Troubleshooting guides, how-tos, deep dives and certification study plans for Microsoft Intune, Configuration Manager (SCCM), Microsoft Entra ID, Microsoft Defender, Exchange Online and Exchange Server, and Microsoft 365.
Showing all 341 articles
Trace a stuck Wi-Fi or VPN profile back through the certificate chain: trusted root, SCEP/PKCS profile, Certificate Connector and NDES, using the logs and event IDs Microsoft documents.
Outbound mail stuck in Retry with 441 4.4.1 or 421 4.4.2? Test port 25 and the smart host, read the send protocol log, fix the network or TLS cause and retry before 4.4.7 NDRs.
Upgrade Exchange Server 2019 CU14 or CU15 to Exchange Server SE in place: prerequisites, AD preparation, the Setup command, DAG maintenance mode, product keys and post-upgrade checks.
Mail stuck in Submission, event 1050 or EdgeTransport crashes after adding or updating an on-server mail security product? Find the agent, isolate it safely and prove the fix.
Configure single-app and multi-app kiosks with the Intune Kiosk template or Assigned Access XML, set up Shared PC mode, pair with Autopilot self-deploying mode, and fix kiosks that won't launch.
A time-boxed first hour for a Defender XDR incident: claim it, read the attack story, scope users, devices and mailboxes with hunting, contain safely and document the hand-off.
Sign-ins requesting only openid, profile, email or User.Read are now subject to All resources policies with exclusions: who is affected, how to find the apps in sign-in logs, how to fix them, and the timeline.
The folders, processes and file extensions Microsoft says to exclude from antivirus on Exchange Server SE and 2019, how AMSI differs, and how to prove the exclusions work with Test-ExchAVExclusions.
A practical hardening pass for a Microsoft 365 tenant: track progress in Secure Score, then fix admin roles, app consent, legacy authentication, SMTP AUTH, risky defaults and auditing.
Run KQL in Intune against one Windows device in real time or across your fleet's inventory: licensing, permissions, the properties catalog policy and queries you can reuse.
Fix Windows Hello for Business PIN setup failures on Intune PCs: the 0x801C and 0x8009 codes, Event ID 360 prerequisite lines, conflicting policy sources and dsregcmd checks.
What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches.
Architecture differences, the Learn feature comparison, when each sync tool fits, and the documented pilot-OU migration from Connect Sync to Cloud Sync with cloudNoFlow and JoinNoFlow rules.
Prepare the site, get the update through the service connection point, pass the prerequisite check, install it, unstick downloads and installs, and finish the post-upgrade tasks.
Build two cloud-only emergency access accounts with passkeys, keep them out of Conditional Access lockouts, alert on every sign-in and test them at least every 90 days.
ContentIndexState Failed or Unknown, or users can't find mail? Separate client from server problems, reseed or rebuild the Exchange 2016 catalog, and fix search on Exchange 2019 and SE.
Look up a rejection or deferral from Mimecast, Barracuda, FortiMail or Cisco (IronPort) in front of Exchange Server, or Exchange's own reply to the gateway: meaning, who fixes it, first check.
Why did Exchange recycle an app pool or reboot itself? How probes, monitors and responders work, how to trace what Managed Availability did, and when an override is justified.
Messages in the poison queue, or a Submission queue that won't drain? Find what crashed or stalled transport, then export, resume or remove messages safely.
Set up Windows LAPS end to end: enable it in Microsoft Entra ID, build the Intune account protection profile, retrieve and rotate passwords, and check the LAPS event log.
Proofpoint in front of Exchange Server: scope the receive connector, relay outbound through Proofpoint, fix TLS and recipient lists, and work out which side wrote each rejection.
Fix Android zero-touch devices that skip Intune: reseller registration, linking the zero-touch account, DPC extras JSON and tokens, and the checksum and Conditional Access errors.
A balanced look at Jamf Pro and Microsoft Intune for Apple devices in 2026: declarative management, scripting and inventory, Self Service vs Company Portal, compliance, identity and when to run both.
Export your Intune device inventory to CSV with the Microsoft Graph PowerShell SDK, spot stale and noncompliant devices, and run it unattended with certificate-based app-only sign-in.
Run a message trace in the Exchange admin center or with Get-MessageTraceV2, read the delivery status and events, and pull older data from downloadable reports.
Read the X-Forefront-Antispam-Report header (CAT, SFV, BCL, compauth) to see why a good message was junked, then fix it the supported way: submissions, Tenant Allow/Block List, sender authentication, not bypass rules.
Pilot Microsoft Entra hybrid join with a client-side SCP, get computer sync scope right, switch to the forest-wide SCP in Entra Connect and validate with dsregcmd and Graph.
How external collaboration settings and cross-tenant access settings fit together: default vs organizational settings, trusting partner MFA and devices, and B2B direct connect.
A safe runbook for renewing the public certificate behind hybrid mail flow: install it on every server, enable SMTP, update the connectors or rerun the HCW, then prove TLS works.
Samsung devices skipping KME, failing to enroll in Intune or ignoring Knox Service Plugin settings? Check the KME profile JSON, the token, device upload, network and the OEMConfig profile.
How organization, site and link settings combine to decide who can share what in SharePoint and OneDrive, with Set-SPOTenant and Set-SPOSite commands to audit and set them.
A six-stage MS-102 study plan built on the official Microsoft Learn paths, with extra Exchange Online practice, lab ideas and what the November 2026 retirement of the exam means for you.
Fix Ubuntu and RHEL devices that won't register, stay Not evaluated or Not compliant, or get blocked in Microsoft Edge: supported versions, compliance checks, journalctl logs and a clean reset.
Public folders missing, out of date or failing to open in Outlook? Check the public folder mailboxes, each user's hierarchy mailbox, hierarchy sync and folder permissions.
Route Exchange Server mail through Mimecast: regional smart hosts, authorized outbound IPs or SMTP authentication, a scoped receive connector, and the Mimecast replies that point to each fix.
Outlook can't build a profile or warns about an internal server name. Read the Test E-mail AutoConfiguration log, fix the SCP and DNS records, then clear 401, 404 and certificate failures.
Store processes holding most of the RAM is by design; sustained high CPU isn't. Map the busy process to its cause - search, IIS app pools, transport - and capture evidence with ExPerfWiz.
How 26H2 installs as an enablement package, the Intune feature update policy and rollout options to deploy it, the known issues listed at launch, how safeguard holds show up, and how to verify a device.
Install Microsoft 365 Apps from the Configuration Manager console, then update it through the software update point: products, client settings, channels, ADRs and the logs that prove it.
Follow any email through Exchange Server SE or 2019: read the tracking event IDs, filter Get-MessageTrackingLog, search every server and set log retention.
Why Intune shell scripts and custom attributes don't run on Macs: the agent's 8-hour cycle, user vs root context, shebangs, exit codes and proxies, plus agent logs and Collect logs.
