Knowledge Base for IT Problems.

Top 10 Microsoft 365 Security Misconfigurations Found in Enterprise Audits (And How to Fix Them)

2026-09-01T18:00:42.077+05:30

Introduction

Microsoft 365 has become the foundation of modern workplace collaboration. Organizations rely on it for email, identity management, document storage, communication, and productivity. However, during security assessments and enterprise audits, many organizations discover that their biggest vulnerabilities are not sophisticated cyberattacks but simple configuration mistakes.

These misconfigurations often leave organizations exposed to account compromise, ransomware, data leakage, privilege escalation, and compliance violations.

In this article, we'll explore the 15 most common Microsoft 365 security misconfigurations found during enterprise audits and provide actionable steps to fix them.

1. Multi-Factor Authentication (MFA) Not Enforced for All Users

Risk

Attackers can easily compromise accounts using stolen credentials from phishing attacks or credential dumps.

Common Finding

MFA is enabled only for administrators or a subset of users.

Fix

Enforce MFA for all users.
Use Conditional Access policies instead of legacy per-user MFA.
Require phishing-resistant authentication where possible.

Recommended: Microsoft Authenticator or FIDO2 Security Keys.

2. Legacy Authentication Still Enabled

Risk

Protocols such as POP3, IMAP, SMTP AUTH, and older Office clients bypass modern authentication controls.

Common Finding

Organizations disable MFA but leave legacy protocols accessible.

Fix

Block legacy authentication.
Monitor sign-in logs for legacy protocol usage.
Migrate affected applications to Modern Authentication.

3. Excessive Global Administrators

Risk

Every Global Administrator account represents a potential organization-wide compromise.

Common Finding

Organizations often have 10-20 Global Admins when only 2-4 are required.

Fix

Follow least privilege principles.
Use Privileged Identity Management (PIM).
Implement Just-In-Time (JIT) administration.

4. No Conditional Access Policies

Risk

Users can sign in from unmanaged devices, suspicious locations, and risky sessions.

Common Finding

Conditional Access is licensed but not configured.

Fix

Create policies to:

Require MFA
Block legacy authentication
Restrict risky sign-ins
Require compliant devices
Restrict administrative access

5. Self-Service Password Reset Not Configured

Risk

Users create helpdesk dependency and weak password practices.

Common Finding

SSPR is enabled but not integrated with MFA.

Fix

Enable Self-Service Password Reset.
Require registration of authentication methods.
Use combined registration experience.

6. Unmanaged Guest Users

Risk

External users retain access to sensitive information long after projects end.

Common Finding

Thousands of inactive guest accounts remain active.

Fix

Implement guest access reviews.
Configure expiration policies.
Review guest permissions quarterly.

7. Microsoft Defender for Office 365 Not Fully Configured

Risk

Organizations remain vulnerable to phishing, business email compromise, and malicious attachments.

Common Finding

Licenses exist but Safe Links and Safe Attachments are disabled.

Fix

Enable:

Safe Links
Safe Attachments
Anti-Phishing Policies
Impersonation Protection

8. Mailbox Auditing Not Enabled

Risk

Security teams cannot investigate suspicious mailbox activities.

Common Finding

Limited auditing retention settings.

Fix

Enable mailbox auditing for all users.
Extend audit log retention where licensing permits.
Monitor suspicious delegate access.

9. Excessive Sharing in SharePoint and OneDrive

Risk

Sensitive documents are exposed externally.

Common Finding

"Anyone with the link" sharing enabled organization-wide.

Fix

Restrict anonymous sharing.
Require authenticated external users.
Review sharing reports regularly.

10. Inactive User Accounts Remain Enabled

Risk

Former employees become an easy target for attackers.

Common Finding

Accounts remain active for months after staff leave.

Fix

Implement automated offboarding:

Disable account
Revoke sessions
Remove licenses
Archive mailbox
Transfer data ownership

Fix: Five9 Not Working on Azure Virtual Desktop (AVD)

2026-05-07T19:56:00.007+05:30

If you are facing issues with the Five9 application not working properly on Azure Virtual Desktop (AVD), this is a known limitation and not a configuration issue.

🚨 Problem Statement

Many organizations deploy AVD in a multi-session (pooled) environment, where multiple users share a single virtual machine.

