Troubleshooter Extraordinaire :)

One Drive to Rule Them All: Consolidating Mail, Files and Media from Many Accounts into Google Drive

2026-10-01T11:42:21.257+03:00

Written with the help of Claude AI

The problem: one person, too many accounts

Most people don't plan their digital footprint. They accumulate it. A personal Gmail from university, an Outlook.com address from an old job, a OneDrive that came free with an Office subscription, a second Google account set up for a side business. Years later, the emails, documents, spreadsheets and family photos are spread across all of them.

That was the situation for a recent client. They had moved onto a Google Workspace account on their own domain and wanted everything else consolidated there: mail into the Workspace mailbox, and every file, folder, photo and video into a single, organised Google Drive.

It sounds like a copy-and-paste job. It isn't. This post walks through the four stages we went through, the traps we hit along the way, and the scripts that got us out of them.

The overall plan was simple:

Move each mailbox into the Workspace account.
Copy each account's files into Google Drive, one top-level folder per source account.
Clean up the side effects of the copy.
Pull all photos and videos out into a single Media folder.

Step 1: Email — moving every mailbox into Workspace Gmail

Mail is the easiest piece to verify and the one people miss most when it's gone, so we did it first. The right tool depends entirely on where the mail lives today:

Source mailbox	Best route into Workspace Gmail	Needs
Personal Gmail	Admin console data import tool (Gmail source)	Workspace super admin; the Gmail owner approves a request
Personal Outlook.com / Hotmail	Classic Outlook for Windows + Google's GWMMO tool (via PST)	A Windows PC with desktop Outlook
Any other IMAP provider (Yahoo, iCloud, Zoho...)	Admin console data import tool (IMAP source)	The mailbox password or an app password

Whichever route you take, moving the mail is only half the job. The other half is telling the rest of the world about the new address, and that part is manual.

Personal Gmail to Workspace Gmail

Google Workspace has a built-in, free data import tool that pulls mail directly from a personal Gmail account into a Workspace mailbox, labels and all. Nothing is downloaded or re-uploaded. It used to be called the Data Migration Service, and older guides (including our own first notes) mention app passwords. The current version uses an authorisation request instead, which is simpler and safer.

Before you start

You need a super administrator login for the Workspace tenant.
The target user must have a Workspace licence with Gmail turned on.
If the personal Gmail account is enrolled in Google's Advanced Protection Program, it has to be turned off before the import is set up and for as long as it runs.

Step by step

In the Admin console, go to Menu → Data → Data import & export → Data import.
Under Gmail, click Import.
Enter the personal Gmail address as the Source email address and click Request authorization.
The Gmail account owner gets an email and approves the request. If you own the account, you can approve it directly from the Admin console. The request expires after 24 hours; use Refresh request to resend.
Once the status shows Connected, enter the Workspace address as the Target account and click Save.
Choose the import settings. With no start date, everything from 1 January 2000 onward is imported. Optionally include deleted and spam messages, or exclude labels by name (sub-labels as Parent/Child).
Click Start import. Progress counts update live: emails discovered, imported, skipped and failed. You can close the page; Google emails a report when it finishes.
Run a delta import later to pick up anything that arrived in the old account after the first pass.

What carries over, and what doesn't

Mail and labels come across. Contacts, calendars, filters, signatures and the old account's "Send mail as" settings do not. For a single person these are quick by hand:

Contacts: export from Google Contacts on the old account (Google CSV), import on the new one.
Calendars: export from Google Calendar settings (.ics) and import, or simply share the old calendar with the new account.
Filters: Gmail settings → Filters → export as XML on the old account, import on the new one.

Bridging the gap

Until everyone has the new address, set the old Gmail to auto-forward to the Workspace address (Settings → Forwarding and POP/IMAP). Add a filter in the new mailbox that labels anything sent to the old address. That label becomes your to-do list for the subscription clean-up below.

Google's full walkthrough: Import email with the data import tool.

Personal Outlook.com to Workspace Gmail

This is the awkward one. The data import tool's IMAP option asks for the mailbox password, and personal Microsoft accounts (@outlook.com, @hotmail.com, @live.com) stopped accepting passwords and app passwords over IMAP in September 2024. Only modern sign-in (OAuth) works now. The data import tool's Exchange Online option is built for business Microsoft 365 tenants, not personal accounts.

So the reliable route goes through a Windows PC and two pieces of desktop software: classic Outlook, which signs in to Outlook.com properly, and Google's free GWMMO (Google Workspace Migration for Microsoft Outlook), which imports a PST file into a Workspace account.

Step by step

Install classic Outlook for Windows (Outlook 2021 or the Microsoft 365 desktop app). Older versions, and the web, Mac and "new Outlook" apps, won't work for this.
Add the Outlook.com account using automatic setup, so it connects with a Microsoft sign-in page rather than a password box. Let it sync completely; for a large mailbox, set the offline cache to keep all mail, not just the last year.
Export to PST: File → Open & Export → Import/Export → Export to a file → Outlook Data File (.pst). Select the top of the mailbox and tick Include subfolders.
Install GWMMO from Google's download page, with Outlook closed.
Run GWMMO, sign in with the Workspace account, and choose From PST file(s) as the source.
Pick what to import: email, calendar and contacts can go together or separately. Optionally skip junk and deleted items, or limit by date.
Start the import and leave the PC on. Outlook folders become Gmail labels.

If the PST is too large to export cleanly, export it in date ranges or folder by folder and run GWMMO once per file.

Other routes we considered

Route	When it makes sense	Catch
Thunderbird with both accounts added (OAuth for Outlook.com), drag folders across	No Windows PC, small mailbox	Slow, manual, easy to miss folders
imapsync with OAuth access tokens	Comfortable on the command line	Getting a Microsoft OAuth token is the fiddly part
Commercial migration services	Several mailboxes, little time	Paid; you hand a third party access to both accounts
Data import tool, IMAP option	Other IMAP providers (Yahoo, iCloud, Zoho)	Doesn't work for Outlook.com any more

Bridging the gap

In Outlook.com, turn on forwarding to the Workspace address (Settings → Mail → Forwarding) and tick Keep a copy. As with Gmail, a filter in the new mailbox labels anything that arrives via the old address.

The manual part: subscriptions, logins and the old address

No tool moves this part for you. Every bank, utility, shop, school portal and newsletter knows the old address, and each one has to be changed by hand on its own website. This took longer than the mail import itself.

1. Build the list

We built an inventory from three places, in a simple sheet with columns for service, old address, category, changed (yes/no) and notes:

The old mailboxes. Search them for words that only service emails use: unsubscribe, receipt, invoice, verify your email, password reset, welcome to, your order. Sort by sender and you have most of the list in an hour.
The password manager (or the browser's saved passwords). Every saved login whose username is the old address is a service to update.
"Sign in with Google" and "Sign in with Microsoft". Check the old account's security page for third-party apps with account access. These logins are tied to the old account, not just its address, and are covered below.

2. Work through it by priority

Priority	Examples	Why
First	Banks, cards, tax, government portals, insurers, utilities	Missing one of these has real consequences; many need extra verification to change
Second	Phone carrier, domain registrar, cloud and software subscriptions, shopping accounts with saved payment	Billing and account recovery depend on them
Third	Social media, forums, loyalty schemes	Nice to have; batch them
Last	Newsletters and marketing	Unsubscribe from most rather than moving them; it's a free clean-up

For each service: log in, change the email, confirm the verification link that arrives in the new mailbox, and tick it off. Where a site won't let you change the email, note it and decide whether to keep the old account just for that service or close and re-register.

3. The things that don't move

Purchases and subscriptions tied to the account itself. Apps, films and books bought on Google Play, YouTube or Google One subscriptions on the old Google account, and a Microsoft 365 Personal subscription on the old Microsoft account stay with those accounts. Cancel and re-subscribe on the new account where it makes sense, or keep the old account for them.
"Sign in with Google/Microsoft" logins. Most sites let you add a password or link a new sign-in method from their account settings. Do that before you stop using the old account.
Recovery details. Make the new address the recovery email on anything important, and check the old accounts' own recovery phone and email are still current.

