ASEv2 subnet sizing

When Microsoft rolled out the original App Service Plans the recommended subnet size was 64 addresses (aka /26).  The ASEv1 series was limited to 50 worker process (minus update domain overhead, etc).  With the introduction of ASEv2 they now support up to 100 worker processes so naturally the question is do you need to use larger subnets - and the answer is yes.

In an ASE environment each App Service Plan (container of apps) is equivalent to 1 worker which is really a VM.  Each worker consumes 1 IP address and even if you follow the general guideline of leaving 20% or more free capacity for scaling and other events that still puts you in the ball park of 80 IP addresses.  On top of that, the ASEv2 consumes 7 IP addresses (with an ILB) between the hidden front end servers, file servers, and fault tolerant instances of small/med/large images.  And if you're running in a multi-tenancy configuration you'll consume even more IPs depending on how many IP addresses you attach to it. 

If you're never planning on exceeding more than say ~30 app service plans in your ASEv2 then you can probably get away with a /26 but you're doing so knowing that you're risking scaling or capacity issues down the road.  But if you really want to cover your bases properly use a /25 (128 IP) subnet.

365 now supports SHA256 signed tokens from your ADFS

Not sure when they're going to cut off the old SHA-1 but it doesn't hurt to get updated early.   It's an easy change which shouldn't have any negative impact on your production environment.   Instructionslink below:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-federation-sha256-guidance

Palo Alto NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

Being able to transparently tie in a particular user to traffic passing through your firewall is a great feature (and fairly common in the current gen of firewalls) - provided you set it up right.

I followed the instructions at
https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Agentless-User-ID/ta-p/62122
and set up the dedicated ldap user on my Windows 2012 R2 domain and assigned it to Distributed COM users, Server Operators, and Event Log readers.  Then I set up the WMI permissions and started seeing the Access Denied next to my discovered domain controllers.  I then SSH'd into the Palo to check the mp-log and useridd.log and ran into the NT_STATUS_ACCESS_DENIED error. After some troubleshooting I realized what I'd messed up - I misread the instructions for the WMI edit.  I had drilled down to 'Security' when the instructions had intended for me to stop at CIMv2 prior to editing the properties.

After fixing my mistake, the access denied message went away.

Ubiquiti Unifi - an SME's best friend - resistance is futile

It's often difficult in small to medium IT shops to get enough budget to build a network that's stable enough to let you sleep at night.  For the most part you either pay a premium for your Cisco Catalyst, Juniper, etc and then spend hours learning how to use them properly or you wind up buying small business versions like the SG300, netgear, linksys and pray daily for uptime and accept lower performance.  It's kind of like buying a SonicWall instead of a Cisco ASA or a Palo Alto firewall.

A colleague of mine recently introduced me to Ubiquity Networks which has been around for a little over a decade and has a decent following.  Their approach to network design places a high emphasis on a dedicated controller machine or cloud key which in turn manages every other Unifi device in your network.  You define all your VLANs, WAP networks, and other settings in the controller and then 'adopt' your other devices.  The controller handles all the upgrades and provisioning of the new devices after the device has been adopted and provides statistics on clients, bandwidth usage, and types of hardware.

One console to rule them all.

bandwidth hogs can't hide.

basic switching - and yes it has STP.

The built-in Map function is pretty nifty as well.  It allows you to upload a floor layout and then define a map scale.  You then drag and drop the devices from inventory and the map updates to show you hotspot coverage, topology and other useful network management data.  And yes, this is all without buying an additional software package!

Wireless Cover map - labels removed

I was able to replace the whole wireless network for a 16,000 sq ft facility for just under $1k.

My deployment:
a) 1 UniFi Cloud Key (~$95 on amazon) - powers off POE and has a smaller footprint than a dedicated controller machine.
b) 1 Unifi 24 port POE 250W switch (~$365 on amazon)
c)  multiple UniFi AP-AC-Pro wireless access points (~$129 on amazon).  All POE based and a ridiculous indoor range compared to the Cisco WAP551 units that we used to have.

