Auditing Exchange Online Transport Rule Use

I recently came across a transport rule being unnecessarily used in Exchange Online. The transport rule in question was used for DLP, and encrypted messages based on the content. It searched message bodies for strings of characters matching credit card numbers, SSN's, etc.  I was surprised to see that there was no way to easily audit transport rule usage with Powershell, so I checked the Exchange Control Panel. There is an option for auditing in each of the transport rules:



So, what does this checkbox actually do?

Enabling this checkbox will cause this rule to appear in Message Trace logs when it is applied to a message. 

Let's look at an example:

Here we have a transport rule in Exchange Online that appends "Outbound" to the subject line of all messages sent to external recipients:



 

After sending a message to an external recipient, we can see the rule working:



Let's take a look at the message trace:



We can see two entries in the message trace log. The first is for applying the transport rule, and the second entry is for setting the audit severity level. I haven't found a good explanation of the audit severity levels, other than you can filter by them when doing a message trace.

If you know of any other use for the audit severity levels, leave a comment below!

vSphere - Unable to Apply DRS Resource Setting on Host

I noticed this error on one of my hosts today. After reading the full error message on the Events tab, and paying particular attention to the "Error Stack" section, it was obvious what the problem was.



"The configuration file of the virtual machine is corrupted". Well, that helps narrow things down, but what virtual machine is it?

After clicking on the host and going to the Related Objects -> Virtual Machines tab, the problem became even more clear.



This was a replica that we deleted last weekend. For whatever reason, vCenter didn't de-register it from the database when it was deleted. The VM no longer existed on the host. To fix the issue, just right click on the VM and click "Remove from Inventory".

After doing this DRS became healthy and all alarms were silenced. I hope this helps anyone experiencing this or a similar problem.

-Ryan

Migrate Windows Deployment Services to New Server

We have been making a great effort to move all of our internal services to Windows Server 2016. This past week, it was WDS' turn to get migrated. Migrating this role is extremely simple. Here are the steps that I took:

1. Create new server and install WDS role.


2. Stop WDS Service on old server


3. Stop WDS Service on new server


4. Use my "Copy-Files" PowerShell script (Available Here: Copy-Files.ps1) to copy RemoteInstall Share to new server


5. Start WDS Service on new Server


6. Shutdown old WDS Server completely


7. Update option 66/67 in DHCP scopes to reflect new WDS Server


8. Update any appropriate DNS records

Note:

If you are unable to start the WDS service, delete the WDS database and logs from the old server located at <drive letter>:\RemoteInstall\Stores\Metadata\*.*. You should be able to start the service after deleting these files.

Simple enough! :)