However, the Five9 softphone application does not support multi-session AVD setups.

🔍 Root Cause

The issue occurs due to a technical limitation in Five9:

Five9 uses a dedicated port (e.g., 8083) per session
In a multi-session AVD host:
- Multiple users try to use the same port
- This leads to port conflicts and unstable behavior

👉 As confirmed by the Five9 vendor, multi-user shared environments are not supported for softphone operations.

✅ Recommended Solution

To resolve this issue, you must switch to:

✔️ Single-Session AVD (Dedicated VM per user)

One user per virtual machine
No port conflicts
Stable softphone performance

Once deployed in this setup, Five9 will work reliably without the issues seen in multi-session environments.

You were disconnected from AVD because your PC went to sleep

2025-02-22T14:52:00.003+05:30

Issue : User reporting that since they migrated to windows 11, As soon as they go away from system after screen lock (Windows + L) for 3-5mins, when they return unlock the screen, they found that their AVD (Azure Virtual Desktop) disconnected with above message.

Reason : This normally happens when in Power settings you set your machine to sleep after 3 mins of no activity. As soon the machine go in sleep mode, it will disconnect all those app those opened (i.e. Outlook, Teams , AVD etc)

Solution : Please change the Power Plan to "Best power efficiency". Again Please note after choosing the Plan make sure your system should not set to sleep if away for more than 3mins.

"Untrusted Server Blocked" - Cisco VPN

2022-03-30T11:17:00.001+05:30

Are you getting below error when you trying to connect VPN?

Solution: Go to change Settings, Untick "Block Connections to Untrusted Servers", Click on Close and try again. VPN will connect now.

Can I install an AV on HP Thin PRO OS?

2022-03-30T10:54:00.003+05:30

Generally this questions asked many times in corporates. They want to make their environment more safe & secure. The THIN PRO OS provided by HP already a Super safe tool as its base on Ubuntu OS.
There is no need to install another AV on this OS. I hope below figure can help you to understand.

PowerShell Commands to connect Remotely

2020-10-08T15:53:00.006+05:30

Outlook Left side options are Missing

2020-06-03T12:29:00.002+05:30

If user says that their left side options are missing, like create mail, etc, it means their left side pane has disappeared. To bring it back, go to VIEW > FOLDER PANE > NORMAL.

What might have happened is that Normal option must have been unchecked. You have to just check (tick) it.

How to Get Wifi Password?

2019-12-29T01:22:00.001+05:30

This will help you to get the wifi password, for which you already connected once.
Open CMD with Command Prompt.
Type comand to show all WIFI profile Created on laptop.

netsh wlan show profile

After this enter the next command : - Netsh wlan export profile folder=C:\ Key=Clear.

Now you can see all profile files in C:\.

Open it with Notepad and you can see the password in sharekey format.

How to check the information of any computer/server?

2018-02-20T14:07:00.000+05:30

If you want to know the hardware and software available on your machine just type one command

Start >> Run > MSINFO32
and Press Enter.

It will show you all the info.

Office365 Mailbox details with folders and subfolders

2017-06-28T16:04:00.000+05:30

Hello Friends,
Sorry for coming back after a long time. Those are busy days with full pack of work.
I am here to share you the Power Shell command to get your OFFICE365 mailbox Sizes details available via Power shell commens.
1) First you have to open windows powershell on the machine.
2) Then You need to connect to your Office365 account. You can get details from https://technet.microsoft.com/en-us/library/dn975125.aspx
3) After connection You can type this command to get the details of all mailbox folders and subfolders.type below command in powershell window.

Get-Mailbox | Select-Object alias | foreach-object {Get-MailboxFolderStatistics -Identity $_.alias | select-object Identity, ItemsInFolder, FolderSize} | Export-csv c:\Stats.csv -NoTypeInformation

You can copy and paste it and no need to make any change. It will save a File at your C:\STATS.CSV.
Open it and You can see all details for your mailboxes.

Keep doing the Good work..!!

Enjoy.

Thanks
Pankaj

How to Delete a service which having no related substance on machine/Server?