4. Don't delete the old accounts

Keep the old Gmail and Outlook.com accounts open, forwarding to the new address, for at least six months to a year. The "via old address" label shows what you missed; when it's been quiet for a few months, you're done. Sign in to each old account every so often: both Google and Microsoft can close personal accounts that sit unused for long enough, and the old address is still the recovery route for anything you forgot.

Step 2: Files — rclone, and the spreadsheet that vanished

For files, we used rclone, which talks to Google Drive, OneDrive and dozens of other storage services. Each source account got its own top-level folder in the destination Drive, named after the account. That kept provenance clear: you can always tell where a file came from.

Setting up the remotes

In rclone, each account is a remote. We created one per source account and one for the destination. The names below are placeholders:

Remote	Type	Scope (recommended)	Role
`src-g1:`	Google Drive (personal)	`drive.readonly`	Source
`src-g2:`	Google Drive (second account)	`drive.readonly`	Source
`src-od:`	OneDrive Personal	default	Source
`dst:`	Google Drive (Workspace)	`drive`	Destination

A Google Drive remote is created with rclone config. The answers that matter:

rclone config
n) New remote
name> dst
Storage> drive
client_id> 1234567890-xxxx.apps.googleusercontent.com   # your own, see below
client_secret> GOCSPX-xxxx
scope> 1                         # "drive" = full access (destination)
service_account_file>            # blank
Edit advanced config? n
Use web browser to automatically authenticate? y
Configure this as a Shared Drive (Team Drive)? n
Keep this "dst" remote? y

A few settings are worth calling out:

client_id / client_secret. Leaving these blank uses rclone's shared client ID, which is being retired in 2026. Create your own. The next section covers why and how.
scope. Use drive (full access) on the destination. On source accounts, drive.readonly is the safer choice: rclone can read and download but cannot rename or delete anything. We learned this the hard way in Step 3.
Shared Drive. Answer y only if the destination is a Shared Drive rather than a user's My Drive.
Browser authentication. rclone opens a local web page on 127.0.0.1:53682 to receive the token. On a machine without a browser, answer n and use rclone authorize on another machine.

For OneDrive, choose Storage> onedrive, keep the region as global, sign in through the browser, then pick the OneDrive Personal drive when prompted. Office files in OneDrive are real .docx and .xlsx files, so they don't have the export problem described below.

Before copying anything, check each remote can see what you expect:

rclone listremotes
rclone lsd src-g1:          # top-level folders
rclone size src-g1:         # file count and total size
rclone about dst:           # free space on the destination

The copy commands

Each source went into its own folder under the destination. Always start with a dry run:

rclone copy src-g1: "dst:Users/Account A" --dry-run -v

Then the real run, with logging and progress:

rclone copy src-g1: "dst:Users/Account A" \
  --drive-export-formats ods,odt,odp \
  --drive-import-formats ods,odt,odp \
  --fast-list --transfers 4 --checkers 8 \
  --drive-stop-on-upload-limit \
  --log-file accountA.log -v -P

rclone copy src-od: "dst:Users/Account C" \
  --fast-list --transfers 4 \
  --log-file accountC.log -v -P

Flag	What it does	Why we used it
`--dry-run`	Lists what would happen without changing anything	Always first
`--drive-export-formats ods,odt,odp`	Exports native Sheets, Docs and Slides as OpenDocument files	Avoids name clashes with real Office files (explained below)
`--drive-import-formats ods,odt,odp`	Converts those files back to native Google files on upload	Sheets arrive as Sheets, not `.xlsx`
`--fast-list`	Batches directory listings into fewer API calls	Much faster on large folder trees
`--transfers 4 --checkers 8`	Parallel uploads and comparisons	Stays under Drive's per-client rate limits
`--drive-stop-on-upload-limit`	Stops cleanly at Drive's 750 GiB/day upload cap	Re-run the next day instead of hammering errors
`--log-file ... -v`	Writes every action to a log	An audit trail, and a way to reverse mistakes
`-P`	Live progress	Visibility on long runs

copy never deletes anything at the destination, which is why we used it instead of sync. Because it skips files that already match, re-running the same command after an interruption simply resumes.

To verify regular files after each run:

rclone check src-g1: "dst:Users/Account A" --one-way --drive-skip-gdocs

Native Google files report no size, so check can't compare them. We spot-checked those by hand.

That's the clean version. Here's what went wrong the first time, before those export flags were added.

The copy ran fine until we checked the spreadsheets. Some native Google Sheets were simply missing at the destination.

Why it happened

A native Google Sheet isn't a file on disk. When rclone copies one between accounts, it exports it to a real format, by default .xlsx, and uploads that. The source folders often had a Google Sheet and a genuine Excel file with the same name sitting side by side, for example Budget (Sheet) and Budget.xlsx (Excel). After export, both became Budget.xlsx, and rclone treated one as a duplicate of the other.

The obvious fix, rclone's dedupe command, made things worse. It renamed the Sheets to Budget-1, Budget-2 and so on, and they then arrived at the destination as plain .xlsx files rather than native Sheets. Formulas survived; the Google-native file did not.

For the record, the command that caused the trouble was:

# Don't do this to fix export collisions
rclone dedupe --dedupe-mode rename src-g1:

rename mode is designed for genuine duplicate files, which Drive allows and most storage doesn't. It renames every item that shares a name, and it does so on the live remote. With a read-only scope on the source, this command would simply have failed.

Fix A: round-trip through ODS

The cleaner rclone fix is to export native Google files to a format that doesn't collide with anything real, then convert them back on upload:

rclone copy src:Folder dst:Folder \
  --drive-export-formats ods,odt,odp \
  --drive-import-formats ods,odt,odp \
  --dry-run -vv

Sheets, Docs and Slides travel as .ods, .odt and .odp, so they no longer clash with real .xlsx, .docx and .pptx files, and they're re-imported as native Google files at the other end. Everything else (PDFs, Word and Excel files, images) is copied byte for byte. Drop --dry-run once the listing looks right.

Two caveats: any genuine .ods files in the source will also be converted to Sheets, and some advanced features (bound Apps Script, certain charts and pivots) may not survive the conversion.

Fix B: Apps Script for true native copies

Where the source account can share folders with the destination, Google Apps Script avoids conversion entirely. DriveApp's makeCopy() produces a genuine native copy of any file type. Share the source folder with the destination account, then run a recursive copy as the destination user:

function copyTree() {
  const SRC_ID = 'SOURCE_FOLDER_ID';
  const DST_ID = 'DESTINATION_FOLDER_ID';
  copyFolder_(DriveApp.getFolderById(SRC_ID), DriveApp.getFolderById(DST_ID));
}

function copyFolder_(src, dst) {
  const files = src.getFiles();
  while (files.hasNext()) {
    const f = files.next();
    const name = f.getName();
    if (!dst.getFilesByName(name).hasNext()) f.makeCopy(name, dst);
  }
  const subs = src.getFolders();
  while (subs.hasNext()) {
    const s = subs.next();
    const existing = dst.getFoldersByName(s.getName());
    const d = existing.hasNext() ? existing.next() : dst.createFolder(s.getName());
    copyFolder_(s, d);
  }
}

Because it skips files that already exist, the script is safe to re-run when it hits Apps Script's execution time limit (about 6 minutes on personal accounts, 30 on Workspace). The trade-offs: copied files get new modified dates, and files the owner has restricted from copying will fail.

Our rule of thumb: large file counts, or a source that blocks external sharing, go through rclone with ODS. Otherwise, Apps Script is the only option that guarantees native files.

