Sunday, July 19, 2026

Organization-Wide MFA Planning, Implementation and Rollout Flowchart

 Hello LinkedIn Network,

I am excited to share my very #1 first post on LinkedIn.
 
Today, I am sharing a Planning an Organization-Wide MFA Rollout? Start with a Strategy, Not Just a Technology Decision.
 
To help organizations avoid common pitfalls, I designed this high-level flowchart outlining an end-to-end MFA implementation journey.
 
A well-designed flowchart often saves hours of explanation and investigation. As the saying goes, "A picture is worth a thousand words."
I encourage every technical team to invest time in documenting workflows, dependencies, and operational processes through clear and concise flowcharts. It not only improves operational efficiency but also strengthens organizational knowledge management.
 
Multi-Factor Authentication (MFA) remains one of the most effective security controls for protecting identities and reducing the risk of account compromise. However, successful implementation requires careful planning, stakeholder engagement, phased deployment, and continuous optimization.

I created this Organization-Wide MFA Planning, Implementation and Rollout Flowchart to provide a structured approach covering:
✅ Readiness Assessment
✅ Legacy Authentication Remediation
✅ Authentication Method Selection
✅ Conditional Access Design
✅ Emergency Access Accounts
✅ Pilot Deployment Strategy
✅ Phased Rollout Approach
✅ Passwordless Authentication Adoption
✅ Governance & Compliance Checkpoints
✅ Continuous Optimization

A successful MFA deployment is not just about enabling a policy. It is about balancing security, user experience, operational readiness, and business continuity.

What has been your biggest challenge during an MFA rollout?


Sunday, August 24, 2025

What is Microsoft Purview and their capabilities?



Microsoft Purview – Brief Overview

Microsoft Purview Capabilities can be grouped into three main areas: Data Governance, Data Protection, and Risk & Compliance Management.

1. Data Governance & Cataloging

  • Data Map – Automatically scans and classifies data across on-premises, multi-cloud, and SaaS sources.

  • Data Catalog – Helps discover, understand, and manage data assets with business glossaries and lineage tracking.

  • Data Sharing – Enables secure data sharing inside and outside the organization.


2. Data Protection & Information Security

  • Information Protection – Apply sensitivity labels to classify and protect emails, files, and documents.

  • Data Loss Prevention (DLP) – Prevents accidental sharing of sensitive information across endpoints, email, Teams, and other apps.

  • Encryption & Access Controls – Ensures only authorized users can access sensitive data, even if shared externally.


3. Risk, Compliance & Insider Threat Management

  • Compliance Manager – Provides assessments and regulatory templates (GDPR, HIPAA, ISO, etc.).

  • eDiscovery – Helps identify and collect relevant data for legal or compliance investigations.

  • Audit – Provides detailed logs of user and admin activities for investigations.

  • Insider Risk Management – Detects risky user behaviors (e.g., data exfiltration).

  • Communication Compliance – Monitors internal communications for policy violations or misconduct.

Microsoft Purview is an end-to-end data governance, protection, and compliance platform that helps organizations know their data, protect their data, and manage risks effectively across Microsoft 365, Azure, on-prem, and multi-cloud environments.

AND OR

Microsoft Purview is a unified data governance, security, and compliance platform. It combines the capabilities of Azure Purview (for data governance) and Microsoft 365 Compliance solutions (for data protection & risk management) into one integrated suite.

It helps organizations answer three key questions:

  1. What data do I have? → Data discovery, cataloging, classification.

  2. How is my data protected? → Information protection, encryption, DLP.

  3. Am I compliant with regulations? → Risk, audit, and compliance management.


Key Areas of Microsoft Purview

1. Data Governance & Visibility

  • Purview Data Map & Catalog – Automatically scans and classifies data across on-premises, Azure, AWS, Google Cloud, and SaaS apps.

  • Business Glossary – Helps standardize business terms across the organization.

  • Data Lineage – Tracks where data comes from and how it moves across systems.

  • Data Sharing – Enables secure and controlled data sharing with partners.


2. Information Protection

  • Sensitivity Labels – Classify and protect data (Confidential, Internal, Public, etc.).

  • Encryption & Rights Management – Ensures sensitive files/emails remain protected even outside the company.

  • Data Loss Prevention (DLP) – Prevents accidental or intentional sharing of sensitive information across Exchange, Teams, SharePoint, OneDrive, and endpoints.