2016-11-17T11:58:00.000+05:30

Hello Friends,
It happen many times, we uninstall a particular application from a machine/server and after successfully uninstallation the SERVICE still present on Machine/Servers under SERVICES.MSC.
Here I am telling you a trick to delete such services.
I.e. I uninstalled Vipre Business Edition (Sunbelt) from one of my machine. After all done and I made a reboot, I found that SQL (SUNBELT) service is still present.
I try to start the service but unable to start.
I try to follow the KB article https://support.microsoft.com/en-in/kb/909967 but that seems not working.
So FInally follow these steps and it starts working:-
Open a command prompt. (Run a command prompt as Administrator in Windows vista/7/8)
Copy red command line and Paste.
sc stop "MSSQL$SUNBELT"
sc config "MSSQL$SUNBELT" start= disabled

How to delete this service.
sc delete "MSSQL$SUNBELT"

Done. I hope the Service is deleted now.

Thanks and Keep sharing your feedback/questions/Answerr]
Pankaj

Windows is not Genuine..!! What to Do??

2016-11-08T16:02:00.003+05:30

Hello Friends,

If you found that your window is not Genuine and You keep Getting Pop-up once you login on the machine.
You can Rearm it via Just typing one command in Command Prompt (Run as Administrator)

slmgr.vbs –rearm

Your Evalutation period will be extended.

Enjoy..!!

Remotely Reboot of a machine via PSTools

2016-05-11T16:06:00.000+05:30

Hello Friends,

Sometimes the shutdown -r command not work for remote reboot of a machine, You can try it via psexec utility comes with PStools.

Open command prompt and type..
C:>psshutdown \\machinename -r -e p:2:3

Thanks
Pankaj

Change the Language of BackupExec Console

2016-01-21T15:26:00.000+05:30

Hello Friends,

During our troubleshooting some times we found that the BACKUP EXEC installed on customer premises is not as per our Language. Until unless we not change it to desired language we would not be able to troubleshoot.

So If you want to make the langauge change of console, Just Open REGEDIT on that machine, Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\SYMANTEC\Backup Exec For Windows\Backup Exec

Select Edit | Add Value

Select "String Value" as the Data Type, and click OK.

Now a Box will Open. Type Language in that. Press OK.

Now again Double Click on "Language" and In the BOX enter your desired language code.

DE = German
EN = English
ES = Spanish
FR = French
IT = Italian

JP = Japanese
PT = Portuguese

ZH = Chinese Simplified
CH = Chinese Traditional
RU = Russian

KO = Korean

Click on OKAY.

Exit from REGISTRY.

Close and Reopen the BACKUP EXEC.

Now you can see the console in your desired language.

How to offline defrag Exchange server 2010 database

2015-04-08T11:58:00.003+05:30

When working with exchange, it happen sometimes that the exchange database is using high disk space and even you and users are deleting/archived some mails but the size is not getting low.

In that scenario, You an exchange administrator or system administrator must perform offline defragmentation of database.

There are some points which you must be follow before starting the offline defragmentation:-

1) During the offline defragmentation exchange service would be stopped. So no mail access would be working during that time

2) Before making some free disk space for the drive in which exchange database present, you need approx 1.1x of database size somewhere in your network.
First you need to check how much white space you have in your exchange database. White space means the space which will be free once you run the defrag utility.
to check it you can open Exchange management shell and type.

Get-MailboxDatabase -Status | ft name,databasesize,availablenewmailboxspace -auto

[PS] C:\>Get-MailboxDatabase -Status | ft name,databasesize,availablenewmailboxspace -auto

Name             DatabaseSize                    AvailableNewMailboxSpace
----             ------------                    ------------------------
MB-HO-01         18.26 GB (19,604,766,720 bytes) 9.544 GB (10,247,766,016 bytes)
MB-HO-02         15.63 GB (16,785,670,144 bytes) 3.696 GB (3,968,761,856 bytes)
MB-HO-Archive-01 648.1 MB (679,542,784 bytes)    134.6 MB (141,164,544 bytes)

In the example above the database MB-HO-01 is 18.26Gb in size but has 9.544Gb white space due to archiving that has ocurred.
So to plan for an Exchange 2010 mailbox database defrag you need an amount of free space equivalent to 1.1x the predicted size of the new file.

