Some Notes on the Machines

Sometimes, when software won’t install, especially something like ShadowProtect SPX which includes a driver, it is because of corruption of one or more internal Windows certificates. A method recommended to some extent in a few Microsoft resources:

certutil.exe -generateSSTFromWU roots.sst
Import-Certificate -FilePath .\roots.sst -CertStoreLocation 'Cert:\LocalMachine\Root' -Verbose

This does not always work. The only thorough method currently known to this writer, is to download this:

http://media.kaspersky.com/utilities/CorporateUtilities/rootsupd.zip

which contains a binary called “rootsupd.exe”. It will unpack itself if one runs it in administrative CMD, with syntax like this:

rootsupd.exe /c /t:C:\rootsupd

It will create the folder C:\rootsupd. Then go into C:\rootsupd, and do these (administrative CMD, not Powershell for some reason!):

updroots.exe authroots.sst
updroots.exe -d delroots.sst
updroots.exe roots.sst
updroots.exe updroots.sst

rootsupd.exe was, according to Google, available by download from Microsoft, but is not at this writing.

One does not have to reboot the system after doing the above, so far it just works.

In administrative Powershell:

1. Install-Module AzureAD
2. Install-Module MSOnline
3. Connect-AzureAD
4. Connect-MsolService

In Active Directory Users and Computers, remove the user object from OU being AD-synched. Then complete an Azure/AD sync cycle. Then:

5. Restore-MsolUser -UserPrincipalName users_login_probably_email
6. Set-MsolUser -UserPrincipalName users_login_probably_email -ImmutableId "$null"

Do the last step before the next automatic AD sync!

Here they are.

A great summary of FTP conversation over TCP:

https://www.ncftp.com/libncftp/doc/ftp_overview.html

A couple of links:

https://itpro-tips.com/2019/this-users-on-premises-mailbox-hasnt-been-migrated-to-exchange-online/

https://answers.microsoft.com/en-us/msoffice/forum/all/this-users-on-premise-mailbox-hasnt-been-migrated/5735f499-7079-42a4-a5e9-8da275404d09

One can use this to import really big ones, dozens of gigabytes in size, imports which will crash, hang, and otherwise cough on Outlook very easily. Runs directly to folders inside of mailboxes. The amazing Yvonne Wynkoop found the first really good set of instructions we have seen:

blog.natfan.io/importing-psts

Mysteries do abound about the Microsoft-provided command line tool AzCopy, not the least being the fact that there is a version 10 and a version 8.1. Items as of this writing:

• Version 8.1 is downloadable from Office 365, and works. Have no clue what 10 is for.
• Usage and download of it, is now through Office 365 Security & Compliance, Information Governance, Import.
• When you run it for an upload, add “/NC:2” to the end of the command line. This increases its speed and stability quite a lot, and prevents timeouts. Default is reportedly 24. Perhaps the developers are sitting on Google Fiber?
• If it times out, just restart it carefully, it will usually continue where it left off.

If the above works for you, use the same number when downloading PSTs from eDiscovery, via registry edit:

https://docs.microsoft.com/en-us/microsoft-365/compliance/increase-download-speeds-when-exporting-ediscovery-results?view=o365-worldwide

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\eDiscovery\ExportTool]
"DownloadConcurrency"="2"

Recently received these. Not all work in all versions of Windows. Run these commands in administrative CMD. Some will take effect at next reboot.

netsh int tcp set global chimney=disabled
netsh int tcp set global rss=disabled
netsh int ip set global taskoffload=disabled
netsh int tcp set global autotuninglevel=disabled
netsh int tcp set supplemental custom congestionprovider=none
netsh int tcp set global ecncapability=disabled
netsh int tcp set global timestamps=disabled
netsh int tcp set supplemental custom congestionprovider = ctcp
netsh int tcp set global ecncapability=enabled
reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableTCPA /t REG_DWORD /d 1

If you let the eDiscovery Export Tool time out, it will eventually give you a link:

https://docs.microsoft.com/en-us/office365/securitycompliance/increase-download-speeds-when-exporting-ediscovery-results

which has the registry edit below. No explanation is given, but it does say that adjustment of the number (in some direction?) can help.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\eDiscovery\ExportTool]
"DownloadConcurrency"="2"

Just got this from HP support. They’re taking a while to answer, but they do have some help to give.

For HP business machines: support.hp.com/in-en/document/c05115630

For HP consumer machines: support.hp.com/in-en/document/c06162205

Apparently, not only is there SMB1, SMB2, and SMB3, but there is also NTLMv1 and NTLMv2. If we need to access older NASes and the like reliably, we may need to create or set this DWORD:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel

to 1.