A 2026 gotcha: rclone's shared Google client ID is going away

If you set up rclone for Google Drive by pressing Enter at the client_id prompt, you're using a client ID shared by every rclone user in the world. That stops working in 2026.

In July 2026, the rclone maintainers announced that Google will start charging for API requests made through rclone's built-in client ID for Drive and Google Photos. Google's stated timescale is later in 2026, after 90 days' notice. rclone's usage is hundreds of times over the free quota, so the project plans to disable the shared ID before charging starts and then remove it from the code (tracking issue). Recent releases already print a warning when a remote uses it.

The exact date is still open. In mid-September the maintainer said Google had gone quiet and might be revising the plan. Don't wait for it: a migration that breaks halfway through is far worse than ten minutes of setup.

Check whether you're affected

rclone config show dst:

If client_id and client_secret are blank or missing, the remote uses the shared ID. Remotes that use a service account are not affected. Check every Drive and Google Photos remote.

Fix: create your own client ID

The rclone Drive docs have the full walkthrough. In outline:

In the Google Cloud console, create a project (any Google account works) and enable the Google Drive API.
Configure the OAuth consent screen: app name, support email, audience External (or Internal if every account involved is in one Workspace).
Under Data access, add the scopes auth/docs, auth/drive and auth/drive.metadata.readonly.
Under Audience, add yourself as a test user.
Create an OAuth client of type Desktop app and note the client ID and secret.
Publish the app (External only). If Publish App is greyed out, fill in a homepage and privacy policy URL under Branding first.
Add the ID and secret to the remote with rclone config, then run rclone config reconnect dst: and refresh the token. Without the reconnect, rclone keeps using the old shared credentials.

One client ID can serve all your remotes, but each remote needs its own reconnect.

Things that catch people out:

Unverified app warning. Google shows a scary screen at sign-in. For personal use (under 100 users), you can click through it; verification isn't required.
Testing mode expires tokens after 7 days. Publish the app to avoid re-authorising every week.
Unused clients can be deleted. Google may remove OAuth clients inactive for six months.
Advanced Protection accounts block unverified apps from requesting Drive scopes, so a self-made client ID won't work there.
A bonus: your own client ID gets its own rate limit, so transfers are often noticeably faster.

Alternatives if you can't (or won't) make a client ID

Option	Works for	Trade-offs
Your own OAuth client ID in rclone	Any Google account	10 minutes of Cloud console setup; recommended default
Service account with domain-wide delegation + `--drive-impersonate`	Workspace accounts you administer	Ideal for the destination; can't reach consumer Gmail accounts
Google Apps Script with `makeCopy()` (Step 2, Fix B)	Any account that can share folders	No OAuth client needed; time limits; resets modified dates
Google Takeout, then upload via Drive for Desktop	Any Google account	No API at all; slow, manual, Sheets arrive as `.xlsx`
Drive for Desktop on both accounts, drag between them	Small jobs	Simple; native Google files sync as shortcut stubs, not content
Workspace admin migration tools	Workspace destination	Built in; less control over folder layout

In a setup like this one, a service account could cover the Workspace destination, but the personal source accounts still need a client ID. The simplest answer is one client ID, created once and used on every remote.

Step 3: Undoing the dedupe renames

The failed dedupe run had left dozens of Sheets in the source Drive renamed Name-1, Name-2. There's no undo button for this. Drive's version history tracks file content, not renames, and rclone keeps no rollback log unless you saved its verbose output.

So we wrote one more Apps Script to rename them back in place. The important part is what it refuses to touch. A file is only renamed if all three of these are true:

It's a native Sheet, Doc or Slides file whose name ends in -<number>.
A matching real .xlsx, .docx or .pptx with the original base name sits in the same folder.
No other native file of the same type already has the original name.

That way, a legitimate file called Budget-2 with no Excel twin is left alone.

const DRY_RUN = true;  // set to false after checking the log
const EXT = {};
EXT[MimeType.GOOGLE_SHEETS] = '.xlsx';
EXT[MimeType.GOOGLE_DOCS]   = '.docx';
EXT[MimeType.GOOGLE_SLIDES] = '.pptx';

function undoDedupe() {
  walk_(DriveApp.getFolderById('SOURCE_FOLDER_ID'));
}

function walk_(folder) {
  const files = folder.getFiles();
  while (files.hasNext()) {
    const f = files.next();
    const ext = EXT[f.getMimeType()];
    if (!ext) continue;

    const m = f.getName().match(/^(.*)-\d+$/);
    if (!m) continue;
    const base = m[1];

    // Only if the real xlsx/docx/pptx twin exists
    if (!folder.getFilesByName(base + ext).hasNext()) continue;

    // Skip if a native file of the same type already has the original name
    let clash = false;
    const same = folder.getFilesByName(base);
    while (same.hasNext()) {
      if (same.next().getMimeType() === f.getMimeType()) { clash = true; break; }
    }
    if (clash) { Logger.log('SKIP (clash): ' + folder.getName() + '/' + f.getName()); continue; }

    Logger.log((DRY_RUN ? 'WOULD RENAME: ' : 'RENAMED: ') +
               folder.getName() + '/' + f.getName() + ' -> ' + base);
    if (!DRY_RUN) f.setName(base);
  }
  const subs = folder.getFolders();
  while (subs.hasNext()) walk_(subs.next());
}

Run it with DRY_RUN = true, read the execution log, then flip it to false. It's safe to re-run after a timeout, because files already renamed no longer match the pattern. Anything logged as SKIP (clash) needs a human decision.

One detail made this whole fix possible: inside Drive, a native Sheet called Budget and a file called Budget.xlsx never actually collide. The collision only exists when a tool exports the Sheet. Restoring the original names was safe.

Step 4: Gathering photos and videos into one Media folder

With everything in one Drive, the last request was the one the client cared about most: all photos and videos in one place, regardless of which account they came from.

The Drive web interface can filter by file type, but it flattens results into one long list, has no bulk move by extension, and loses track of which account and subfolder each file came from. With thousands of files, that's a non-starter.

Instead we used Google Drive for Desktop on a Windows laptop and a PowerShell script run against its virtual drive. The key insight: a move within the Drive for Desktop drive (for example G:\) is sent to Google as a Drive move, not a download and re-upload, even in Stream mode. File IDs, sharing settings and version history are preserved. Only metadata changes.

The script works like this:

It scans the account folders recursively for image and video extensions (JPEG, PNG, HEIC, camera RAW formats, MP4, MOV, MKV and so on).
It moves each match to Media\<AccountFolder>\<original subfolders>\, so provenance is kept and the inevitable dozens of IMG_0001.jpg files from different phones don't collide.
It never overwrites. Name clashes get (1), (2) suffixes.
It runs as a dry run by default and writes a CSV log of every planned move.
An optional switch removes folders left empty afterwards. They go to Drive's trash, so they're recoverable.

The core of it:

param(
    [string]$Root  = "G:\My Drive\Users",
    [string]$Media = "G:\My Drive\Users\Media",
    [switch]$Execute,
    [switch]$RemoveEmptyFolders
)

$ext = @('.jpg','.jpeg','.png','.gif','.heic','.heif','.webp','.tif','.tiff',
         '.dng','.cr2','.nef','.arw',
         '.mp4','.m4v','.mov','.avi','.mkv','.wmv','.webm','.3gp','.mts','.m2ts')

$rootFull  = (Resolve-Path -LiteralPath $Root).Path.TrimEnd('\')
$mediaFull = (Resolve-Path -LiteralPath $Media).Path.TrimEnd('\')

Get-ChildItem -LiteralPath $rootFull -Recurse -File -Force |
  Where-Object { $ext -contains $_.Extension.ToLower() -and
                 -not $_.FullName.StartsWith($mediaFull + '\') } |
  ForEach-Object {
    $rel  = $_.FullName.Substring($rootFull.Length + 1)
    $dest = Join-Path $mediaFull $rel
    # ...collision handling, dry-run logging, then Move-Item when -Execute is set
  }

The workflow is: run it once as a dry run, review the CSV, then re-run with -Execute (and -RemoveEmptyFolders if wanted). Let the Drive for Desktop tray icon finish syncing before judging the result.