Add a WMI class to Configuration Manager hardware inventory, pilot it, and follow the data from InventoryAgent.log through MP_Hinv.log and dataldr.log to Resource Explorer.
Set up account-driven User Enrollment for personal iPhones and iPads in Intune: Managed Apple Accounts, the service discovery file, JIT registration, the enrollment profile and the user flow.
Deploy Microsoft 365 for Mac, Company Portal and Microsoft AutoUpdate with Jamf Pro: official packages, App Installers or policies, an MAU profile, activation and verification.
Decode MSExchange Common event 4999: which process failed, where and why, how to tell noise from real crashes, and how to match the report to bugs fixed in later updates.
A simple change routine for Microsoft 365: Message center preferences and digests, Planner sync, service health alerts, Targeted release and the Graph service communications API.
Purview retention policies vs retention labels vs Exchange MRM tags vs litigation hold: what each does, what wins in a conflict, licensing, how to set them up and how to prove a mailbox is really on hold.
Edge keeps asking Windows users to sign in, or MAM never applies? Check prerequisites, the Conditional Access grant, the Edge profile and the Windows Security Center connector.
A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke.
Autopilot pre-provisioning for hybrid join fails in the technician flow when a policy such as a User Rights setting needs a domain controller. How to read the 0x800706FD event and fix the scoping.
Fix Intune macOS PKG and DMG app failures: the documented 0x87D3 error codes, LOB vs unmanaged PKG rules, Included apps detection, pre-install scripts, agent logs and verification.
Build one Patch Tuesday automatic deployment rule with pilot, early and broad deployments, an offset schedule and maintenance windows, then confirm each run in RuleEngine.log.
Find expiring app secrets and certificates with Graph PowerShell, lock down user consent, enable the admin consent workflow and track down over-privileged service principals.
Passive DAG copies falling behind? Learn what the copy and replay queues measure, find out whether the network, storage or a lagged copy is responsible, and watch the queues drain.
Outlook can't download the offline address book from Exchange Server? Check the OAB assignment, web distribution, generation mailbox and OAB URL, then force a clean download.
Exchange Web Services is being disabled in Exchange Online from October 2026. What changes, how EwsEnabled and EwsAllowedAppIDs work, how to find what still uses EWS and how to buy time safely.
Which mailbox permissions work between Exchange Server and Exchange Online, how to make objects ACLable, and how to grant Full Access, Send on Behalf and Send As correctly.
Look up an Android error in Intune: DeviceCapReached, Company Portal Temporarily Unavailable, work profile and corporate enrollment blocks, Play Integrity and other compliance failures.
Use Intune's co-management settings policy to install the Configuration Manager client from the CMG during Autopilot, keep the ESP within its timeout and check each stage.
Find the message, read why it was quarantined, release it, and report it through Submissions so a scoped, expiring allow entry replaces risky mail flow rule bypasses.
A reused Autopilot device fails MDM enrollment with 0x80180014. Why it happens, and the documented fixes: unblock or remove the stale Intune record and check enrollment restrictions.
Why Exchange Online rejects mail with 550 5.4.1 at the perimeter, how Directory-Based Edge Blocking and the accepted domain type cause it, and how to fix each common cause.
Licences and roles, techniques, payloads, targeting, training and launch settings for a Microsoft phishing simulation, how to read the results, and where advanced delivery fits.
Renew the public SAN certificate on every Exchange server and rotate the Auth certificate before it expires, with the commands, the checks and the hybrid follow-up.
A Windows device shows a stale last check-in in Intune and policies stop arriving. How check-in works, what to inspect on the device (service, tasks, certificate, network) and when to re-enroll.
Apple Business Manager apps assigned in Intune stay pending or fail on iPhones and iPads. How location (VPP) tokens and licences work, what the 0x87D13B error codes mean, and what to check in order.
Pick the right Intune remove-data action: what wipe, retire, Fresh Start and Autopilot Reset remove and keep, what they need to run, and why actions stay pending or fail.
Enable network protection from Intune, turn on web content filtering, build category policies scoped to device groups, add allow indicators, and read blocks in reports, Event Viewer and advanced hunting.
How Entra Connect Sync builds retire, the April 2027 application-based authentication deadline, what auto-upgrade won't do, and how to upgrade and verify safely.
What Built-in protection, Standard and Strict presets enforce, how they outrank custom threat policies, what you still have to configure for impersonation protection, and how to verify which policy handled a message.
Set up Defender for Endpoint live response with guardrails: advanced features, unified RBAC roles, a signed script library, evidence collection and the session command log.
A failed or interrupted Exchange CU or SU can leave services Disabled. Restore the original startup types, start the services and finish the update properly.
Set up Intune's new TeamViewer connector, delegate sessions with RBAC, prepare TeamViewer (client, Device Sync, SSO), fix common launch problems and compare it with Remote Help.
Queues stuck in Retry with 451 4.4.0 DNS query failed? Find the DNS servers transport really uses, test lookups from the Exchange server, and fix the resolver or connector.
How access reviews and entitlement management fit together in Microsoft Entra ID Governance: licensing, creating reviews, catalogs and access packages, and a starter plan you can run this quarter.
Publish one correct SPF record, turn on DKIM signing in the Defender portal, then move DMARC from p=none to p=reject without blocking your own legitimate mail.
A six-stage study plan for exam SC-300, mapped to the official Microsoft Learn learning paths, with hands-on labs for Conditional Access, authentication methods, PIM, access reviews, apps and Entra Connect.
Look up an Exchange Server event by ID and source: what 15004, 2142, 474, 1135, 4999 and 38 more events mean on Exchange SE and 2019, the usual cause and the first check.
Use Defender for Endpoint as your Cloud Discovery source, judge apps by risk, then warn on Monitored apps or block Unsanctioned ones on devices through network protection.
How Safe Links rewriting and time-of-click checks work, what the Safe Attachments actions do, how to find out why a click was blocked, and how to allow a legitimate URL without weakening protection.
How to read Entra Connect export errors such as AttributeValueMustBeUnique, InvalidSoftMatch and LargeObject, fix matching problems with ms-DS-ConsistencyGuid, and find objects that filtering keeps out of Entra ID.
Exchange 2016 can't be upgraded in place to SE. The side-by-side route step by step: prepare AD, add SE servers, move namespaces, mail flow and mailboxes, then remove 2016.
Follow a failing Configuration Manager app through the client logs - evaluation, content, install and detection - and fix stuck installs, timeouts and 0x87D00324.
Outlook on iOS or Android ignoring your Intune app protection policy? Check targeting, licensing, the signed-in account, broker apps, check-in timing, reports and Edge diagnostics.
Deploy Intune Endpoint Privilege Management: the elevation settings policy, elevation rules by hash or certificate, the user experience, the elevation reports, and how to troubleshoot rules that don't match.
Why iPhone and iPad profiles show Error, Conflict, Pending or Not applicable in Intune, why supervised-only restrictions don't take effect, and how to check the device and prove the fix.