3. Risk & Compliance Management

  • Compliance Manager – Provides 300+ regulatory templates (e.g., GDPR, HIPAA, ISO 27001, PCI-DSS) to assess compliance posture.

  • eDiscovery & Audit – Finds, preserves, and reviews data for legal or internal investigations.

  • Insider Risk Management – Detects risky behaviors (e.g., downloading large sensitive files before resigning).

  • Communication Compliance – Monitors Teams, email, and chats for policy violations.

  • Records Management – Automates retention, archiving, and deletion of data based on policies.


4. Multicloud & Hybrid Support

Unlike older tools, Microsoft Purview doesn’t only focus on Microsoft 365. It can discover, classify, and govern data across multiple clouds and on-premises sources, making it useful for hybrid enterprises.


Why Microsoft Purview Matters

  • Unified Platform → Combines governance + compliance in one tool.

  • Scalability → Works across M365, Azure, AWS, GCP, and on-premises.

  • Regulatory Alignment → Helps organizations stay compliant with global laws.

  • Risk Reduction → Protects against insider threats, data leaks, and non-compliance fines.


In short: Microsoft Purview gives organizations a 360° view of their data estate, helps protect sensitive information, and ensures regulatory compliance — all from one platform.


Thursday, March 11, 2021

Upgrading new Exchange 2016CU18 or CU19 with Security Patch

 Hello All,

I was upgraded all my customers to Exchange 2016CU19 and CU18 with latest security patch.

Below are the urls which I was used as a pre-requisite and very useful.
Special Thanks to Michel de Rooi blogs as he explained very clearly to proceed further.

This first url gives us the Upgrade Paths for CU's and .Net and compatibility.
https://eightwone.com/2017/12/21/upgrade-paths-for-cus-net/


This second url gives us the Exchange Schema Versions along with Forest and Domains object version.
You can use this url before and after upgrading the CU's to check the versions.
https://eightwone.com/references/schema-versions/

This third url gives us the Exchange Versions and build version.

https://eightwone.com/references/versions-builds-dates/


Forth url is used to identify the .net framework version based on Windows version.
You can use this url before and after upgrading the CU's to check the versions.



Fifth url used to download the latest CU18 or 19 from below url

https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901/page/2


Sixth url used to download the latest CU18 or 19 from below url
https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-2-2021-kb5000871-9800a6bb-0a21-4ee7-b9da-fa85b3e1d23b

NOTE: My Customer was running with Exchange2016CU2 and Net framework was 4.3. Then I updated .net framework to 4.8 and installed latest CU19 and security patch. No erros and issues occured.
But before installing net framework please keep the mailbox server in maintaince mode

I was used below url to keep the node in maintenance mode and special thanks to MarkGossa blog.
https://markgossa.blogspot.com/2015/12/exchange-2016-database-availability-group-maintenance.html


Enjoy your upgrading CU19 or CU18 with latest security patch.

Any questions feel free to ask.

Regards
Anand Sunka




Sunday, February 28, 2021

Export Office 365 User’s Mailbox Last Logon details to CSV

 Hello Everyone,

I was trying to export O365 mailbox last login details to CSV by using few of the scripts but all the scripts had given me the wrong details.

After I was going through this blog I came to know that Last login details pulled by Get-MailboxStatistics gives the incorrect details. Even the below blog says.

I followed this blog: https://o365reports.com/2019/06/18/office-365-users-last-logon-time-incorrect/

Hence I used below url script to pull the details.

https://o365reports.com/2019/06/18/export-office-365-users-real-last-logon-time-report-csv/

Thanks to https://o365reports.com blog which help us a lot.




Regards

Anand Sunka

Saturday, January 30, 2016

My Updated Resume and Technical Consultant Profile

My Updated Resume and Technical Consultant Profiles are uploaded at Microsoft One Drive below mentioned URL.


http://1drv.ms/1QyZ2o1

Monday, December 29, 2014

Creating Forest Trust between different forest

Hello Readers,

Currently working on Active Directory Consolidation project with below details:

There are total of 16 different forest with different locations.

All 16 forests running on Windows 2003 Server Standard with SP2 &
Windows 2003 Server Enterprise with SP2 with the

Domain Functional Level : WIndows 2000 mixed

Forest Functional Level : WIndows 2000 Native

We can directly migrate from Windows 2003 to Windows 2012 R2 in the same forest as well as different forest.

When we install AD on Windows 2012 R2 by default it shows DFL & FFL as Windows Server 2008 minimum level.