We deliberately left .svg and .ts off the extension list. In a mixed archive they're far more likely to be design assets and TypeScript source than images and video.

For very large collections (tens of thousands of files), a server-side Apps Script avoids the local sync client entirely, at the cost of batching around the execution time limit. For a personal archive, the PowerShell route was simpler and much easier to audit.

Lessons learned

Consolidating accounts is less about moving bytes and more about not breaking things along the way. A few principles carried us through:

Use the platform's own migration tools first. Google's Data Migration Service handled mail with almost no effort. Scripts are for the gaps.
Native Google files are not files. Any tool that copies between accounts has to export them, and that's where names collide and formats change. Know how your tool handles Sheets, Docs and Slides before you run it on real data.
Be wary of "fix" commands. rclone's dedupe did exactly what it says, and created a second problem. Test on a small folder first.
Dry run everything. Every script in this project defaulted to preview mode with a log. That's what made it safe to run against years of irreplaceable photos.
Keep provenance. One folder per source account, preserved all the way into the Media folder, meant we could always answer "where did this come from?"
Moves beat copies. Within the same Drive, a move is a metadata change that preserves sharing and history. A copy creates a new file with a new date.

The end result: one Google Workspace account holding the client's mail, their documents with Sheets still working as Sheets, and every photo and video from every account in a single Media folder.

From Password Spray to SAML: Securing Cisco FTD AnyConnect VPN with Entra ID

2026-10-01T11:17:51.628+03:00

Written with the help of Claude AI

Why we did this

Random Active Directory lockouts turned out to be a large password spray against our Cisco AnyConnect VPN, and the fix was moving VPN authentication to SAML with Microsoft Entra ID.

The starting point was common: a Cisco Firepower 1100-series firewall running FTD, managed on-box, with AnyConnect users signing in with their Windows AD password. Users kept getting locked out for no obvious reason.

This post walks through what we found and every step it took to fix it, including the problems we hit along the way. It's written for small IT teams who run a similar setup and are seeing the same symptoms.

What you'll end up with:

VPN sign-in through Entra ID, with MFA on every connection
The firewall never sees or forwards AD passwords, so spray attempts can't lock AD accounts
Optional single sign-on through the user's default browser

Starting environment: FTD 7.2.x managed by Firepower Device Manager (FDM), AnyConnect 4.10, hybrid AD synced to Entra ID, no Entra ID P1 licences, and endpoint security plus a DLP agent on domain laptops.

Step 1: Prove the VPN is the source

One command on the FTD settled it. Before touching anything, confirm where the failed logons come from.

> show aaa-server

It doesn't depend on logging being set up, and it shows request, accept and reject counts per authentication server. Ours showed this for the AD server group:

Counter	Value
Authentication requests	~774,000
Accepts	~400
Rejects	~770,000

Nearly every attempt failed, and each failure counted as a bad password against an AD account. The LOCAL group also showed ~73,000 rejects and zero accepts. Those were attempts against the built-in default connection profiles, which authenticate against an empty local database and never reach AD.

Two surprises came out of this:

We weren't using RADIUS at all. The server group was plain LDAP on port 389, pointing straight at a domain controller. Check your actual config rather than relying on documentation or memory.
The syslog buffer was missing everything. show logging | include 113005 returned nothing despite hundreds of thousands of failures. Buffer logging was off or set below informational. If you need source IPs, enable the internal buffer at level 6 or send syslog to a server.

If the reject count is low, the VPN isn't your problem. Check event 4740 on the PDC emulator instead: the Caller Computer Name points to the real source, which could be an Exchange server, a stale credential on a phone, or a cloud sign-in through Pass-through Authentication.

Why adding MFA through NPS wouldn't have helped

The usual advice is the NPS extension for Entra MFA. That checks the AD password first and only then prompts for MFA. Every wrong guess still counts against AD, so accounts keep locking. MFA through NPS stops a guessed password from being used, but it doesn't stop the lockouts.

Also check the accepts. At this volume, a few weak passwords may have been guessed, so review active sessions with show vpn-sessiondb anyconnect for unfamiliar IPs or users before going further.

Step 2: Choose SAML, and check what manages your firewall

SAML with Entra ID was the only option that stopped the lockouts. With SAML, the firewall redirects the user to Microsoft's sign-in page and never handles the password. Entra checks it instead, and its Smart Lockout absorbs the spray. If Entra Connect uses Password Hash Sync, failed attempts never reach your domain controllers at all.

FDM or FMC?

We lost time following FMC instructions on a box managed by FDM. The two have different menus and different field names. A quick way to tell: FMC is a separate server or VM you log into, while FDM is the web UI served by the firewall itself. Most Firepower 1000-series boxes in small offices use FDM.

The FDM 7.2 certificate limitation

On FDM 7.2 and earlier, Cisco only supports Duo as a SAML identity provider. The IdP signing certificate must have Basic Constraints: CA:TRUE, and Entra's signing certificate doesn't. The symptom is the error "Failed to generate SAML AuthnRequest", and show saml metadata <profile-name> returns blank sections.

You have two ways out:

Upgrade to FDM 7.3 or later, which adds a Skip CA Certificate Check option when uploading a trusted CA certificate. This is what we did.
Stay on 7.2 and use Cisco's workaround: generate your own signing certificate with CA:TRUE, upload it to Entra as a PFX, make it active, and upload it to FDM. You then have to renew that certificate yourself before it expires.

The upgrade was worth doing anyway: newer releases add RA VPN threat detection and fix several actively exploited VPN vulnerabilities.

Step 3: Upgrade FTD, and watch for expired certificates

We went from 7.2.5 directly to 7.6.6, which Cisco supports as a single upgrade. Check your hardware first: the Firepower 2100 series can't run 7.6 and tops out at the 7.4 train, while the 1000 series is fine.

Before you start

Take an FDM backup under Device → Backup and Restore, and download it off the box.
Download the upgrade package for your model from software.cisco.com, not the reimage package.
Run the readiness check in Device → Updates → System Upgrade.
Plan a maintenance window. A single box reboots, so internet access and the VPN go down for 45–90 minutes. Never power-cycle it mid-upgrade.
Go to Objects → Certificates and look for any certificate with an expiry date in the past. The readiness check didn't catch the one that broke our upgrade.

The failure we hit

The upgrade ran to the final stage and then failed. To find out why, check the status and the upgrade logs:

> show upgrade status detail
> expert
$ sudo su
# ls -lt /ngfw/var/log/sf/
# grep -iE "error|fatal|fail" /ngfw/var/log/sf/<upgrade-folder>/main_upgrade_script.log | tail -n 40

The log showed 800_post/100_ftd_onbox_data_import.sh failing with "The chosen certificate has already expired." The new version installed fine, but re-importing the FDM configuration hit an expired certificate that 7.2 had tolerated and 7.6 rejected.

The culprit was DefaultWebserverCertificate, the self-signed certificate for the FDM web UI, which had expired two years earlier. show crypto ca certificates didn't list it, because that command only shows certificates deployed to the data plane. FDM keeps its own certificate database, and the upgrade validates all of it.

The fix

Run upgrade cancel to roll back to the old version with your configuration intact.
Create a new certificate under Objects → Certificates → Add Internal Certificate → Self-Signed. You can't renew the system default.
Select the new certificate under Device → System Settings → Management Access → Management Web Server. Your browser session drops and shows a certificate warning, which is expected.
Check the other places a certificate can be selected (RA VPN device identity, identity policy, SSL decryption), then delete any expired custom certificates.
Back up again and rerun the upgrade.

Step 4: Configure Entra ID

The gallery app does most of the work, and you can enforce MFA without an Entra ID P1 licence. In the examples below, the VPN address is vpn.example.com and the new connection profile is called VPN-SSO.

