with GoDaddy. There is no other action that would be required. License ownership would transfer and there will be no downtime for users.

If you are changing the subscriptions that are assigned to users (i.e. you are moving them from Business Standard to Business Premium as an example) you will need to perform the following steps:

  1. Order the licensing from CSP
  2. See the licensing provisioned in the 365 Tenant for this customer under Billing>Your Products
  3. Go to Users>Active Users and bulk assign the new licensing from CSP and unassign the licensing from GoDadddy.
  4. Remove GoDaddy as Delegated admin
  5. Cancel the GoDaddy subscription in the GoDaddy admin portal.

For Microsoft Direct:

  1. In the Microsoft Admin Portal, go to Billing>Purchase Services
  2. Purchase the licensing you want to have for your users 
  3. Follow the same steps as CSP to Assign licenses to users if you have changed their subscription type. (i.e. Moving from Business Standard to Business Premium). 

Remove GoDaddy as Delegated Admin and Cancel Subscription

In the 365 Admin Portal

Under Settings>Partner Relationships>Click on GoDaddy and remove their roles:

In GoDaddy, cancel the renewal:

Conclusion

From here, the subscription from GoDaddy will expire at end of term and that is all. You now have a tenant under CSP with all of the typical management functionality you are familiar with. Hope this provided some targeted guidance on defederating a GoDaddy tenant! Please share with the community! 

4.10.22

Excel: Transpose data from rows to columns or vice versa

 

  1. Select the range of data you want to rearrange, including any row or column labels, and press Ctrl+C.

    Note: Ensure that you copy the data to do this, since using the Cut command or Ctrl+X won’t work.

  2. Choose a new location in the worksheet where you want to paste the transposed table, ensuring that there is plenty of room to paste your data. The new table that you paste there will entirely overwrite any data / formatting that’s already there.

    Right-click over the top-left cell of where you want to paste the transposed table, then choose Transpose Tranpose button image.

    Paste Options menu

  3. After rotating the data successfully, you can delete the original table and the data in the new table will remain intact.

22.9.22

Gmail IMAP with Outlook 2016/2019 very slow synching subscribed folders fix

After trial and error with all the settings in Outlook, there is a setting/checkbox in Define Send/Receive Groups --> Edit --> Receive mail items.  There are two radio buttons.  One is for Download complete items including attachments for subscribed folders and the other is for Use the custom behavior defined below.  I chose the second setting and then selected ONLY the Inbox.  This way ALL of the subscribed folders don't get synched when the sync happens.  Back on the main Outlook screen, if a folder is clicked, it shows Synching folder xyz at the bottom of the screen and then updates that folder in real time to see any recent additions or deletions in the folder.

On this screen I also unchecked Get folder unread count for subscribed folders since that was recommended in a lot of search results I found.  I don't know how much this impacts the speed.

The default setting when adding a new IMAP email account is for the Download complete items including attachments for subscribed folders to be ON.  For smaller mailboxes or ones without too many folders, maybe this is OK, but as the mailbox grows, it adds considerable time to the sync.

With these settings, when clicking Send/Receive All Folders, the sync happens almost instantaneously.

Subscribe to: Posts (Atom)