Use report-only mode, the sign-in logs, the insights workbook and the What If tool to prove a Conditional Access policy behaves as expected before you turn it on.
A staged way to switch co-management workloads to Intune: what each slider really controls, pilot collections, the client logs to watch, rollback caveats and a sensible order.
What enhanced HTTP and PKI-based HTTPS each protect in Configuration Manager, why HTTP-only sites are deprecated, and how to check, switch and verify without stranding clients.
Win32 app stuck downloading or failing with 0x87D30065, 1603 or 1618? Find the failing stage in AppWorkload.log, fix content delivery and installer exit codes, then verify.
Why Exchange Server security updates fail or break OWA and ECP, the documented fixes for the common errors, and the checks that prove an update really installed on every server.
OWA and the EAC loop at sign-in, Event ID 1003 appears or hybrid OAuth fails? Prove the Exchange Auth certificate is expired or missing, then replace it safely.
Feature update policy assigned but nothing offered? Check licensing, join type, telemetry, update ring deferrals, WSUS and Group Policy, hardware readiness and safeguard holds.
What the Microsoft MVP Award recognises, how nominations and reviews work, which contributions count (and which don't), and a simple log template to track your community work.
Event 2937 means an Exchange object still points into AD's Deleted Objects container. Find every affected object, then fix HomeMTA, RecipientContainer and connector links safely.
A vendor-neutral design for sending Exchange Server mail through DLP and encryption gateways: forward vs return patterns, connectors, verdict headers, fail-open choices and tests.
A five-stage plan for Exam MD-102 and the Endpoint Administrator Associate certification: the current skills-measured domains, the Microsoft Learn paths to follow, lab exercises and exam-day tips.
A capability-by-capability comparison of distribution groups, dynamic groups, Microsoft 365 Groups and shared mailboxes, when to choose each, how to upgrade a DL and the PowerShell to answer the usual questions.
What Conditional Access token protection binds, which platforms, apps and licences it needs, and how to roll it out in report-only mode using the sign-in log status codes.
Find the app or policy holding up the Enrollment Status Page, collect the right logs from OOBE, and fix the profile settings behind most Autopilot ESP timeouts.
A walkthrough of the Windows Autopilot known issues page as of October 2026: open and fixed items, deeper guidance on the January 2026 entries, and how to subscribe so new issues reach you first.
EMS fails with a WinRM error? Match the exact message to its cause - kerbauth and WSMan modules, Remote PowerShell access, the port 80 binding, Require SSL or a proxy - and fix it safely.
Outlook keeps asking for credentials against Exchange Server? Work through cached credentials, Autodiscover, virtual directory authentication, Kerberos, Extended Protection and modern auth.
ESE event 474 and error -1018 mean a database page failed its checksum. Why storage is the usual suspect, how DAG page patching helps, and when to reseed, restore or repair.
Diagnose an unhealthy Configuration Manager management point with mpcontrol.log, status message 5436, mplist and mpcert tests, IIS and SQL checks, and the client-side logs.
Fix the errors you hit when FortiMail filters mail for Exchange Server: 550 5.7.1 Relay access denied, 451 Try again later, failed recipient verification, plus connectors, TLS and SPF.
Windows profile showing error 65000 or Remediation failed (0x87D1FDE8)? Decode the codes, read event 404 on the device, check edition, build and OMA-URI data, and fix the setting.
Build a two-tier Microsoft Cloud PKI hierarchy in Intune, deploy the trusted certificate and SCEP profiles, bind the certificate to Wi-Fi or VPN profiles, monitor and revoke, and fix the common SCEP errors.
Pure on-premises Exchange can accept OAuth tokens from AD FS instead of passwords. Prerequisites, the AD FS application group, auth policies, Exchange and Outlook settings, and testing.
Veeam jobs failing on the Microsoft Exchange Writer, or logs not truncating after a green job? Check application-aware settings, guest credentials, freeze timeouts and DAG job design.
The known issues Microsoft lists for the latest Exchange Server SE security update, the hybrid issues it fixed, how to confirm each one on your servers and where to watch for changes.
Working dynamic device rules for Autopilot, group tags, OS version, ownership and enrollment profiles, plus licensing, processing time, rule validation and when filters fit better.
Set up any load balancer for Exchange Server SE and 2019: per-protocol healthcheck.htm monitors, SSL bridging with Extended Protection, no affinity, SMTP and Kerberos, and bad-VIP symptoms.
Test-IRMConfiguration failing on Exchange Server with the Microsoft RMS connector? Find the failing step, then fix authorization, registry settings, IRM switches or the DRM cache.
Silent BitLocker not starting? Check TPM, UEFI, Secure Boot and WinRE, the required policy settings, startup authentication conflicts and recovery key backup to Microsoft Entra ID.
Why a hybrid joined PC also shows as Entra registered, what Pending really means, and how to clean up duplicates with dsregcmd, BlockAADWorkplaceJoin and Graph PowerShell.
Take a Purview DLP policy from template to enforcement: simulate with policy tips, tune out false positives, onboard devices for endpoint DLP, then switch it on in stages.
Why some Macs dropped out of Intune during MDM identity certificate renewal, Apple's fix in macOS 26.4, how to find and re-enroll affected devices, and how this differs from an expired Apple MDM push certificate.
A 10-minute checklist to rule out a service incident, a documented known issue or a gradual service release before you troubleshoot your tenant, plus what to collect for a support case and how to subscribe.
Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users.
Why a Windows device fails "Require the device to be at or under the machine risk score", and how to check the connector, onboarding, device identity and active alerts in the right order.
Veeam Explorer can't open an Exchange database or restore items? Point it at the right ese.dll, replay logs on a Dirty Shutdown copy, grant restore rights, or fall back to a recovery database.
The four sign-in log types, the fields that matter, how to trace one failed sign-in end to end, KQL against the SigninLogs table, export and retention by licence, and the misreads that waste hours.
Why Exchange databases never shrink, how to read AvailableNewMailboxSpace, and why moving mailboxes to a new database beats eseutil /d offline defragmentation.
Where the HCW log lives, how to find the line that really failed, and fixes for the usual causes: TLS, stale servers, Autodiscover, certificates, OAuth (HCW8064) and MRS.
User risk vs sign-in risk, the detections behind them, risk-based Conditional Access that lets users fix their own risk, and how to investigate, dismiss or confirm the false positives.
Settings stuck on Conflict in Intune? Find the competing policies, confirm what the device received with the MDM diagnostic report and event log, and rule out Group Policy.
Build a locked-down Android kiosk with Intune: dedicated device enrollment tokens, multi-app kiosk mode with Managed Home Screen, Entra shared device mode sign-in, and fixes for missing apps.
Tell inactive clients from unhealthy ones, read CcmEval results on the device, repair WMI and broken clients safely, and clean up stale records with the right maintenance tasks.