Create a new connection profile rather than converting the old one

The connection profile name is part of both SAML URLs, so pick it once and use it everywhere with the same capitalisation. A new profile also lets you test with one user while the old one keeps working.

Add and configure the app

In the Entra admin center, go to Enterprise applications → New application and add Cisco Secure Firewall - Secure Client.
Open Single sign-on and choose the SAML tile. If you don't see the SAML settings, you're probably in App registrations instead of Enterprise applications.
Under Basic SAML Configuration, set:
- Identifier: https://vpn.example.com/saml/sp/metadata/VPN-SSO
- Reply URL: https://vpn.example.com/+CSCOE+/saml/sp/acs?tgname=VPN-SSO
- If your VPN runs on a non-standard port, include it in both, for example vpn.example.com:4334.
Download Certificate (Base64), and copy the Login URL and Microsoft Entra Identifier.
Under Properties, set Assignment required to Yes, then assign users under Users and groups.

Without Entra ID P1

Conditional Access needs P1, and so do a few other things you'd expect to use. Here's how we worked around each:

Need	P1 approach	What we did without P1
Require MFA	Conditional Access policy	Per-user MFA, enabled for each VPN user and every admin
Assign users to the app	Assign a security group	Assign each user individually
Lockout threshold	Custom Smart Lockout	Default Smart Lockout (10 failures)

For per-user MFA, turn off Security Defaults first. Then go to Users → Per-user MFA, enable the users, and under Service settings untick remember MFA on trusted devices so every connection prompts. Have users register the Authenticator app at https://aka.ms/mfasetup before cutover.

If Entra Connect uses Pass-through Authentication instead of Password Hash Sync, failed cloud sign-ins still hit AD. Make sure your AD lockout threshold is above Entra's, or switch to Password Hash Sync.

P1 is worth budgeting for later. Location-based Conditional Access alone would have blocked most of this spray.

Step 5: Configure SAML in FDM

FDM needs three objects and one global setting, and the global setting is the one most guides miss.

1. Upload the Entra certificate

Go to Objects → Certificates → + → Add Trusted CA Certificate. Upload the Base64 certificate and tick Skip CA Certificate Check. The checkbox only appears when adding a new certificate, not when editing one. If it's missing after an upgrade, hard-refresh the browser, because it may be showing the old UI from cache.

2. Create the SAML server object

Go to Objects → Identity Sources → + → SAML Server:

IDP Entity ID URL: the Microsoft Entra Identifier, https://sts.windows.net/<tenant-id>/, including the trailing slash
Sign In URL and Sign Out URL: the Entra Login URL, ending in /saml2
Identity Provider Certificate: the certificate from step 1
Request Signature: None

3. Set the FQDN and port

There is no Base URL field in FDM. FDM builds the SAML base URL from the RA VPN global settings, which live inside the connection profile wizard.

Edit any connection profile and click Next until the Global Settings page. There, Fully-qualified Domain Name for the Outside Interface becomes the base URL, and Port Configuration sets the VPN port.

We ran the VPN on 4433 because FDM management was using 443 on the outside interface. That port mismatch cost us an afternoon: the SAML login URL came out without :4433 and went nowhere. The cleanest fix is to take FDM management off the outside interface entirely under Device → System Settings → Management Access → Data Interfaces, which you should do anyway, and run the VPN on 443.

4. Create the connection profile

Create VPN-SSO with SAML as the primary identity source, using your SAML object. Use the same address pool and group policy as your existing profile. Give it a group URL, and turn off the option that lets users pick a connection profile at the login page.

5. Verify before testing

> system support diagnostic-cli
# show running-config webvpn | include base-url
# show saml metadata VPN-SSO

The metadata output gives you the exact SP entity ID and ACS URL the firewall uses. Copy them into Entra's Identifier and Reply URL. Matching Entra to the firewall's own output avoids typos in the port, capitalisation, or trailing slashes.

If something fails, run debug webvpn saml 255, retry from the client, and read the output. Run undebug all when you're done.

Step 6: Fix the client-side problems

Once the firewall and Entra matched, SAML worked from a phone and a personal PC but failed on domain laptops. Both problems were on the endpoint, not the firewall.

"Profile settings mandate a single local user"

This appeared after a successful MFA approval. The client profile's Windows Logon Enforcement was set to SingleLocalLogon, and the test PC had a second Windows session still signed in. Run query user, sign off the extra session, and connect again. Keep the setting: it stops a second user on the same PC from riding someone else's tunnel.

"Sent an invalid response", then "validation failed"

On domain laptops, the embedded browser showed a TLS error. Refreshing loaded the Microsoft sign-in page and MFA succeeded, but the client then reported validation failed. The firewall debug showed:

%FTD-3-716164: SAML response relay state missing data integrity hash.

The firewall signs the RelayState it sends to Entra and expects that signature back. Refreshing after the TLS error started a sign-in without the firewall's RelayState, so the firewall rejected the result. The refresh was a symptom; the TLS error was the real problem.

Finding the TLS interception

Opening the Microsoft sign-in page in Edge on the laptop and checking the certificate showed the cause. The certificate chain led to a root named after the laptop's own hostname, ending in "endpoint cert", not to a Microsoft or DigiCert root.

That pattern means local software is intercepting HTTPS by re-signing it with its own root certificate. Things we learned while tracking it down:

Pausing the antivirus didn't help, because it wasn't the antivirus. The interceptor was the DLP agent, which generates a signing certificate for each endpoint. ESET's own certificate, for comparison, is named "ESET SSL Filter CA".
The certificate's NotBefore date was useless, because interception products often backdate it.
Check another laptop. If every managed laptop has the same pattern, it's your own software. If only one does, treat that laptop as potentially compromised: it can read Microsoft sign-ins in cleartext.

The fix: exclusions in the interception tool

SAML doesn't tolerate a man-in-the-middle, so the exclusions are required. In the DLP console's protection exclusions (website exclusions), we added:

vpn.example.com, login.microsoftonline.com, *.microsoftonline.com, login.live.com, *.msauth.net, *.msftauth.net

After the policy synced and the client restarted, the certificate chain went back to Microsoft's and the VPN connected normally. If your interceptor is an antivirus or a secure web gateway agent, the equivalent setting is usually called SSL/TLS filtering exclusions.

Step 7: Add single sign-on and upgrade the client

Switching the SAML login to the user's default browser gives SSO, so users who are already signed in to Microsoft don't type their password again.

Enable SSO

In the VPN-SSO connection profile, change the SAML Login Experience from the embedded browser to Default OS Browser.
In the SAML server object, untick Request IDP re-authentication at login. While it's ticked, Entra has to ask for the password every time.
Deploy, then test with a fresh connection.

You probably don't need the separate external-sso-*.pkg package. It was only required by early AnyConnect 4.10 builds; current clients include the support. It's a 10 KB download, so keep it on hand in case FDM asks for it.

With per-user MFA, expect no password prompt but still an Authenticator prompt. The Windows token only satisfies MFA if the user signed in with Windows Hello for Business. For a firm that just survived a spray, keeping that tap is a reasonable trade-off. Running dsregcmd /status tells you whether laptops are hybrid-joined (AzureAdJoined: YES, AzureAdPrt: YES), which gives the most reliable SSO.

Upgrade AnyConnect 4.10 to Secure Client 5.1

AnyConnect 4.x is end of life. From the Secure Client 5 downloads, take:

Package	Use
Headend Deployment Package (Windows), `*-webdeploy-k9.pkg`	Upload to FDM; clients upgrade from it
Pre-Deployment Package (Windows), `*-predeploy-k9.zip`	Install the core VPN MSI on one test laptop first
Profile Editor (Windows)	Edit client profile XML

Skip the ARM64 packages unless you have ARM laptops, and skip the API and transforms packages.