In this example that would be:
18.26 – 9.544 = 8.7
8.7 x 1.1 = 9.57

1. Start--->Run--->services.msc and then STOP Microsoft Exchange Information Store service
2. Open up a command line utility and execute the following command:

eseutil /d "C:\Program Files\Microsoft\Exchange Server\V14\Mailbox\Mailbox Database 0305499990\Mailbox Database 0305499990.edb" /t \\10.0.0.2\temp.edb

Where: "C:\Program Files\Microsoft\Exchange Server\V14\Mailbox\Mailbox Database 0305499990\Mailbox Database 0305499990.edb" is the path to the exchange server database that needs to be defragmented and \\10.0.0.2\temp.edb is any temporary location that has adequate space (minimum the size of the database+10%) to store the temporary defraged database, until completion of the defrag.

Finally once the process is complete you need to START the Microsoft Exchange Information Store service and check that the database has been mounted correctly via the Exchange Management Console. I always give the server a restrat to check that all relevant services do start up automatically after the defrag procedure.

If you want to verify that the available new mailbox free space has been increased after the defragment procedure all you need to do is execute the following command in Exchange Management Shell:

Get-MailboxDatabase -Status | ft name,databasesize,availablenewmailboxspace -auto

Unable to promote windows Server 2012 R2 as a Child Domain Controller

2014-12-08T16:55:00.001+05:30

Hello Friends,

Its just to share with you all that there is a bug in Windows Server 2012 R2. If you try to promote windows server 2012 R2 as a Child Domain controller of existing forest, It will keep restarting again and again in 15mins.

Till now there is no solution of this.

Feel free to let us know if you found some solution.

Thanks
Pankaj

Unable to write on an external disk

2014-12-08T16:50:00.004+05:30

If any time you found that the disk which you connected to your machine, is readonly.
You can try these steps.

Using Diskpart (command prompt)

Start > search bar -> CMD and press enter
Type< diskpart
Type< list disk
Type< select disk # (# is the number of the USB DRIVE you’ve plugged in )
Type< attributes disk clear readonly
Type “exit” to exit the diskpart

Feel free to contact us for your suggestions/feedback.

How to Shut Down Windows Server 2012 / Windows 8 through Remote Desktop

2014-08-29T11:25:00.001+05:30

Here's my favorite way to shut down a Windows Server 2012 or Windows 8 system through Remote Desktop:

Go to the Desktop.
Click on the desktop background (to make sure you don't have any window in focus).
Hit the Alt-F4 keyboard shortcut. This brings up a simple dialog box (below):

You can choose Disconnect, Sign out, Shut down, or Restart.

How to update Windows Defender via command prompt?

2014-06-15T21:00:00.000+05:30

To update the windows defender signature files via command prompt simply open command prompt.
use the cd (Change Directory) command to go to directory
C:\Program files\Windowsdefender.

Now type MpCmdRun.exe -SignatureUpdate and Press Enter.

Refer:http://technet.microsoft.com/en-us/magazine/gg131918.aspx

Reset VSS Writers

2014-05-05T10:58:00.000+05:30

VSS writers are application-specific components for Microsoft's Volume Shadow Copy Service, which ensure the consistency of application data when a shadow copy is created. That's quite useful for creating consistent backups of a system. However, some of these writers go into error states more or less frequently. And Microsoft did not deem it necessary to document how to reset writers without rebooting the entire system (or at least I didn't manage to find that piece of information).

Since this burnt me once too often, I started compiling a list of VSS writers and the services that need to be restarted to reset each of them. Some are rather obvious, others (System Writer for instance) not so much.