Look up an ESE/JET error from eseutil, a failed mount or the event log: what -1018, -528, -550 and 36 more codes mean in Exchange Server, the usual cause and the first check.
Fix Microsoft Tunnel Gateway problems: stalled installs, Unhealthy health checks, TLS certificate issues, /dev/net/tun and Podman log errors, and devices that won't connect.
Configuring the Intune Connector for AD with your own gMSA can fail on the SeLogonAsServicePrivilege pre-check. The June 2026 known issue, the SkipByoMsaPrivilegeCheck fix and how to verify it.
How the HCW connectors, certificate name matching and header trust keep cross-premises mail internal, when centralized mail transport is worth it, and how to prove it all works.
Set up CMPivot and Run Scripts permissions, query online clients in real time, take a PowerShell fix through approval, then confirm it in Script Status and Scripts.log.
Cisco Secure Email Gateway (formerly IronPort) in front of Exchange: map listeners, HAT and RAT to Exchange connectors, fix relay, rate-limit and TLS errors, and trace mail in both logs.
After the September 2026 Windows 11 updates some domain-joined devices lose their secure channel because Machine Identity Isolation is now honoured. How to find the policy, roll it back and verify.
Edge Transport server not synchronizing? Check DNS, port 50636, services and certificates, re-create the Edge Subscription the supported way and prove it with Test-EdgeSynchronization.
Microsoft Store app (new) installs failing? Decode the WinGet 0x8A15 codes, check Store and App Installer policies, TLS inspection and install context, then test on the device.
How Defender for Endpoint security settings management pushes Intune endpoint security policies to devices not enrolled in Intune: prerequisites, enforcement scope, synthetic registration and pitfalls.
How automapping really works, why group-based Full Access never automaps, how to switch it off per user, and how to keep sent items in the shared mailbox.
Set up the Endpoint Protection point and client settings, build antimalware policies, choose security intelligence update sources and prove on the device that Defender got the settings.
Extend Intune compliance with your own checks: write a discovery script that returns compressed JSON, define rules in the JSON schema, upload both, and troubleshoot error codes 65007 to 65010.
Phones stop syncing or never start. Check the device access state and rules, fix the AD permission problem behind Event ID 1053, and read ActiveSync status codes in the IIS log.
Set up Windows driver update policies in Intune, choose automatic or manual approval, and fix the settings that leave the driver list empty or stop approved drivers installing.
Microsoft's response order for a compromised mailbox, cmdlets that find malicious inbox rules and forwarding across every mailbox, what to read in sign-in and audit logs, and how to harden afterwards.
Fix Jamf Device Compliance registration on Macs: Account not onboarded, Device is already enrolled, keychain prompts, duplicate Entra devices and registrations that never turn compliant.
Apps using EWS fail with 401, 503, ErrorServerBusy or ErrorImpersonateUserDenied. Check authentication, server health, throttling policies, impersonation rights and the EWS logs.
Event 12014 means a connector has no usable certificate, so STARTTLS disappears. Line up the FQDN, certificate and TlsCertificateName, then prove TLS works again.
What Exchange Server SE supports: Windows Server 2019-2025, domain controllers, forest levels, .NET, Outlook clients and coexistence rules, plus a plan for moving to Windows Server 2025.
Build the Applicable and Compliance smart groups, run the Jamf Pro Device Compliance wizard, add the Intune compliance partner and require compliant Macs without blocking registration.
Five items Microsoft currently lists as Active on the Intune known issues page, what each looks like, what to tell users, how to work around it, and how to track the page and escalate properly.
Why Intune scripts on Microsoft Graph fail with 401, 403 Forbidden or 429 Too Many Requests: permission types, admin consent, Intune roles, the 2025 scripts permission change, paging and retries.
Signatures missing on some messages, added twice or causing loop NDRs? Find which agent, rule or service stamps your Exchange Server mail, fix it and prove it with message tracking.
A 12-week, lab-based study plan for on-premises Exchange Server SE: deployment, mail flow, DAGs, client access, security, servicing and hybrid, with break-fix drills at every stage.
What each Intune policy type is for, how conflicts between them are resolved and reported, a recommended layering for a new tenant, and naming and assignment hygiene with filters.
Link Apple Business (formerly Apple Business Manager) to Microsoft Entra ID: approve, test and turn on federation, sync users, handle account conflicts and fix sign-in failures.
Move Macs off Jamf Pro's retired macOS Conditional Access integration: what changes, an order of steps that avoids lockouts, Jamf's migration script, verification and a realistic rollback plan.
SSPR prerequisites, password writeback through Connect Sync or Cloud Sync, the documented SSPR_00xx portal errors, the Windows sign-in screen Reset password link, and the event IDs behind writeback failures.
A methodical way to troubleshoot hybrid free/busy and calendar sharing: direction, Autodiscover, the OAuth trust and dedicated hybrid app, connectors and relationships, with cmdlets for each hop.
Match an Exchange Management Shell or Active Directory error to its cause: object not found, matches multiple entries, proxy address in use, INSUFF_ACCESS_RIGHTS, WinRM failures and more.
Read dsregcmd /status for hybrid join failures, check the SCP and Entra Connect sync, use the User Device Registration log and clear devices stuck in Pending.
Intune says the antivirus policy succeeded but the device disagrees. Check the management channel, conflicts, passive mode, tamper protection and exclusion behaviour to find out why.
POP3 or IMAP4 clients can't connect or sign in? Start the right services, check PopProxy/ImapProxy, LoginType and the certificate, then prove the fix with a test login and protocol logs.
All mailboxes are in Exchange Online but a server still runs just for recipient management? The supported ways to retire it, what you give up and the exact steps.
Connect Barracuda Email Gateway Defense or the Email Security Gateway to Exchange Server, and use message tracking plus Barracuda's Message Log to tell a Barracuda block from an Exchange fault.
What error 5.7.57 means, how SMTP AUTH client submission, SMTP relay and Direct Send differ, how to fix each cause, and where Basic authentication for SMTP AUTH stands.
Look up an Apple enrollment error in Intune: NoEnrollmentPolicy, DeviceCapReached, APNs and ADE token sync errors, Profile Installation Failed and Mac messages, with the first check.
Copilot uses only what people can already open, so oversharing surfaces fast. Find it with data access governance reports, contain it, and fix it with site owners and labels.
Classic v2.x or new v3.x sensor? Prerequisites, the Directory Service account and gMSA, the Health issues page and the fixes for the sensor health alerts you'll actually see.
How Configuration Manager evaluates collections, and how to design limiting collections, query rules and update schedules that keep membership fresh without overloading the site.
Outlook keeps showing a certificate name Security Alert? Find the host name Exchange or DNS hands out, then fix the Autodiscover SCP, virtual directory URLs, split DNS or SAN list.
Look up an Outlook, Autodiscover or OAB error against Exchange Server: what 0x8004010F, 0x80190194, GetLastError=12007 and 42 more codes mean, the usual cause and the first check.