In FDM, the client package is uploaded on the Global Settings page of the connection profile wizard. FDM holds one package per operating system, so the upload button stays greyed out until you remove the old Windows package with its X. Remove and upload in the same session, then deploy.

Clients upgrade themselves on their next connection, without local admin rights. Afterwards, update any application exclusions in your security tools: the install path changes to Cisco Secure Client, and the UI process is now csc_ui.exe.

Step 8: Close the old attack path

SAML only ends the lockouts once nothing else on the firewall still sends passwords to AD.

Delete the LDAP-backed connection profile after all users have moved. As long as it exists, attackers keep spraying AD through it.
Keep the default profiles as sinkholes. DefaultWEBVPNGroup and DefaultRAGroup should authenticate against something that can never succeed, such as an empty local database. FDM 7.6.4 and later fixed a bug that prevented changing these in FDM.
Turn off connection profile selection on the login page, and don't use aliases. Users reach the SAML profile only through its group URL in the client profile.
Watch the counters. Run show aaa-server over the next day. The LDAP reject count should stop climbing. If it keeps rising, something still points at the LDAP server.
Enable RA VPN threat detection. It's available from 7.4.2.1 and 7.6.0, and it shuns IP addresses that repeatedly fail authentication or probe the default profiles. Check with show threat-detection service and show shun.

Housekeeping

Send syslog to an external server or SIEM, so the next incident has a record.
Switch any remaining LDAP use to LDAPS. Plain LDAP on 389 sends passwords to the domain controller unencrypted.
Keep FDM management off the internet.
Put certificate expiry dates in a calendar: the VPN certificate, the Entra SAML signing certificate (three years by default), and the FDM web certificate.

Lessons learned

Most of our time went into problems that a short checklist would have caught up front.

Symptom	Cause	Fix
Random AD lockouts	Password spray through VPN, LDAP auth straight to a DC	SAML with Entra ID; delete the LDAP profile
"Failed to generate SAML AuthnRequest"	FDM 7.2 rejects Entra's non-CA signing certificate	Upgrade to 7.3+ and use Skip CA Check
SAML login URL missing the port	FDM builds the base URL from the outside-interface FQDN	Run VPN on 443 or include the port in the FQDN
Upgrade fails at `800_post`	Expired `DefaultWebserverCertificate`	Replace it before upgrading
"Single local user" error	Second Windows session signed in	Sign off the extra session
TLS error, then relay state 716164	DLP agent intercepting HTTPS	Exclude VPN and Microsoft sign-in domains

Pre-flight checklist

show aaa-server confirms whether the VPN is the lockout source
Confirm whether FTD is managed by FDM or FMC, and which version
No expired certificates under Objects → Certificates
FDM backup downloaded off the box
Users registered for MFA before cutover
Certificate issuer for login.microsoftonline.com checked on a managed laptop
New connection profile tested with one user before moving everyone
Old LDAP profile deleted after cutover

Microsoft 365 emails to Gmail getting blocked with 550 5.7.1 errors

2025-02-20T14:47:00.001+03:00

We are using Microsoft 365 for their email service and recently faced an issue where outgoing emails to Gmail were not getting delivered because of the following error :

550 5.7.350 Remote server returned message detected as spam -> 550 5.7.1 [2a01:111:f403:c40f::7 19] Gmail has detected that this message;is likely suspicious due to the very low reputation of the sending;domain. To best protect our users from spam, the message has been;blocked. For more information, go to; https://support.google.com/mail/answer/188131 d9443c01a7336-220d5320c49si112823045ad.160 - gsmtp

Now unless you have some kind of gold-star support with either Microsoft or Gmail, you are stuck with combing through documentation and forums to understand where to even start troubleshooting this error. The usual steps of checking if the domain is listed on spam sites (MultiRBL) and if TestExchangeConnectivity didnt give much insight into the error.

After an hour of going through various forum posts, there was a set of posts with a workaround for a similar situation of emails being sent from Microsoft 365 servers.

The issue that was identified was that Gmail was blocking emails sent to their servers from IPV6 addresses which were used by Microsoft, as these IPs were not listed on the SPF record of the domain sending the email.

Now Microsoft documentation recommends to add "include:spf.protection.outlook.com" to the domain SPF record. And technically it "should" resolve to all the outgoing IPs of Microsoft . But I assume in this case the IPv6 server IPs are not resolved here, and so it gets blocked

The rule was to filter emails sent to gmail.com or *.gmail.com and the option to select was the MX record option. The idea here was that DNS resolution using the MX record would force resolution in IPV4 and everything will go well.
So I setup the rule, and the connector allows for validation, which also worked.
Great!
Not really.
The next day, the problem started again. And this time the connector validation was also failing.
After some more digging around, someone figured out a brute force way of updating the SPF record with +ip6:2603:1000::/24 which sort of blanket whitelists the Microsoft IPV6 range.

The connector validated successfully after this. And outgoing mails to Gmail started working again!

Now we wait and see what Gmail does next :)

Fortigate SDWAN with IPSec Site-to-Site VPN and multiple subnets at both sites

2024-09-04T14:49:00.004+03:00

Recently, I was tasked with setting up a Site-to-Site VPN between a Fortigate FG100-F in a High Availability (HA) configuration and a FG60-F. Both sites featured dual WAN links configured in an SD-WAN setup, along with multiple VLANs.

I needed to setup multiple VLANs at the branch office Fortigate. I used the VLAN switch feature to create VLANs as sub-interfaces, and then added them to a zone to help with inter-vlan traffic, and for easier firewall policy configuration

To completed the site-to-site VPN links despite consulting the Fortigate documentation, I couldn't find an example that exactly matched this scenario.

After some extensive searching, I found a YouTube video that demonstrated this particular setup. You can watch it here.

YouTube Video Summary

The video, although in Spanish, provides a detailed walkthrough of setting up a Site-to-Site VPN between Fortigate devices in a similar environment. It covers the configuration of dual WAN links, SD-WAN, . Thanks to YouTube's caption feature, I was able to follow along and apply the configurations needed for my setup.

The video demonstrates how to combine IPsec tunnels with SD-WAN to balance traffic across multiple internet providers. It includes configuring two IPsec tunnels between SP1 and SP2 interfaces of two Fortigates and setting up SD-WAN to use these Fortigates for health checks.

Network Configuration:

Interface Configuration: Assign ISP1 and ISP2 to the "wan internet" zone with their respective gateways.
Routing and Policy Setup: A default route and an internet policy are created for outgoing traffic on LAN

IPsec Tunnel Configuration:

Two IPsec tunnels are configured between the Fortigates with identical settings.
SD-WAN zones are created, and the tunnels are added to these zones.

Loopback Interface and Static Routing:

Create a loopback interface on both Fortigates for monitoring.
Set up static routes using these interfaces.

Policy Configuration and SD-WAN Optimization:

Policies are created to route traffic based on the loopback interface.
SD-WAN rules are configured to route traffic through specific IPsec tunnels based on latency.
The video demonstrates how latency can trigger a switch between tunnels.

This video is an excellent resource for setting up IPsec with SD-WAN on Fortigate devices, especially in scenarios requiring dynamic traffic management based on link performance.

For more details, you can watch the video here.

Troubleshooting the Ping Issue

One problem I encountered was that after bringing the VPN links up ,ping was working from the Branch to the HQ, it wasn't working the other way around. To diagnose this, I used the following Fortigate CLI commands:

di de reset
diagnose debug flow filter addr <src-addr>
di de flow filter proto 1
diagnose debug flow show function enable
diagnose debug console timestamp enable
diagnose debug flow show iprope enable
diagnose debug flow trace start 30
diagnose debug enable

The issue was traced back to the SD-WAN policy rules at the HQ. The policy was configured to 
route all traffic through the WAN links, completely bypassing the VPN interfaces. I had to modify
 the policy to include more specific destinations, which allowed outgoing VPN traffic to be routed 
 correctly through the VPN interfaces.
This setup, while challenging, was a great learning experience, and the YouTube video was 
instrumental in helping me navigate the configuration process.

