News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon

Daily Archives: January 7, 2019

  • Patch Lady – the Office 365 admin center

    Posted on January 7th, 2019 at 23:35 Susan Bradley Comment on the AskWoody Lounge

    Patch Lady here – for those of you that are admins in Office 365 I would highly recommend bookmarking the Office 365 admin center and especially to make sure that you have access to the message center inside of it.  It’s a key way to keep aware of updates and changes.  On my cheapest Godaddy Office 365 subscription I don’t have the ability to forward the alerts to other email addresses, but on my higher Office 365 subscriptions (a Office 365 Business plan and a Microsoft 365 E5 plan just to be aware of the nuances and changes with each plan).  You can also download the Office admin center app on an iPhone or android and log in with admin credentials to get the same info.

    Today they announced they are adding more forensic features that turn on more auditing by default.  This is a very good thing and starts to get the online better aligned with on premise in terms of forensics.

    Now if I can just get Advanced Threat Protection features built into EVERY Office 365… yes I know… never happy am I?


    Updated feature: Exchange Online mailbox audit to add mail reads by default


    To ensure that you have access to critical audit data to investigate security incidents in your organization, we’re making some updates to Exchange mailbox auditing. After this change takes place, Exchange Online will audit mail reads/accesses by default for owners, admins and delegates under the MailItemsAccessed action.

    This message is associated with Microsoft 365 Roadmap ID: 32224.

    How does this affect me?

    The MailItemsAccessed action offers comprehensive forensic coverage of mailbox accesses, including sync operations. In February 2019, audit logs will start generating MailItemsAccessed audit records to log user access of mail items. If you are on the default configuration, the MailItemsAccessed action will be added to Get-mailbox configurations, under the fields AuditAdmin, AuditDelegate and AuditOwner. Once the feature is rolled out to you, you will see the MailItemsAccessed action added and start to audit reads.

    This new MailItemsAccessed action is going to replace the MessageBind action; MessageBind will no longer be a valid action to configure, instead an error message will suggest turning on the MailItemsAccessed action. This change will not remove the MessageBind action from mailboxes which have already have added it to their configurations.

    Initially, these audit records will not flow into the Unified Audit Log and will only be available from the Mailbox Audit Log.

    We’ll begin rolling this change out in early February, 2019. If you are on the default audit configuration, you will see the MailItemsAccessed action added once the feature is rolled out to you and you start to audit reads.

    What do I need to do to prepare for this change?

    There is no action you need to take to derive the security benefits of having mail read audit data. The MailItemsAccessed action will be updated in your Get-Mailbox action audit configurations automatically under AuditAdmin, AuditDelegate and AuditOwner.

    If you have set these configurations before, you will need to update them now to audit the two new mailbox actions. Please click Additional Information for details on how to do this.

    If you do not want to audit these new actions in your mailboxes and you do not want your mailbox action audit configurations to change in the future as we continue to update the defaults, you can set AuditAdmin, AuditDelegate and AuditOwner to your desired configuration. Even if your desired configuration is exactly the same as the current default configuration, so long as you set the AuditAdmin, AuditDelegate and AuditOwner configurations on your mailbox, you will preclude yourself from further updates to these audit configurations. Please click Additional Information for details on how to do this.

    If your organization has turned off mailbox auditing, then you will not audit mail read actions.

  • AskWoody Plus Newsletter delayed

    Posted on January 7th, 2019 at 09:36 woody Comment on the AskWoody Lounge

    Bugses. My life is filled with bugses. (Credit: Welta Digital via Wikipedia)

    In spite of the efforts of many people over a long (and lost) holiday, we didn’t make the cutoff to get the AskWoody Plus Newsletter — formerly the Windows Secrets Newsletter — out the gate this morning.

    There are lingering technical problems. And a couple of software manufacturers who aren’t co-operating. Microsoft’s bugs are bad enough, but some of the ones I encountered in the past few weeks put our woes here to shame. I should write a book.

    Anyway, if we’re lucky, we’ll have the newsletter out tomorrow morning. And if a %$#@! credit card processing company can get its act together, I’ll publish more details about Plus Membership — and signing up for the newsletter — later today.

    Stay tuned.

  • Windows 10 1809 adoption rate is slow. And that’s good!

    Posted on January 7th, 2019 at 07:53 woody Comment on the AskWoody Lounge

    Gregg Keizer has his usual thorough review of the situation: No matter how you slice it, adoption of the latest version of the last version of Windows is going at a snail’s pace:

    According to statistics gathered by AdDuplex… Windows 10 October 2018 Update – 1809… had been installed on just 6.6% of all Windows 10 systems by year’s end. That was a small fraction of the 53.6% powered by 1709 – Windows 10’s second feature upgrade of 2017 – at the close of that year.

    I think that’s great. Microsoft’s showing some long-overdue restraint in forcing Win10 users onto the next version. We saw repeated bloodbaths on the forced upgrades last year. Maybe this year we’ll seem some sanity return to the Win10 scene.

    People are fretting over the delay in 1809 and how that’ll impact the delivery of the next-next version of Win10, code named “19H1.” I think it’s been obvious for quite a while that MS will let the next version slide until much later in the first half of 2019 — thus the “H1” part of 19H1 — and that the decision to do so was made more than six months ago.

    I hope, nay pray, that this means our every-six-months upgrade treadmill is coming to an end.

    Time will tell, but it’s one more hopeful sign that Microsoft may not end up killing Windows. Maybe.

  • MS-DEFCON 2: Microsoft’s already yanked four patches. Best to verify Auto Update is turned off

    Posted on January 7th, 2019 at 05:43 woody Comment on the AskWoody Lounge

    The holidays are over, but the Grinch is still on the loose. Make sure your machine is locked down.

    Computerworld Woody on Windows.