Implementation:
Note:  Make sure you have working DHCP on your network to make configuring the devices easier.

1) Rack mounted the switch, plugged in the cloud key, ran cabling to WAPs from the switch.
2) Configured the Cloud key - set up multiple wireless networks (limit 4).  The WAPs auto switch between 2.4 and 5 GHz using the same wireless network name so both client types work.  I set each wireless network to it's own VLAN and RADIUS authentication on the more secure one.
3) I 'adopted' the switch and the WAPs through the cloud controller interface.  And then I went ahead and hit the 'upgrade' button next to each to get the latest firmware.

--------------- And that was all it took -------------

Flat out, the stuff works.  Wireless handoff from WAP to WAP and all my client devices worked without a hitch.  I'd definitely recommend them if you're doing a greenfield deployment or if you're just looking to upgrade your small to medium sized network.

Extending your on premise AD (hybrid 365) into the Azure Cloud

Sure, if your on-premise Active Directory is already being synchronized with Office 365 then you've most likely already been exposed to the benefits of single sign-on.  And perhaps you've even spun up your own Azure subscription and set your synchronized Azure AD as the authentication provider so your team can assign Azure admin roles to your on-premise credentials.  There's one more nifty thing you can do which is to use Azure AD Services to extend your AD into Azure to provide domain services to the VMs inside your subscription (aka domain join, single-sign on inside the VM, etc).

The other alternative would be to spin up some servers, build out a site to site VPN, dcpromo the boxes, set up the AD site(s), and then manage it old school.  On the upside you'll have more control over your AD and it'll be a complete replica of your on-prem setup.  The downside is that you'll have more boxes to patch, more replication traffic to pay for, and possibly split fsmo roles.  There isn't a wrong answer, it just depends on if feel that your datacenter is more secure than Azure and what your company's needs are.  In my case, I decided to explore the ADDS route.

Enabling my Azure AD instance started out pretty straightforward, got a little murky with the virtual networks, and then took some patience for password sync.  I used Microsoft's documentation at https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-getting-started   (Make sure to use the 'synched tenant' instructions for password sync)

Steps a through e below cover just setting up the basic ADDS.  The steps after that explain how I got it integrated with a Resource Management virtual network and VMs using Peering.

a) Created the AAD DC Administrators Group - this is a special group that is automatically inherited into your new ADDS so you'll want to put your admin accounts in here.
b) ADDS currently only works with the old type of virtual network and not the newer Resource Manager one.  So I had to create a legacy virtual network.
c) After enabling ADDS it took around 15 minutes to provision.  I chose the 'yourcompany.onmicrosoft.com' domain name and connected it to my new legacy virtual network.  Once provisioned, it popped out a new DNS IP.
d) I then edited the legacy virtual network and specified the IP address for the new ADDS.  This made it the new default DNS service for that virtual network.  Note:  After another hour, a second DNS IP showed up in the ADDS view.  It doesn't matter what you name them in the virtual network.
e) I then ran the powershell script in the link above to force a full sync in my AAD instance.  The first two variables have to be edited by hand before you run the script.  If you're not sure what your connectors are called, just open the Synchronization Service Manager and view the Connectors tab. (Hint - the one that ends in 'AAD' is your $azureadConnector)

f) I created a new virtual network in the 'new' Azure portal - making sure that the IP range did not overlap the IP range of the legacy virtual network.  (10.10.0.0/24 vs 10.20.0.0/24 and not 10.0.0.0/8 and 10.20.0.0/16 which would have collided).
g) Now to get both virtual networks to play nicely, you can either do a VPN and/or gateway or you can just do virtual network peering which will merge the two together much like joining two switches with a cable in a Layer 2 fashion.  From the 'new' Azure portal, under Virtual Networks, I selected the virtual network (ARM type) that I created earlier and then Peerings

h) I clicked Add at the top of the blade, gave the peering connector a name, chose Resource manager (important), assigned it the same subscription as everything else, and then chose the Classic virtual network from the selector.

i) Then I went back in and updated the DNS settings for the ARM virtual network.  Remember, out of the box each virtual network defaults to the Azure-provided DNS.  I was not able to join a VM to ADDS until I changed it to use the DNS servers for ADDS.  (There is a chance that if would have eventually worked without this step but it's up to you if you have more time available to wait it out).

j) I provisioned a new machine, booted it up, and then joined the yourcompany.onmicrosoft.com domain using the on-premise credentials that I'd put in the AAD DC Administrators group.