Handling PDF Size Issues with Protected Files: A Solution Using Microsoft PDF Printer

2024-08-05T11:39:00.002+03:00

In a recent project, I encountered a challenge involving a protected PDF file that needed to be included in a multi-page document. The PDF file was around 100 KB, and due to file upload limitations, the entire document had to be under 2 MB. Unfortunately, the protection settings of the PDF prevented it from being added to the multi-page document, citing security restrictions. Additionally, Adobe's PDF printer does not allow printing protected PDFs to a new PDF file—quite a limitation from Adobe!

To work around this, I used the Microsoft PDF Printer, which allowed me to save the file as an unprotected PDF. However, this resulted in a significant increase in file size, ballooning to around 3 MB. Despite attempting various methods to reduce the size, such as using "Optimize PDF," "Reduce PDF Size," and online compression tools, the results were minimal.

After further research, I stumbled upon a forum suggestion to use the "Print As Image" option in the Advanced settings of the Microsoft PDF Printer. This setting effectively reduced the file size to less than 500 KB, well within the required limit.

This technique can be a valuable solution for anyone facing similar issues with protected PDF files and file size constraints.

Adobe Acrobat DC Fill & sign Tool missing

2019-08-28T10:43:00.004+03:00

Acrobat DC has a nifty tool to allow placing of saved signatures on documents.
After a recent laptop replacement, one user couldnt find the tool to place the signatures needed.
The issue came out to be that Acrobat removes the tool if the language setting of the applications is not set as English only. The application here was set to English & Arabic
You have to go to Edit->Preferences->Language
The Application Language option should be set as English Only
After restarting the program, the Fill&sign option appeared in the Tools Section

Ref: https://forums.adobe.com/thread/1945290

Renew expired Microsoft Exchange Server Auth Certificate

2019-03-18T14:01:00.000+03:00

Today our Exchange servers refused to send out emails to the user mailboxes. After going through the logs, Warnings popped up for Exchange OAuth, which said that SMTPReceive connector was failing because of a certificate issue.

So Exchange server installs a server authentication certificate used for Organizational Authentication for itself and other Exchange servers in the organization for intra-site communication, during initial setup

Usually these certificates have a 5 year validity. Upon expiry, some services start failing to work as needed.

Following the link and steps below, i was able to get the services up and running again.

ref: https://community.spiceworks.com/topic/512374-missing-the-microsoft-exchange-server-auth-certificate

New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn= Microsoft Exchange Server Auth Certificate" -DomainName "*.yourdomain.com" -FriendlyName "Microsoft Exchange Server Auth Certificate" -Services smtp
Do not accept to replace the SMTP certificate when prompted
2. Note the thumbprint of the new certificate. Let us assume it is 7A39541F8DF58D4821967DD8F899B27410F7C081
3. $a=get-date
4. Set-AuthConfig -NewCertificateThumbprint 7A39541F8DF58D4821967DD8F899B27410F7C081 –NewCertificateEffectiveDate $a
Accept to continue despite the fact that the certificate effective date is not 48 hours into the future
5. Set-AuthConfig –PublishCertificate

6. Make sure to remove any potential reference to the previous certificate (which might not exist anymore) by doing Set-AuthConfig -ClearPreviousCertificate.

Access Denied Error on Exchange Management Shell for Exchange 2013

2019-03-18T13:56:00.003+03:00

So I tried opening the EMS tool on our Exchange server and i was getting the dreaded Access Denied error. I was also unable to open the Exchange Toolbox.

First issue i noticed was that the server time was off by 6 minutes. So I got that fixed first.

w32tm is the utility used for that.

But that didnt help with the original error

After having enough of going through the logs for errors, and getting fed up of googling, i came across a forum which talked about two modules used by IIS to support authentication on the Powershell Folders under the Default WebSite, and the Exchange Back-End Site

1. WSMAN
2. KERBAUTH

So I left KERBAUTH module on for the Powershell Folder under Default Website and removed WSMAN module from there.
I enable KERBAUTH and WSMAN for the Powershell folder under Exchange Back-End

Both modules have to be native and local when enabled. You can find them under the Configure Native Modules setting on the right side pane

Its better to run iisreset after any change to the IIS settings to be sure of the effects of your changes.

After setting this combo, both EMS and Toolbox started working.

QuickParts button in Word 2013

2019-02-26T11:31:00.001+03:00

I got to know about a nice feature in Word while looking to solve a problem for a office user.
The user wanted to include customized header and footers so that they could be selected from the header drop down list

The Quickparts button is available under the Insert Tab .

Select the content that you want to replicate later. Click the QuickParts button, choose Save to Quick Part gallery.

Then the building blocks menu comes up, and you can change the Gallery to which it is saved. Choose the Headers Gallery, and give the selection a name to be referenced to later.

Once saved, the selection will be available for all future documents. This however requires you to save these changes to a file called BuildingBlocks.dotx, which Word will ask for when closing the program.

The new custom header will now be available under the Headers drop down menu.

Even footers and tables can be customized in a similar manner.

For further info, please have a look at this link from TechRepublic.
https://www.techrepublic.com/article/office-q-a-adding-custom-headers-to-words-headers-gallery/

Cisco 881 with Thomson Speedtouch ADSL

2011-08-18T11:55:00.000+03:00

The requirement was to have the Cisco 881 WAN port control the PPPOE connection, and have it's IP as the external IP of the connection. The Cisco 881 however does not have an analog telephone port so as to directly dial the connection. The CPE here that was provided was an Thomson Speedtouch ADSL router. The Cisco WAN port is connected to one of the Thomson ethernet ports.

If the PPPOE connection is configured on the Speedtouch as well as the Cisco 881, then there will be a fight between the two, to control the connection, the result being that the connection will keep dropping, expecting one of the two to dial.

What needs to be done is to setup the Thomson Speedtouch as a bridge, using the Easy Setup wizard on its web interface. This way, the only router that will dial the connection is the Cisco router and hence will receive the external IP of the ADSL connection on its WAN interface.

Fujitsu-SAN!

2011-08-18T11:44:00.000+03:00

I got an opportunity to setup a Fujitsu Eternux DX 80 Storage with a Fujitsu RX 200 server. Once the storage was out of the box, it was just a matter of putting up the railings and slowly placing the storage onto the grooves. Since the hard disks come pre-configured, there was no need to install them separately. I connected a laptop to the MNT port for configuration and setup an IP in the default IP range of the MNT port ( 192.168.1.1). Logged on to the web-interface using the default u/p combo (root/root). Setting up the RAID config and the volumes was quite easy, thanks to the detailed but well thought-of setup wizard.

Now the MNT port is used only for management through a direct connection to a device like server/desktop/laptop and cannot be connected to a switch. For that there is a RMT port which can be setup for remote configuration. Also , the MNT and RMT ports can't be on the same subnet.
trust me, I tried!

Now comes the part of setting up the volumes so that the server can see them. This setting is know as host affinity where we can set up the volumes in such a way that they can be 'reserved' for certain hosts. Very useful in the case of when the storage is connected to a fibre switch. This is done by using the feature of the fibre card known as WWN or World-Wide Name. This basically identifies the fibre card installed on the server to which the volume has to be associated to.

Once the volumes are setup , we needed to wait until the formatting is done.This took a while because one volume was 4TB and the other was 2TB. I tried setting up the server to recognize the volumes but it wouldn't show up. The formatting took a while to complete. Im not sure how long because I came back the next day to check, and it was done.

My first misconception was that the Storage volumes would show up during the HBA scan that usually happens when the server starts up. But after a little bit of reading, I found out that only certain fibre cards support this feature whereby you can actually boot from a SAN!