But still we can create the forest trusts between Windows 2003 mixed DFL/FFL to Windows 2012 R2 with DFL/FFL as Windows Server 2008

All the locations are inter-connected through MPLS & Leased Lines.

Project Scope : Consolidate 16 AD forests into the Single Forest with new name.

Created New Forest with new domain.

Added DNS IPs into the Forwarders tab into all the old AD forest DNS forwarders list to communicate with cross forests.

Even added existing domain name into the new domain DNS forwarders tab & vice-versa.

Created External Forest Trust with New Forest and with the existing 16 different forests.

Now using Profile Wizard in order to migrate the User Profile data from Old Domain to the New Domain.

This completes the cross forest migration from one AD forest to another AD Forest.

Follow the similar steps on other 15 forests.


Regards
Anand

Wednesday, October 22, 2014

Lync 2010 User Contacts backup before we migrate to Lync 2013 pool

Hello All Readers,

This post is about to take backup of individual users Contacts List in Lync 2010 pool. The main purpose of this post is that I was tried moving few of the users to Lync 2013 pool by selecting "Force" option under moving users from one pool to other pool.

Unfortunately one of my users contacts list got deleted or not moved successfully.

To prevent such issues it's better we take backup of Lync 2010 users in Lync 2010 Shell console as shown below:

NOTE : Backup shown below is individual user contact list backup


Start the Lync Shell with elevated rights & go to this path :
PS C:\Program Files\Common Files\Microsoft Lync Server 2010\Support>

Run this command:


PS C:\Program Files\Common Files\Microsoft Lync Server 2010\Support> .\DBImpExp.exe /user:anand@domain.com /hrxmlfile:"D:\Lync2010_User_Contacts_Bkp\20_Oct_2014\anand.xml"

Below is the screenshot:


Above shell command has taken the backup successfully.

Go to the above path, it will create the .xml file with above name.



Regards
Anand S

Tuesday, September 30, 2014

Lync 2013 & Lync 2010 Address Book Download Issues & Find contacts issues

Hello Readers,

We normally face address book download issues and not able to find contacts in Lync 2010 client as well Lync 2013 clients.

So in that case only option is to force download the address book by using below steps:




To force the Lync Server 2013 to update the address book, execute the following cmdlet in Lync Shell on Front End :

Update-CsAddressBook

Wait for the LS Address Book Server event to report event ID 21056 listing the:



Lync 2013 :

Log off of the Lync client and delete the profile from:

%userprofile%\appdata\Local\Microsoft\Office\15.0\Lync

… then execute the following command in the command prompt to add the registry that forces the Lync client to immediately download the address book:

reg add HKLM\Software\Policies\Microsoft\Office\15.0\Lync /v GalDownloadInitialDelay /t REG_DWORD /d 0 /f


Now Log in to the Lync client & check the above path, its should create some of the files & 3 folders.

Also 2 files are created as GalContacts.db & GalContacts.db.idx which used to search for contacts under find

Now it should search for the users.







Lync 2010 :

Log off of the Lync client and delete the profile from:

%userprofile%\AppData\Local\Microsoft\Communicator

… then execute the following command in the command prompt to add the registry that forces the Lync client to immediately download the address book:

reg add HKLM\Software\Policies\Microsoft\Communicator /v GalDownloadInitialDelay /t REG_DWORD /d 0 /f


Now Log in to the Lync client & check the above path, its should create some of the files & 3 folders.

Also 2 files are created as GalContacts.db & GalContacts.db.idx which used to search for contacts under find


Now it should search for the users.



it should resolve the address book issues.


Regards
Anand S


NOTE : If this posts helpful to resolve your issue, please comment.

Thursday, September 18, 2014

Lync 2013 WAC Issue "Sorry, PowerPoint Web App Ran into a problem opening this presentation."

