u/Any-Promotion3744

In Entra, we have a pre-existing enterprise app for SAML authentication.

We are trying to allow a new user to log into that app but it is not working.

Looking at the logs, it seems to pass all of the conditional access policies.

The logs say it fails because the user isn't allowed to use the app.

When I go to the Enterprise app and look in users and groups, that user is listed (directly, not part of a group).

Any idea how to troubleshoot this issue?

I looked at the settings of the web based app and everything is set up like other users. I looked at the attributes and it is referencing user principal name and that user account has that in the same style as all other users.

I would like to monitor the VMs on our Hyper-V servers using Splunk but unsure how.

I see that there was an add-on for Hyper-V at one time but it is no longer supported.

Can I just add items to the inputs.conf file within the UF?

I have tried a few but none seem to be picking up.

What options are there?

Event logs that are associated with Hyper-V?

Powershell scripts?

Winhostmon that can give stats on the Guest VMs?

Which dashboards in Splunk will show the info ingested? ITSI?

Our heavy forwarder is in our DMZ and I was thinking about installing DBConnect on it so it can pull audit logs from a table in a SQL database on our internal network.

How safe is that set up?

I know the password is encrypted. I can use the firewall to only allow the one port to connect the HF to SQL Server. I can choose long password and the account has lockout policies. The SQL Server login will only allow select permission to a single table. All the standard stuff.

Since remote users with UF will connect to HF, I can't restrict connections to the HF by ip.

Is there any risk to the internal database?

We have a few Ubuntu servers that we SSH into.

Instead of using local accounts, I want to change it so we use our Windows logon credentials instead. I would also like to use Google Authenticator as MFA (I thought about Entra Id but don't want to open a browser for the MFA portion).

Has anyone set this up before?

I opened a ticket with Ubuntu but they haven't help much.

I followed an article on using SSSD with LDAP and Kerberos but can't get it to work.

https://ubuntu.com/server/docs/how-to/sssd/with-ldap-and-kerberos/

I can get the kerberos ticket but the getent passwd, id and sudo login commands won't work.

I checked firewall logs and see ssl traffic over port 636 that is being allowed. DNS resolution is working. I added the cert chain for our internal CA, just in case.

Running out of ideas. Log files aren't helping much. LDAP error saying offline but the firewall isn't blocking anything. Maybe trying to use TLS and SSL? I added LDAP authentication in the SSSD config file but no change.

Every once in awhile, our HR and Finance dept need to send an email to all employees.

The issue we have is that we have more 1,500 employees, all using Exchange online in several tenants.

Microsoft has a bulk email limit that we run into.

What is the work around?

I see options such as High Volume Email for M365 but since many of the emails go to a different tenant, will that work? And how would the end user compose and send the email?

I also see an option using Azure Communication Services but wouldn't that require programming?

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

Is it possible to set up Ubuntu so that SSH connections to an onprem Ubuntu VM support SSO using Entra ID?

I see articles describing it for Ubuntu with the Desktop environment.

I also see articles for SSH if Ubuntu is hosted in Azure.

In addition, I see Ubuntu SSH secured using Google Authenticator.

Google Authenticator isn't a bad option but Entra ID would make audits easier.

We currently run Zabbix at our main site but would like to run Zabbix proxy at a remote site.

Zabbix website has info on installing it but I have a few general questions.

How do you point the proxy server to the Zabbix server? Or do you just add the proxy on the Zabbix server and it pulls the info from it?

Is there any web interface or configuration on the proxy itself?

or do you install a zabbix client at the endpoint, point it to the ip of the proxy, add the host to the main Zabbix server and select the proxy when configuring the host?

We have the zabbix agent installed on various Windows servers and all but one are reporting info fine.

One server is not showing CPU information and I am not sure why. Items like mem usage and storage space are reporting but CPU util is 0% all the time. The graph is just a straight green line at 0.

What could cause this?

I restarted the agent but no change. I checked the firewall logs and traffic is being allowed from server to zabbix.

One of our company sites uses Veeam v12 to backup VMs hosted on Windows Datacenter 2025. That Windows Datacenter is not domain joined.

After installing the windows patch KB5094125, backups stopped working. From what I was told from backup admin onsite, the issue is using the local admin account for the backups. The solution is cert based authentication or domain join the server and use domain authentication. I was also told that Veeam v12 doesn't support cert based authentication.

Has anyone else run into this issue?

If so, is cert based authentication the best solution? How does cert based authentication effect app aware backups?

How hard is it to upgrade from v12 to v13? There will be a big push to get this fixed by tomorrow. Is that reasonable?

Has anyone seen a Windows Server where the default permissions on the windows temp folder has changed?

I inherited a Windows Server from a company we acquired and I get errors trying to install or uninstall software on it. Each time the errors were caused by the permissions on the Windows temp folder. I compared the permissions to another server and the default accounts (trusted installer, etc) had read only permissions instead of write.

I am just curious what could have caused it? I guess an admin could have done it purposefully but why?

Has anyone run into issues with opening PDF files that were labeled and encrypted using MS Purview?

We have had this set up for quite awhile without issues but within the last few weeks, we have had issues opening files.

Testing:

- installed latest version of Adobe Reader

- opened file labeled and encrypted using MS Purview

- Prompted to enter email address and afterwards Microsoft MFA prompt

- for a quick sec you see what looks like an error page but afterwards you see a Microsoft page with my email address that says Need admin approval. Adobe Acrobat Reader. Adobe Acrobat Reader needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

If you click on the link Return to the application without granting consent it will just open the file as normal.

Is this expected behavior? If not, what needs to be changed?

Is there a windows equivalent to Arpwatch that doesn't cost a ton?

Arpwatch is free but my manager really hates linux.

I find it useful receiving alerts when a new mac address is detected on the network.

I think ManageEngine OpUtils Professional can do it but it would cost a lot.