So in this case, the server OS had to load the drivers for the Fibre card , only after which the volumes could be detected. This server was running Ubuntu Server 11.04, so drivers wouldn't really be a problem.

Once the host affinity was configured and the volumes had completed formatting, the volumes showed up under devices folder on the server.

Shazam!

2011-02-16T14:53:00.000+03:00

My brother bought a Nokia X3-02 recently, and he was going through the Nokia Ovi Store, and found an interesting app,called Shazam (www.shazam.com) they've got apps for mobiles and the pc. it's an online service, which can by listening to any song clip or part of a song, identify it and give you the song details.

The wiki article http://en.wikipedia.org/wiki/Shazam_(service) makes for interesting reading. Apparently there's something known as acoustic fingerprints for audio files.

Cisco 887 and VPN

2011-02-16T11:37:00.001+03:00

I'm setting up a Cisco 887 ISR where the internet facing interface is ADSL and this router is the main router for the LAN

Configure the Easy VPN server using Cisco Configuration Professional
1.Create a Loopback interface with IP address 10.10.10.10
2. Configure a Group Name along with a Pre-Shared Key.
3. I'm using a local user database for authentication by enabling AAA logins, so the user authentication is taken care of by the router.
for those who want to configure domain authentication, here's a link a found, but haven't tried yet.
http://www.blindhog.net/cisco-aaa-login-authentication-with-radius-ms-ias/
4. Setup an IP range in your network which is not under the common DHCP pool for your vpn clients

I was facing a problem with getting a VPN client for this setup, because my CCO login doesnt have a technical agreement attached to it, and I couldn't find any pointers as to how i can add it.

So I googled and found a few links where I could download it from
http://helpdesk.ugent.be/vpn/en/akkoord.php

But this VPN client could only be installed on 32 bit systems, except for the AnyConnect client , but that supports only SSL connections, for which I would have to purchase individual user licenses.

One option to install the 32 bit client on a 64 bit Windows 7 system , was to run the client in XP mode, and then do a NAT to the host computer. A little complicated but, apparently it works!

http://blogs.nil.com/blog/2009/05/28/64-bit-windows-7-cisco-vpn-client-and-xp-mode-part-2/

After some more googling, I found that Cisco did release a 64 bit VPN client , even though it was in beta.

I'm sorry that I'm not able to paste the link for this client, because when I looked for the download link now, it's been taken offline. I tried to find it again, but all I could find were torrents. They should work too, but I haven't tried them.

The version number for this client is Cisco VPN Client 5.0.07.0290 x64

Once the client is running, you can configure the connection by giving your group name as Name and the Pre-Shared Key as your password.

Once the router has connected, you will be asked for your user login. This is where the user database comes in.

Once you put in the correct user details, you're logged in!

Outlook, POP3 and Outbox issues

2010-11-12T23:11:00.000+03:00

A close friend of mine works as the IT manager for a construction company. He mentioned an interesting incident that happened at his office. He was facing problems with a few systems at his office. When users try to send emails, most of the time the mail would get stuck in outbox and not finish sending. It will finish only after he re-opened and sent it again or if he restarted outlook. He tried a lot of things to get it fixed like re-installing and even changing his internet router! Changing the router solved a lot of other problems but not this one! he did notice something odd. While trying to send , outlook would show Sending 1/800 or some huge number, but the number of items in Outbox was not more than 10. After a little bit of googling, he found a article which talked abt read receipts. it also talked abt a tool to check the number of pending read receipts, and cancel them manually. When he ran the tool on one system he found 600+ read receipts pending. After a boring few hours of manually clearing all the read receipts, outlook started working without any hassles.

Cisco switches and virtual machines

2010-11-12T22:32:00.001+03:00

A very interesting thing happened recently. A server running on centos , was setup as a base OS for 3 windows virtual machines - a domain controller, a database server, and an antivirus server. Last week the database server stopped responding. A restart didn't solve the problem. Even pinging didn't work. So the admin decided to restart the physical server itself. After the restart all the virtual machines stopped responding! A few more restarts , and checks on the network settings of the physical server, vm and there was no change. The admin disabled the physical network card and restarted the vms and servers. After re enabling the card suddenly the dc started responding and the physical server stopped responding! That's when the admin decided to take a break and re-assess the situation.
He had one physical server, and 3 vms. One of the vms was responding on the LAN. The physical server and the other two vms were not responding to any requests. But he had done restarts before and this was a new thing. The only change he could point out was that he had replaced one of the 3com switches with a cisco 2900 managed switch. This was to setup a gigabit uplink. It was a shot in the dark but we removed the server network cable from the cisco switch and plugged it into another 3com switch in the rack, and presto , all the servers and vms started responding. :) after doing a bit of reading, a particular setting on the cisco sets it to accept traffic only from one IP per port. that's why even though the dc was responding, the physical server was not allowed to respond.

Now that's what I call security. Good stuff, cisco!
Sent from my BlackBerry® smartphone from VIVA

Untangle

2010-10-21T00:45:00.000+03:00

A good friend of mine, Hussain, brought up an issue at one of his sites. The users were using up all the bandwidth, and he wanted an option where could control bandwidth and traffic. He basically listed a few requirements :
1. Bandwidth control
2. Content Filtering
3. Central user control

Having worked with Microsoft technologies for sometime, I was tempted to suggest Forefront 2010. But he had mentioned that this was just an internet-sharing, non-domain enviroment. So I started looking elsewhere,and after a bit of googling, I came across Untangle (www.untangle.com). It's an open-source firewall/router with a few nice plugins that come for free, and some awesome plugins that you have to pay for.

I downloaded the ISO (450Megs for the 32-bit version) , and burnt a CD. Once we setup a PC for use, I popped in the CD and started the install. Untangle comes in a few versions ,(1.Standalone OS - based on Debian, 2. Windows based.,etc). Since this PC was not going to be used for anything else, I started the Standalone OS install. The installation was pretty simple with a few prompts for hard disk partitioning and some features. After I rebooted into the OS, then the setup wizard started, asking about network settings.

I entered the required settings, then the base OS came into view. The base OS is nicely designed with a dock at the bottom,showing the client icon and icons for terminal, reboot and shutdown.
You will be using the client mainly, which is a web-based client that opens up in Iceweasel.
After the first login, you will be asked to select the app packages that you want to install. They have a few questions as to what your installation will be used for, and then selects that packages based on your answers. You can customize the final selection , and start the download. There are a few big plugins, so be prepared to wait for the download to complete. I discovered this the hard way. While downloading the packages, I started playing the ADSL router settings, and in between I had to reset the router. I expected the download to resume on it's own. But it didn't :). So the package installation came up with an error message stating that apt-get exited with a code of 1! I tried restarting the package installation, but the error message came up again. So I was back on google, trying to find a solution. The untangle forums were very helpful, and the package installation procedure is properly logged in the log directory. I opened terminal and ran a command mentioned in the forums tail -n 100 -f /var/log/uvm/apt.log. This showed that one of the packages was not finishing it's installation. So I deleted the package, and restarted the download manually, using the apt-get command.Once the download completed properly, I could download apps using the GUI.
The interface is well designed and easy to navigate.
We've put up the rules,and the firewall was responding properly. The installation is still under testing, let's see how the response is.

In the beginning, there was a blog!

2010-10-21T00:16:00.000+03:00

4+ years of being a system admin takes its toll on the mind. It's always been in the back of my mind to put down atleast some of the experiences I've had, with regards to IT that is. Bahrain, being a small island in the Arabian Gulf, and my home for the most of my life, doesn't really provide a HUGE amount of opportunities to experience IT in it's entirety. You could pin it on the laid-back attitude of people in embracing new forms of technology, or just the lack of resources for support and encouragement. This is just my opinion btw. I'm definitely interested in hearing an argument on this subject.

So as of now, I'm going to start penning down my IT experiences , and maybe I'll look back at it after a few years and smile!

To infinity and beyond!!!....