Unused Azure AD Connect accounts "On-Premises Directory Synchronization Service Account"

-
Playing with #Azure Privileged Identity Management‎ made me aware of two active accounts from old or failed AAD connector installations from way back.
And we don't want to leave something with that potential for misusage laying available in our AAD. 

To check if you have you the same in your system don't need PIM, just search for "On-Premises Directory Synchronization Service Account" under Users in https://admin.microsoft.com/Adminportal or the Azure portal. I am using the Microsoft 365 Admin center because you can block the account from here. With the Azure portal you must use PowerShell commands 
The active AAD Sync account should contain name of AAD connector servers in them.

Remember to disable/block the account before delete to make sure it's not in use, or else you must re-run the installation to recreate it. 

You can also check the sign-ins log in Azure AD, the passive one if you have 2 connectors are usually login in once a month so there should be some activities on that one. 

Popular posts from this blog

Installing Android on a Hyper-V virtual machine

-
Image
Working with mobile device management (MDM) require a lot of testing. With Windows 10 testing is no problem (except those things that demand to be done on a physical device by different reasons), they can easily be run virtual. But when it comes to phones and tablets it have not been that easy. Visual Studio and some other solutions where out there, but they did not come with Store access or they had dependence which excluded Hyper-V from running. Some Emulators runs in a Hyper-V VM with Windows 10, but not on the host itself. So, if you got it to work it was usually slow and painful.
Read more

Quick guide on how to run BgInfo background as Group Policy login

-
Image
I know, it's simple. But I always forget some minor details when it have been a while since last time. So this blogpost is more a reminder to my self. Goal = Get same background picture an all PC (and/or Server) Doing it very simplified and easy in this guide, but you should normally use  folder structure for the files and a suitable Group Policy or more for the setting themself.
Read more

MDT: TimeZoneName and index number list

-
Remebering time zone name and number are a hasle so here are the list for the next time you (or I) need it. Norwegian settings for MDT are: TimeZone=110 TimeZoneName=W. Europe Standard Time (InputLocale=0414:00000414) (KeyboardLocale=nb-NO) The complete list are as following:
Read more