What the monthly KB4052623 platform and engine updates are, how to assign Intune update channels in rings, how to read versions with Get-MpComputerStatus, and how to roll back with MpCmdRun.
Run Microsoft's Exchange Server Health Checker on every server, build the HTML report and fix the findings that come up most: missing updates, page file, TLS, KeepAlive and more.
Set up PIM for Microsoft Entra roles: role settings, eligible assignments, activation and approvals, PIM for Groups, alerts, access reviews, and the activation problems you'll hit.
Apps get 550 5.7.54 when relaying to external recipients. Build a dedicated Frontend receive connector, allow only specific IPs to relay, and test it without creating an open relay.
Fix Android fully managed and corporate-owned work profile enrollments that fail during setup: device and token checks, QR code and afw#setup, Google downloads, Conditional Access and registration.
Read StatusDetail and the MRS report to tell throttling by design from real problems, then fix stalled or failed on-premises mailbox moves and resume them safely.
Domain-joined users getting password prompts again? Decode the 8100x sign-in errors, then check the intranet zone, klist and the AZUREADSSOACC account and key.
A vendor-neutral checklist for any gateway in front of Exchange: a scoped receive connector, InternalSMTPServers, the header firewall, TLS, a smart host connector and no mail loops.
Log volume filling up or databases dismounting? Find out why Exchange isn't truncating logs, free space safely with a backup or circular logging, and never delete logs by hand.
Blank OWA and ECP pages, EMS WinRM errors or Event 15021 after certificate work? Restore the self-signed Microsoft Exchange certificate on the Exchange Back End site's port 444 binding.
Microsoft Entra hybrid join Autopilot deployments can time out with 0x80004005 on older Windows 11 builds. How to confirm the known issue, which KBs fix it and how to get devices onto a fixed build.
Exchange answers 452 4.3.1 when back pressure kicks in. Find the resource under pressure, fix the cause or move the queue database, and confirm transport is back to normal.
How Exchange Server RBAC decides what an admin can do: roles, role groups, assignments and scopes, how to grant least privilege, and the usual causes of access-denied errors.
Prerequisites, SPN registration with Microsoft Graph PowerShell, EvoSTS and OAuth2ClientProfileEnabled, then proof that Outlook uses Bearer tokens for on-premises mailboxes.
Why DAG databases stay active on the wrong member after failovers or patching, what blocks automatic rebalancing, and how to move them back with RedistributeActiveDatabases.ps1.
Intune will evaluate BitLocker, Secure Boot and code integrity compliance through Microsoft Azure Attestation. Which endpoints to allow, how to test from a device, and how to find affected policies.
Why Exchange Online blocks automatic forwarding to external addresses with 5.7.520, and how to allow it only for the mailboxes that need it instead of for everyone.
Mount-Database fails with ec=1108 and eseutil /mh says Dirty Shutdown? Find the logs Exchange needs, run soft recovery safely, and know when to restore or reach for eseutil /p.
Why cloud Kerberos trust is the recommended Windows Hello for Business model for hybrid tenants, how to create the Entra Kerberos server object, configure the Intune policy, and verify with dsregcmd and klist.
Why Exchange answers MAIL FROM with 530 5.7.1 Client was not authenticated, how to find the receive connector that answered, and how to fix scanners, apps and gateways safely.
Exchange setup stopped at Prerequisite Analysis? Match each readiness error to the missing piece (UCMA 4.0, Visual C++, .NET, URL Rewrite, Windows features, pending restart) and fix it.
Look up a VSS error from an Exchange backup: 0x800423F3, 0x800423F4, 0x800423F2, 0x8004230F and other VSS_E codes, vssadmin writer states and related events, with first checks.
The core Conditional Access policies to deploy first, how they map to Microsoft's templates and Microsoft-managed policies, and how to roll them out in report-only mode without locking anyone out.
How Configuration Manager clients use boundaries and boundary groups to pick a site, management point and content source, how fallback works, and how to verify it.
What the Exchange Hybrid Agent replaces, what still needs inbound access or classic hybrid, and how to check agent health, redundancy and the msappproxy.net endpoint.
Create and manage Exchange Online mailboxes from on-premises the supported way: New- and Enable-RemoteMailbox, the attributes that matter, ExchangeGuid fixes and common mistakes.
How the Primary Refresh Token powers single sign-on on Windows, how to check it with dsregcmd and the AAD event logs, and how to fix a missing or stale PRT.
How Microsoft Security Exposure Management works: licensing and permissions, critical assets, initiative scores and targets, attack paths and choke points, and how it relates to Secure Score.
Deploy Defender for Endpoint to Macs with Jamf Pro in the right order: onboarding plist, settings, permission profiles, a smart group gate and the package. Then read mdatp health and fix its errors.
Lookout, Zimperium or Check Point connected to Intune, yet devices are blocked, wrongly compliant or never report? Check the connector state, toggles, partner app and threat-level rules.
Install the ExchangeOnlineManagement module, connect interactively or with app-only certificate authentication, and run five quick reports with the fast Get-EXO cmdlets.
vssadmin shows the Microsoft Exchange Writer Failed or Retryable, or logs pile up after a 'successful' backup? Reset the writer, fix DAG conflicts and prove it with Windows Server Backup.
How Intune device cleanup rules work per platform, what they hide and what they leave behind, and how to pair them with a safe Entra ID stale-device routine that spares Autopilot.
Device control concepts (groups, rules, entries, access masks), the Intune Device Control profile with reusable settings, audit before block, printers, hunting queries and fixes when a USB stick stays writable.
Internal mail bouncing to an IMCEAEX address with RESOLVER.ADR.ExRecipNotFound? Decode the old LegacyExchangeDN, add it back as an X500 proxy address and stop it happening again.
What Inactive, Impaired communications and No sensor data mean in the Defender device inventory, and how to check the sensor, onboarding state, proxy and duplicate device records.
Look up an Exchange Server NDR or queue status code: what each 4.x.x and 5.x.x code means, the usual on-premises or hybrid cause and the first cmdlet or setting to check.
Issue Intune SCEP certificates from DigiCert, Entrust, GlobalSign, Sectigo, SCEPman or another partner CA: the Entra app, profiles, challenge validation, Wi-Fi/VPN linkage and errors.
Use supersedence to update or replace Win32 apps and dependencies to install prerequisites first: update vs replace, targeting, auto-update, limits, conflicts and IME logs.
Configure the Passkey (FIDO2) policy and a passkey profile for Authenticator, pick the right registration flow, roll out in rings and fix the registration and sign-in failures users report.
A 12-week plan for Configuration Manager admins: cloud attach, co-management, moving workloads to Intune and cloud-native Windows with Autopilot, with labs and Microsoft Learn resources.