Hello Readers,
Currently we are facing Powerpoint presentation issues for Lync 2013 users internal as well as external.
IM, A/V , Polling working fine
Tried scenarios are :

Lync 2010 users to Lync 2013 users: showing presentation at both sides (internal & external)

Lync 2013 users to Lync 2010 users: not showing presentation on Lync 2013 client but showing at Lync 2010 client (internal & external)

Lync 2013 users to Lync 2013 users: not showing presentation at both sides (internal & external)

Below is the error we get

NOTE : This issue occurs due to several errors as I mentioned in below link. Every time whenever you get above error, you simply need to delete the cache from below path shown in the red box.
http://social.technet.microsoft.com/Forums/lync/en-US/0bbf35a5-6518-47d4-a3ee-e756a7e87487/lync-2013-users-not-able-to-share-powerpoint-presentation-internal-as-well-as-external?forum=lyncprofile
After I made several changes in Farm & IISARR rules everything was working fine like Powerpoint presentation sharing internal as well as external.
But after 2 days I was again started getting above error while I was testing sharing Powerpoint presentation between external Lync 13 users.
This issue occurs due to Caching of powerpoint files on Office Web Apps server below path as shown:

Followed this link : http://lynclounge.blogspot.in/2014/07/lync-2013-wac-issue-sorry-powerpoint.html
Special Thanks to Anthony who helped me to resolve this issue.
First stop the Office Web Apps Service on Web apps server & Simply go to the above path & delete or move the data to other path if you need.
Now start the Office Web Apps Service & try to share the PowerPoint presentation files which we get errors.
Now it should work fine without any issues.
Mine Powerpoint presentation sharing is working fine.

Regards
Anand S

NOTE : If this posts helpful to resolve your issue, please comment.

Tuesday, September 16, 2014

Lync 2013 Your server configuration has changed Please restart Lync

Hi All Readers,

Once we move the user from Lync 2010 pool to Lync 2013 pool. Eveything was working fine from the Desktop/Laptop internal as well as external networks.

From Smart Phone devices also working fine but from iPad when a user tried to use Lync 2013 client from external network it was showing "Your server configuration has changed Please restart Lync"

Below is the screen shot


I had increased the ProxyPass timeout from 200 to 960 for dialin, Lyncdiscover, Lyncweb, meet, webcontent except owebappe. I haven't seen the "configuration has changed" message for the past 18 hours.

Below is the settings changed screen shot.




This resolved my issue. I hope it will help you out.

Regards
Anand S


NOTE : If this posts helpful to resolve your issue, please comment.

Wednesday, September 3, 2014

Lync 2013 Archiving and Monitoring SQL database version mismatch issues

Hello All,


When we try to create Lync 2013 Archiving database & Monitoring database while publishing of the topology.

It creates the Archiving & Monitoring databases but it throws error of Creating database failed with below errors :

Resolution : By default it uses SA account even though if you specified other account. We must need the SA account with default permissions on SQL server where we create the databases. It will successfully create the databases.
------------------------------------------------------------------------------------------------------------------------------------
****Creating DbSetupInstance for 'Microsoft.Rtc.Common.Data.ArchivingDatabase'****
Initializing DbSetupBase
Parsing parameters...
Found Parameter: SqlServer Value sqlserver.domain.com.
Found Parameter: SqlFilePath Value C:\Program Files\Common Files\Microsoft Lync Server 2013\DbSetup.
Found Parameter: Serveracct Value SETINDIA\RTCComponentUniversalServices.
Found Parameter: DbPath Value E:\CsData\ArchivingStore\(default)\DbPath.
Found Parameter: LogPath Value F:\CsData\ArchivingStore\(default)\LogPath.
Found Parameter: LogSize Value 1024.
Found Parameter: LogSize Value 1024.
Trying to connect to Sql Server sqlserver.domain.com. using windows authentication...
Sql version: Major: 11, Minor: 0, Build 3000.
Sql version is acceptable.
Validating parameters...
DbName LcsLog validated.
SqlFilePath C:\Program Files\Common Files\Microsoft Lync Server 2013\DbSetup validated.
DbFileBase LcsLog validated.
DbPath E:\CsData\ArchivingStore\(default)\DbPath validated.
Effective database Path: \\sqlserver.domain.com\E$\CsData\ArchivingStore\(default)\DbPath.
LogPath F:\CsData\ArchivingStore\(default)\LogPath validated.
Effective Log Path: \\sqlserver.domain.com\F$\CsData\ArchivingStore\(default)\LogPath.
Checking state for database LcsLog.
Checking state for database LcsLog.
Checking state for database LcsLog.
State of database LcsLog is detached.
Attaching database LcsLog from Data Path \\sqlserver.domain.com\E$\CsData\ArchivingStore\(default)\DbPath, Log Path \\sqlserver.domain.com\F$\CsData\ArchivingStore\(default)\LogPath.
The operation failed because of missing file '\\sqlserver.domain.com\E$\CsData\ArchivingStore\(default)\DbPath\LcsLog.mdf'
Attaching database failed because one of the files not found. The database will be created.
State of database LcsLog is DbState_DoesNotExist.
Creating database LcsLog from scratch. Data File Path = E:\CsData\ArchivingStore\(default)\DbPath, Log File Path= F:\CsData\ArchivingStore\(default)\LogPath.
Clean installing database LcsLog.
Setting the database LcsLog to restricted mode.
Database LcsLog set to mode Restricted.
Setting database options.
Creating objects from dbcommon.sql.
Creating database objects.
Executing ArchDb.sql...
Updating database roles.
Setting owner for database LcsLog to sa.
Exception Stack:
Type: Microsoft.SqlServer.Management.Smo.FailedOperationException, Message: Set owner failed for Database 'LcsLog'.
Type: Microsoft.SqlServer.Management.Smo.SmoException, Message: An exception occurred in SMO.
Type: System.ArgumentException, Message: The login 'sa' does not exist on this server.
--------------------------------------------------------------------------------------------------------------