VSS Writer	Service Name	Service Display Name
ASR Writer	VSS	Volume Shadow Copy
BITS Writer	BITS	Background Intelligent Transfer Service
COM+ REGDB Writer	VSS	Volume Shadow Copy
DFS Replication service writer	DFSR	DFS Replication
DHCP Jet Writer	DHCPServer	DHCP Server
FRS Writer	NtFrs	File Replication
FSRM writer	srmsvc	File Server Resource Manager
IIS Config Writer	AppHostSvc	Application Host Helper Service
IIS Metabase Writer	IISADMIN	IIS Admin Service
Microsoft Exchange Writer	MSExchangeIS	Microsoft Exchange Information Store
Microsoft Hyper-V VSS Writer	vmms	Hyper-V Virtual Machine Management
NTDS	NTDS	Active Directory Domain Services
OSearch VSS Writer	OSearch	Office SharePoint Server Search
OSearch14 VSS Writer	OSearch14	SharePoint Server Search 14
Registry Writer	VSS	Volume Shadow Copy
Shadow Copy Optimization Writer	VSS	Volume Shadow Copy
SPSearch VSS Writer	SPSearch	Windows SharePoint Services Search
SPSearch4 VSS Writer	SPSearch4	SharePoint Foundation Search V4
SqlServerWriter	SQLWriter	SQL Server VSS Writer
System Writer	CryptSvc	Cryptographic Services
TermServLicensing	TermServLicensing	Remote Desktop Licensing
WMI Writer	Winmgmt	Windows Management Instrumentation

This list is far from complete. It merely contains those writers I already had to deal with and some contributions from fellow administrators.

Event ID: 55 Description: The file system structure on disk is corrupt and unusable. Please run the chkdsk utility on the volume "Drive_letter:"

2014-04-15T11:32:00.000+05:30

On a Windows Server 2003-based or Windows XP-based computer, an NTFS file system partition was formatted by using an allocation unit size (cluster size) that is smaller than 4,096 bytes. When you create many files on this partition, event ID 55 may be logged in the System log:

Event Type: Error
Event Source: NTFS
Event ID: 55
Description:
The file system structure on disk is corrupt and unusable. Please run the chkdsk utility on the volume "Drive_letter:"

To Resolve this, Please install below hotfix.

http://support.microsoft.com/kb/932578/en-us

How to update GFI Agent version for devices?

2014-03-21T11:56:00.000+05:30

Updatind the Agent is actually very simple.

1) The simplest methode and quickest way as far as I am concerned will be to download the Agent from the RMM (Dashboard) while you are loggeg on into the server or use the executable Agent you have download to install it direcly on the server. From the Agent tab on the Dashboard: Agent>Download Agent v9.5.2 RC or v9.4.0

2) Alternatively by double clicking on the device or right-clicking the device and selecting Edit Device>Agent version ( at the right-hand side of the screen) Update Agent and select the version you wish and finish with Ok! To save the setting.

3) And last but not the least from the Agent tab where you started in the beginning click Agent Auto-update settings. This last one is more interesting for all Servers or Workstations Agent update at once or on a Client or Site level base update

GFI Agent Portal showing RED for some devices

2014-03-21T11:43:00.000+05:30

We found that the GFI Agent Portal is showing RED for some devices.
When you click on this device its showing "OVERDUE".

When you login to device (SERVER/PC), its showing everything OKAY. GFI Agent is having latest AV Definitions. All Schedule backup is also running.

To resolve this, Just login to the device (SERVER/PC) and check for "Advanced Monitoring Agent" service.
It must be stopped, Start it.

Wait for 15seconds, The red alert removed from GFI Portal.

Sunbelt Vipre Agent Definition update via Command Line

2014-01-14T13:42:00.000+05:30

Hello Friends,

Sometimes we are unable to login to the machines those having Vipre Agent installed. But if we are able to connect to the machine with NON-Interactive session via some applications i.e. Logmein and we can open the command prompt, We can run some commands to run the Definition update from here.
By this the user will also not get disturbed and the definition will also updated.

For this:-

Open a command prompt and navigate to the VIPRE installation directory. By default VIPRE is installed in one the following folders:

VIPRE Business 5.0
- 32bit: C:\Program Files\GFI Software\GFIAgent\
- 64bit: C:\Program Files\GFI Software\GFIAgent\
VIPRE Business 6.0

32bit: C:\Program Files\GFI Software\GFIAgent\
64bit: C:\Program Files (x86)\GFI Software\GFIAgent\
- VIPRE Home
  - 32bit: C:\Program Files\GFI Software\VIPRE
  - 64bit: C:\Program Files (x86)\GFI Software\VIPRE
Run the following executable: sbamcommandlinescanner.exe /updatedefs
(This will start updating the AV def via Internet, If you have downloaded the Definition locally you can give that path also)
sbamcommandlinescanner.exe /applydefs [PathToDefsFile] - apply definitions

Let me know if you face any issues.