Jamf devices not reporting compliance to Entra ID? Check the Intune partner status, scoping, licences, the Entra apps Jamf's wizard creates, Jamf Pro smart groups and legacy leftovers.
How Intune roles, role assignments and scope tags fit together, three delegation designs that work, the pitfalls that leak visibility, and how to audit and test what an admin can really do.
A hop count NDR means a message looped until a server gave up. Read the NDR, trace the loop with message tracking, and fix the accepted domain, connector or recipient behind it.
DAG backups failing in NetBackup (status 156) or Commvault? Check the preferred server list, the passive copy and the Exchange writer, then prove which side is at fault.
Exchange setup won't remove a server that still hosts hidden system mailboxes or DAG copies. Find them, move them, fix connectors and uninstall cleanly.
Look up a failed Intune app install: what 0x87D1041C, 0x87D300C9, 0x80070643, 0x8A15001B, 0x87D13B7E, 0xC7D14FB5 and 50 more codes mean, the usual cause and the first check.
How Exchange Online evaluates mail flow rules, why the native External tag beats a subject-prefix rule, and how to test, order and audit rules without punching holes in EOP.
Purview DLP covers Exchange Online mail; Exchange Server has its own DLP and needs IRM for encrypted mail. What each engine sees on-premises and in hybrid, and how to prove it.
How classic Outlook finds Exchange Online, how to read Test E-mail AutoConfiguration and the Remote Connectivity Analyzer, and the usual culprits: DNS, stale on-premises Autodiscover, old clients and broken profiles.
Connect Jamf's mobile threat defense to Intune: UEM Connect consent, the MTD connector, Jamf Trust activation, device threat level in compliance and app protection, and fixes when it fails.
What Exchange Server SE changes for on-premises Exchange: the Modern Lifecycle, entitlement-based licensing, how updates ship, and a practical checklist for planning your move.
How Teams external access (federation) differs from guest access, which Teams, Entra ID, Groups and SharePoint settings control each, and a safe baseline to apply.
A practical checklist for failed Android personally owned work profile enrollments: Managed Google Play, restrictions, licences, device requirements, existing profiles and logs.
Add a prepackaged Win32 app from the Enterprise App Catalog, understand the prefilled install and detection settings, choose between auto-update and guided supersedence, and troubleshoot failed installs.
Create room and equipment mailboxes, tune Set-CalendarProcessing (auto-accept, conflicts, booking window, delegates), build room lists and Set-Place metadata for Room Finder, and fix the usual booking complaints.
Delegates get a SendAsDenied NDR when sending from a shared mailbox? Grant the right permission, allow for replication and caching, and fix stale Outlook addresses.
Connect Intune to Microsoft Defender for Endpoint, onboard Windows devices with an EDR policy, then prove it worked on the device, in the Defender portal and with a detection test.
Turn on SMTP protocol logging on the right connector, find the log files and read a session line by line to spot TLS, authentication and relay failures.
Why group-based licence assignments fail for some members, where to see the errors, how to list affected users with Microsoft Graph PowerShell, and how to fix and reprocess them.
Answer who did what in Microsoft 365: audit retention by licence, Purview audit search jobs, Search-UnifiedAuditLog for large result sets, and the operation names worth knowing.
Prerequisites, the update ring settings and their ranges, a pilot/broad ring design, expedite and driver update policies, the Intune and Windows Update for Business reports, and how to check a device locally.
What AADSTS53000, 53001 and 53003 actually mean, how to find the blocking policy in the sign-in logs, and how to fix compliance and browser device-identity gaps.
Detect and repair folder view, folder count, search folder and other logical mailbox corruption online with New-MailboxRepairRequest, then track it with Get-MailboxRepairRequest.
Choose between OU, group and attribute filtering in Entra Connect Sync, preview every pending delete with csexport, and get past the accidental-delete threshold safely.
How the Exchange Emergency Mitigation service and AMSI integration protect Exchange Server SE between updates, what they need to work, and the checks that prove they're doing their job.
Why custom ADMX and ADML uploads fail in Intune (missing namespaces, combo boxes, language and size limits), how to fix each one and how to prove the settings reached the device.
Turn on Windows Backup for Organizations and the tenant-wide restore page in Intune so users get their Windows settings back during setup: requirements, steps and fixes.
What the Company Portal Sync button really does, why the app says a device isn't set up or belongs to another user, how the primary user drives it, and where the logs are.
Look up a move request status, StatusDetail or MRS exception: what Queued, StalledDueToTarget_*, TooManyBadItems and 30-plus more mean in Exchange Server and hybrid, and what to check first.
Windows MDM enrollment fails with 0x80180018 or a nearby 0x8018 code. What Microsoft documents for each code, which tenant setting is behind it, and how to confirm the fix in the enrollment event log.
Large messages bouncing with 5.3.4 ROUTING.SizeLimit or 5.2.3 RecipSizeLimit? Every Exchange size limit with its default, how they interact and how to raise them safely.
A map of the Jamf and Microsoft integrations in 2026: Device Compliance, the retired macOS integration, Platform SSO, Jamf Connect, Entra ID in Jamf Pro, threat defense and Defender.
How Workspace ONE, Ivanti, Citrix and other MDMs report compliance to Entra ID through Intune: partner setup, device registration, Conditional Access, migration and why devices stay N/A.
A phased sensitivity label rollout: design a small taxonomy, publish with default labels, enable SharePoint and OneDrive support, then auto-label safely using simulation.
Set up Windows Autopilot end to end: tenant prerequisites, collecting and importing hardware hashes, group tags and dynamic groups, a user-driven Entra join profile, an Enrollment Status Page and the first test device.
Deploy OneDrive Known Folder Move through the Intune settings catalog, roll it out at a safe pace, read the sync health dashboard, and fix the documented reasons a folder refuses to move.
Build the Intune settings catalog policy for macOS Platform SSO, pick Secure Enclave, smart card or password, get Macs registered and fix the failures you will actually meet.
Move legacy MFA and SSPR method settings into the authentication methods policy: the three migration states, how each setting maps, and how to prove nobody gets locked out.
Why Configuration Manager clients don't become co-managed: read CoManagementHandler.log and the MDM enrollment events, fix scope, licence and MFA causes, and check who owns each workload.
Backup Exec failing with 0xE000FED1, skipping DAG databases or leaving logs untruncated? Fix the Exchange writer, passive-copy settings, backup method and GRT requirements.
Upload Configuration Manager devices to the Intune admin center with tenant attach: prerequisites, enabling the upload, what admins can do there, RBAC, and fixing missing devices or failed actions.
Mail flow or OWA down after an Exchange CU or SU? Check Get-ServerComponentState, find which requester holds ServerWideOffline Inactive, finish the update and reactivate safely.
What device association writes to UEFI, the Windows 11 and TPM 2.0 requirements, exporting the DeviceLink CSV and pre-associating in Intune, lifecycle and removal, and how it coexists with classic Autopilot.