I hope it will resolve the issues.

Regards
Anand S


NOTE : If this posts helpful to resolve your issue, please comment.

Friday, August 1, 2014

Domain Join Error "Changing the Primary Domain DNS name of this computer tofailed error"

Hi All Readers,
I am working on a Active Directory migration project from Windows 2003 R2 Active Directory to 2008 R2 Active Directory fir multiple sites.
After I completed my migration project I was noticed that below error whenever I was trying to add a PC/laptop/Server to the domain, but it successfully adds to the domain.

But this error is very critical because when we add a duplicate name it won't give us the duplicate name errors simply it over-writes the existing host name which makes lot of issues.
I faced this critical error which makes over-writes the host names in the domain when you join.
For example: Already you had a host name called as PC.domain.com in the domain.com Domain.
When you try to add the another host name called as PC in the domain.com Domain, it doesn't give you the duplicate name error on the network it does over-write the existing host name called as PC.domain.com & it will add the new host name into the domain.

Host name which got over-written will get removed from the domain. I faced this issue in my project. My DPM host name got removed from the Domain & new host name got joined into the domain which halted my backups for one day.

Final Resolution is as follows:
You need to start the dns console on the DC & drop down the domain name.
Select the _msdcs when you click on _msdcs it will show the Name Server's list on the right hand side.
You need to add the Domain Naming Master under the _msdcs or add all the domain controllers which you had.

After you add the Name server's try joining the PC OR Laptop OR Server to the domain which is successfully joins it.
I hope this will resolve your issue.
Regards
Anand S


NOTE : If this posts helpful to resolve your issue, please comment.

Sunday, June 22, 2014

Combined Exchange 2010 Hub Transport/CAS Role installation failed due to IP v6 is not enabled

Hello Readers

When I was installing combined Exchange 2010 HUB Transport and Client Access roles on Windows 2008 R2 SP1 got failed & given below error



Reason for Failed : IP v6 is not checked in the Lan connection.

Resolution : Simply check IP v6 in Lan connection and re-run the setup it should install successfully.



Regards
Anand S


NOTE : If this posts helpful to resolve your issue, please comment.

Thursday, November 14, 2013

How to Uninstall Exchange Server 2010 mailbox Server Role

How to Uninstall Exchange Server 2010 mailbox Server Role


In my case I had DAG with 2 Mailbox Server Roles Installed

1) You can complete this step by going into the Organization Configuration - Mailbox - 
     Select Database Management Tab - Under Work Pane it will show the DBs which are added into the DAG. Right Click & select remove the Database & click remove - It will remove the Database membership from DAG
     
2) You can complete this step by going into the Organization Configuration - Mailbox - 
     Select Database Availability Groups Tab - Right Click properties of DAG name - 
     Click on Manage Membership Tab - Here you can remove the Member Servers which you want to        uninstall the mailbox servers. Select the Server & Click Delete. Process will get completed.
3) Now Delete the DAG name under DAG Group TAB. Here the DAG is deleted.
4) Now you go to Add or Remove Programs & select Microsft Exchange Server 2010. Click Uninstall.

It will show below window;

Uncheck the Server Role which you need to Uninstall & uncheck Management Tools as shown above.
Click Next it will check the Readiness Check.

Need to close MMC and EMC to prevent errors otherwise errors will show up for uninstall.

Here Exchange 2010 Mailbox Server Role is Uninstalled.



NOTE : If this posts helpful to resolve your issue, please comment.