Thanks
Pankaj

Tuning Guide for StorageCraft Software on Servers

2013-11-30T12:44:00.003+05:30

Instructions:

Use the following sections to help improve performance with your Windows server in regards to StorageCraft software.

Paging file

When the server is running low on memory and more is required immediately, the operating system uses hard drive space to simulate system RAM by swapping out memory pages not currently required. This is known as virtual memory and is often called the paging file.

For the best performance of Windows, follow these rules:

Create a fixed size paging file that is 1.5 times the size of physical memory. Fixed size means the initial size and the maximum sizes have the same value. (Fig. 1)

Fig.1 - Initial and Maximum Sizes screen.

Avoid placing a paging file on the system or boot drive.
Do not place paging files on separate partitions that are on the same physical disk.
Avoid placing a paging file on a fault tolerant drive especially a mirrored (RAID-1) volume.

Paging files do not need fault tolerance – they need speed.

Memory Management

Registry keys can be modified or created to help with memory management.

Run regedit and locate the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\MemoryManagement

Check the following values under this registry key.

PagedPoolSize:

Typically a DWORD value for PagedPoolSize exists. If it does not exist, create a new DWORD value called PagedPoolSize. The default setting calculates an optimal value for this entry based on the amount of physical memory in the computer, and it adjusts this value if the amount of memory changes.

Modify the value and enter a value of 0xFFFFFFFF (hexadecimal) – that is eight Fs'. This new setting calculates the maximum paged pool allowed for the system in this configuration.

PoolUsageMaximum:

Memory Manager trims paged pool allocations to help optimization. It can be beneficial to be more aggressive on the trimming process. By default, trimming occurs at the 80% watermark and if the system is extremely active, it will cause delays in processing requests. The following setting will reduce this watermark to 60%, forcing housekeeping to kick in earlier:

Create a new DWORD value called PoolUsageMaximum and specify a value of 60 (decimal).

SessionPoolSize:

Typically a DWORD value for SessionPoolSize exists. If it does not exist, create a new DWORD value called SessionPoolSize. The SessionPoolSize is used to control the amount of memory alloted to each session in memory. The default value is 20 (MB). A slight increase will help improve data stored in each session.

NOTE: While the registry keys SessionPoolSize and SessionViewSize do not depend directly on each other, Microsoft recommends that if you increase one of these Registry values, you increase the other. Microsoft does not recommend increasing memory over 512 between the SessionPoolSize and SessionViewSize values.

Modify the value and enter a value of 48 (decimal).

SessionViewSize:

Typically a DWORD value for SessionViewSize exists. If it does not exist, create a new DWORD value called SessionViewSize. The SessionViewSize is used to control the amount of memory alloted to each session in memory. The default value is 20 (MB). A slight increase will help improve data stored in each session.

Modify the value and enter a value of 68 (decimal).

For additional tuning on this value, start at the default value of 20 and increase this value by multiples of 16 (MB) as needed. (e.g., 20, 36, 52, 68).

Lanman Server:

Registry keys for the LANMANServer can be modified or created to help with resource management.

Run regedit and locate the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters

Check the following values under this registry key.

Size:

A DWORD value for Size exists with a default value of 1. The registry value of 1 means that the system will minimize memory used for I/O transfer.

We suggest maximizing I/O throughput for file sharing and for network applications. Use the following value to do so.

Modify the value and enter a value of 3 (decimal).

IRPStackSize:

Typically a DWORD value for IRPStackSize does not exist. This indicates that the default value of 15 is in effect. If it does not exist, create a new DWORD value called IRPStackSize.

The IRPStackSize specifies the number of stack locations in I/O request packets (IRP) in use by the operating system. If resource demands are a problem, increasing this value can benefit certain transports such as Media Access Control (MAC) drivers and file system drivers. Each stack uses 36 bytes of kernel memory for each receive buffer. Valid range of values are 11 (0x0b hexadecimal) to 50 (0x32 hexadecimal).

Initially, we recommend starting with a value of 24 (decimal). Do not use values between 32 and 36 (decimal), as these values have been known to cause issues with Windows.

If the problem with resources still persists after completing this procedure, increase the value by small increments (1-5 points).

http://www.storagecraft.com/support/kb/article/241