Why senders get 554 5.2.2 mailbox full, how to measure a mailbox and its hidden Recoverable Items folder, and the fix for each cause: user data, holds, calendar logging or the wrong licence.
Work through a failing PXE boot in order: network and IP helpers, the PXE-enabled distribution point, boot images, deployments and unknown computers, reading SMSPXE.log at each step.
A structured compromise check for Exchange Server: Health Checker, Test-ProxyLogon, where web shells hide, the logs and Exchange settings attackers abuse, and what to do if you find something.
A Mac is compliant in Jamf Pro, yet Conditional Access returns AADSTS53000. Read the sign-in log, find the broken link (registration, compliance sync, browser or device ID) and fix it.
What trips admins up in Autopilot device preparation, the known issues and their status as of October 2026, how to read the deployment status report, and the documented steps for a failed deployment.
How exposure score, recommendations, software inventory and weaknesses fit together, and how a Request remediation in the Defender portal becomes a security task an Intune admin can close.
Enterprise Vault archiving tasks failing to log on, stalling or leaving shortcuts that won't open? Check the Vault Service account, system mailboxes, throttling policy and add-ins.
A device is onboarded to Defender but never shows up as MDE-managed in Intune. Read HKLM\SOFTWARE\Microsoft\SenseCM\EnrollmentStatus, map the code to its cause and fix it.
What automatic attack disruption contains and why, the Defender settings it depends on, and how to exclude critical assets, review its actions and undo them safely.
Why Outlook falls back to NTLM behind a load-balanced namespace, and the fix: create the ASA account, deploy it with RollAlternateServiceAccountPassword.ps1, register SPNs, verify with klist.
Outlook shows Disconnected or can't create a profile against Exchange Server. Check the user's MAPI settings, Autodiscover, the MAPI virtual directory, healthcheck.htm and load balancer probes.
Look up an Intune profile or compliance result: what 65000, 0x87D1FDE8, SyncML 404/500, iOS payload codes, compliance states and BitLocker status details mean, and the first check.
Set consistent internal and external URLs on every Exchange virtual directory, then back up, reset or recreate a broken OWA, ECP, EWS or OAB directory safely.
Configure Intune Multi Admin Approval so wipes, scripts, app deployments and role changes need a second admin: approver groups, access policies, the request flow and audit.
How PHS, pass-through authentication and AD FS federation work, what each depends on, how each fails, and a decision table for choosing and backing up your hybrid sign-in method.
Build configuration items from registry, WQL and script settings, bundle them into a baseline, deploy it with remediation and prove on the client and in reports that drift gets fixed.
Why Macs, iPhones and iPads don't update on time with Intune: legacy update policies that stopped working, DDM deadline settings, deferrals, the Apple updates reports and on-device checks.
Enable the Temporary Access Pass policy, issue passes in the portal or with Graph PowerShell, and use them to register passkeys, Authenticator and Windows Hello for Business.
How to wrap an installer with the Win32 Content Prep Tool, choose silent install and uninstall commands, set install behaviour, return codes, requirement and detection rules, and pilot the app.
Plan a Jamf Pro to Intune move: map profiles and scripts, reassign ADE devices, choose OS 26 migration or a wipe, handle FileVault, Activation Lock and app licences, and fix enrollment errors.
A practical checklist for Exchange Server SE and 2019 cumulative updates: backups, Health Checker, AD preparation, maintenance mode, elevated setup and the checks that prove it worked.
How a remote move batch works, what Syncing, Synced and Completing really mean, the documented errors (SMTP proxy, MRS Proxy 401, skipped items) and how to finish the cutover cleanly.
Encrypted device but no recovery key in Intune? Read BitLocker events 845 and 846, fix the join state and policy, re-escrow with BackupToAAD-BitLockerKeyProtector and prove it worked.
A passive DAG copy in FailedAndSuspended won't heal itself. Read the real error, fix the disk or log problem behind it, reseed with Update-MailboxDatabaseCopy and prove the copy is healthy.
Set up BitLocker management in Configuration Manager: recovery service, policy, portals and a clean move off stand-alone MBAM, plus the logs that prove recovery keys are escrowed.
Intune's new Deployments experience (preview): staging Win32 and Enterprise App Catalog apps, settings catalog and endpoint security policies across rings, permissions, how rings advance, and a ring design.
Exchange services failing with event 2142? Read event 2080's columns, fix site, DNS, firewall and SACL right (event 2112) causes, and keep static domain controllers as a last resort.
Test-MigrationServerAvailability or a new hybrid migration batch fails against your on-premises endpoint? Check MRSProxy, credentials, publishing and certificates, then prove the fix.
Look up an AADSTS code from a managed device: what 53000, 50155, 135011, 50076, 7000218 and 39 more mean for Intune and Jamf admins, the usual cause and the first check.
Connect Jamf Pro to Microsoft Entra ID as a cloud identity provider and fix what breaks: admin consent, Graph permissions, attribute mappings, nested groups and LDAP migration.
What Exchange Server SE and 2019 support for TLS 1.2 and TLS 1.3, the Schannel and .NET settings Microsoft documents, and how to find partners still on TLS 1.0 before you switch it off.
Manage Zebra Android devices in Intune: dedicated enrollment, Zebra OEMConfig profiles, LifeGuard OTA firmware deployments, and what Conflict, NOTAPPLICABLE and Failed to create mean.
What each Intune Management Extension log records, how to read them with CMTrace, what to search for, how to force a check-in, and how to collect the logs remotely.
Why Apple ADE devices don't appear in Intune or enroll without the right policy: device assignment, token sync limits and renewal, default policies, and why a reset is needed.
Put an Exchange Server DAG member into maintenance mode the supported way: drain transport, move databases, pause the cluster node, patch, then bring it back and prove it's healthy.
Prepare hybrid join and automatic MDM enrollment, run the Cloud Attach wizard against a pilot collection, then prove on the device and in the Intune admin center that it is co-managed.
HTTP 500 or Server Error in '/ecp' on Exchange? Use the error text, IIS and HttpProxy logs to find the cause: a non-elevated update, a missing config file, certificates or app pools.
Fix Jamf Connect sign-in with Microsoft Entra ID: the app registration, ROPG password checks, Conditional Access after the June 2026 change, and the AADSTS errors at the Mac login window.
Check licensing and the one-way switch, enable auto-expanding archiving org-wide or per user, make sure items actually move, and confirm extra storage was provisioned.
Which 2011 Secure Boot certificates expire and when, the Settings catalog Secure Boot settings, model-based filters for a staged rollout, and the Intune report and remediation that track progress.
Combine Jamf Pro device compliance for iPhone and iPad with Intune app protection: the partner connector, smart groups, IntuneMAMUPN keys, Conditional Access and how to verify each piece.
An Intune platform script reports Failed or never runs. How the Intune Management Extension executes scripts, what the three script settings change, how retries and re-runs work, and where to look.
Set up Remote Help end to end: check licensing, enable the tenant settings, grant least-privilege helper roles, deploy the Windows app, handle Conditional Access, and fix sessions that won't connect.
A Cloud PC shows Provisioning failed in the Intune admin center. How provisioning works, what the Azure network connection health checks test, the documented failure reasons, and when to retry or reprovision.
The Intune deployment for Defender for Endpoint on Mac in the documented order: system extensions, Full Disk Access, network filter, background services, the app, the onboarding package, mdatp checks and fixes.
Find smsts.log in every phase, keep the device on the error with F8, read the log from the failure upwards and fix driver, network, content and domain join failures.
What *.endpoint.security.microsoft.com replaces and what it doesn't, the sensor prerequisites, how to migrate onboarded devices, EDR and antivirus proxy settings, and how to prove it worked.
0x87D1041C means the installer finished but the detection rule found nothing. The usual causes (bitness, install context, version drift) and how to test detection on the device.
What Extended Protection does, the TLS, NTLM and load balancer prerequisites, enabling it with Microsoft's script, and fixing the clients and hybrid features that break.
Show ServiceNow incidents in Intune's Troubleshooting pane: licences, roles, the ServiceNow OAuth app and CORS rule, the connector, what the help desk sees and the setup errors.
Why Macs don't encrypt or don't escrow a FileVault recovery key to Intune, what the encryption report's status details mean, and how to take over user-encrypted Macs and prove the key works.
Some Windows 11 24H2 devices ship without the Sense client, so Intune's EDR policy errors and the device never reaches Defender. How to detect it at scale with Remediations and add the capability.
Free space on Exchange Server SE and 2019 safely: which IIS, diagnostic and search ETL logs you can delete, which files you must never touch, and how to schedule the cleanup.
Move public folders from Exchange Server SE or 2019 to Exchange Online with Microsoft's batch scripts: prerequisites, lock-down, cutover and the errors that stall the batch.
A stage-by-stage study plan for exam SC-200 (Security Operations Analyst Associate): the current skills-measured domains, the Microsoft Learn paths to follow, hands-on labs and exam-day tips.
Migration batches, moderation, OAB generation or a CU upgrade failing? Check Exchange's seven arbitration mailboxes, then re-home or recreate broken and missing ones the supported way.
Route Intune audit, operational, compliance and device logs to Log Analytics, Event Hubs or storage, then on to Microsoft Sentinel or Splunk, with sample KQL and checks.
Look up a Windows Autopilot failure: what 0x800705B4, 0x801C03EA, 0x80070774, 0x81039001, event 807, import error 808 and more mean, the usual cause and the first check.
Exchange setup says it previously failed during Install or BuildToBuildUpgrade? Find the real error, resume with the same build and media, and treat Watermark cleanup as a last resort.
Third-party VPN profile failing in Intune? Pick profile vs app configuration per platform, fix the certificate chain, decode 2016281112 Remediation Failed and Conflict, and read client-side logs.
A low-risk path off AD FS: inventory relying parties and claim rules, enable password hash sync, pilot with staged rollout, convert the domain with Graph PowerShell, then decommission.
A phased plan from Configuration Manager to Entra joined, Intune-managed Windows devices: assess, co-manage, move workloads, provision with Autopilot and retire on-premises dependencies.
Event ID 1135 or 1177 on DAG members, databases dismounting or witness errors from Set-DatabaseAvailabilityGroup? See how DAG quorum works and fix the cluster, witness and network.
Deploy a Configuration Manager cloud management gateway on an Azure scale set, connect it to your site, bring internet clients onto it, and read the right logs when clients can't connect.
Eight short KQL queries for the Defender portal using documented tables: OS builds, sensor health, app versions, CVE exposure, antivirus posture, who ran a tool, ASR audit hits and network destinations.
Follow content from the site server to a distribution point through distmgr.log, PkgXferMgr.log and smsdpprov.log, and know when to update, redistribute or validate.
Fix Exchange /PrepareSchema and /PrepareAD failures: missing Schema Admins or Enterprise Admins rights, wrong site or domain, unfinished replication and stale AD entries. Then verify AD versions.
Configure the Microsoft Enterprise SSO plug-in and Platform SSO from Jamf Pro: payload values, Company Portal first, Device Compliance registration, verification and the errors to expect.
A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce.
Read UEFICA2023Status, the AvailableUpdates bitmask and TPM-WMI events 1795 to 1808 to see where a Secure Boot certificate update is stuck, interpret the Intune report, and clear the common blockers.
What tamper protection locks, the four places it can be managed and their precedence, how to see which one controls a device, and how to fix settings that won't apply or exclusions that aren't protected.
Trace a failed Configuration Manager client install from client push to site assignment: ccm.log, ccmsetup.log, client.msi.log, return codes, MP lookup and boundaries.
Set up SAML single sign-on from Microsoft Entra ID to Jamf Pro and Self Service, keep a working failover login, and fix the AADSTS50105, AADSTS50011 and AADSTS700016 sign-in errors.
Set up Intune Remediations end to end: licensing and tenant attestation, the exit-code contract, run context, schedules, on-demand runs and reading the results.
Look up a Windows enrollment or Entra join failure: what 0x80180018, 0x8018002b, 0x801c03f2 and dozens more codes mean, the usual cause in an Intune tenant and the first check.
Licensing, prerequisites and registration for the Connect Health agents, sending alerts to people who act on them, and a playbook for the sync alerts you'll see most.
Exchange 2016 and 2019 left support on 14 October 2025 and paid ESUs end with October 2026. The real risks, a decision table and the order of work to move to SE or Exchange Online.
Send Exchange Server journal reports to a hosted archive: standard vs premium journaling, a hidden contact, a dedicated TLS send connector, JournalingReportNdrTo and proof of delivery.
How automated investigation and response decides what to remediate, how device groups and automation levels control it, and how to approve, reject or undo an action in the Action center.
Network Prevent for Email behind Exchange Server: why reflecting mode loops with 5.4.6, how to set forwarding mode, ports and relay, and what the queues show when it's down.
Autopatch groups and quality update policies, per-update-type approvals, deferrals and pausing for Windows and .NET Framework updates, quick machine recovery approvals, the reports and migration tips.
What mandatory MFA enforcement covers, the failures it causes for user-based automation and admin sign-ins, how to verify who is ready, moving scripts to workload identities, and MFA-capable break-glass accounts.
Keep your software update point healthy: enable the WSUS maintenance options, set supersedence rules, back up and reindex SUSDB on a schedule, and confirm it all in wsyncmgr.log.
Follow a Configuration Manager update from scan to install: WSUS location, WUAHandler.log scan errors, Group Policy conflicts, content download and maintenance windows.
Build an Entra Connect staging server from an exported configuration, prove what it would export with csexport, and switch the active server without surprises.
Try a different keyword, or .
Tell me what you're troubleshooting or which feature you'd like a guide for, and it may become the next article.