The return of UNCHardenedPath problems.

Last week we rolled out some new GPO security settings which made our Windows 10 machines stop being able to process group policy changes.  First we noticed the GPP drive maps had stopped working and when we ran gupdate /force manually it failed citing that it couldn't access gpt.ini for
31B2F340-016D-11D2-045F-00C04FB984F9 (aka the Default Domain Policy).
While researching it we found many articles on how Windows 10 by default has UNC Hardenening enabled and the various patches (MS15-011, MS15-014) had affected many users in GPO environments.  We weren't using user filtering and all of our GPOs had Authenticated users listed with Read and Apply permissions so that wasn't it.  So for testing, we added the registry keys to disable Mutual Authentication on a laptop.

New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" -Name "\\*\SYSVOL" -Value "RequireMutualAuthentication=0" -Property "String"

New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" -Name "\\*\NETLOGON" -Value "RequireMutualAuthentication=0" -Property "String"

We were able to run gpupdate /force successfully after that but we didn't like that solution because that meant we'd have to manually update a lot of machines since even login scripts were broken at this point.  That and it just didn't make sense that Microsoft would have implemented all these security controls if they didn't work so we continued researching.  We found the next clue at the end of Sean Greenbaum's post - patch MS16-075 / KB 3161561 which was released in June and purportedly had caused issues for users trying to access SYSVOL shares.

The workaround listed was to set the SmbServerNameHardeningLevel to 0 under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
on the domain controller servers.  That registry key corresponds to the GPO security policy
Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher
which was one of the settings that we'd changed the week before.  Setting that to Off changes SmbServerNameHardeningLevel to 0.  Once that change was made on the Domain Controller GPO and applied, all of our client issues were resolved.

Ultimately this came down to insufficient testing on our part and it is one of the risks of trying to harden down existing systems.

References;
https://blogs.technet.microsoft.com/askpfeplat/2015/02/22/guidance-on-deployment-of-ms15-011-and-ms15-014/

https://blogs.technet.microsoft.com/askpfeplat/2016/07/05/who-broke-my-user-gpos/

https://social.technet.microsoft.com/Forums/en-US/6a20e3f6-728a-4aa9-831a-6133f446ea08/gpos-do-not-apply-on-windows-10-enterprise-x64?forum=winserverGP

https://community.spiceworks.com/topic/1389891-windows-10-and-sysvol-netlogon

Veeam error after Hyper-V migration

In general I find Veeam backup and replication 9 performs brilliantly once it's configured.  But sometimes infrastructure changes can really throw it for a loop.  I recently had to shuffle several VMs around between Hyper-V hosts using the built-in Move command and afterwards Veeam started throwing errors on some of the VMs. (Task failed:  failed to expand object.  Error:  Cannot find VM on host...)

The main thing they all had in common was they they were configured to use alternate guest OS credentials (which Veeam uses to take the internal snapshots).  In the Veeam GUI these all appear to be tagged by VM Name but what I suspect is that on the back end it's latched on either to the GUID or the host server name so by Moving the VMs it started treating them as new entities.

The fix is a relatively straightforward but manual process of removing them, adding them back from the new associated servers (under Guest Processing, Credentials...), setting the right credentials for them, then hitting OK, then Finish.  That will fix that particular error so you won't see it again on the next run.

Configuring LDAP auth from Palo Alto PA-500 firewalls to Windows 2012 R2 AD servers

For the most part this is covered in the Palo Alto admin guides but if like me you just wind up owning one of these at work and you don't have a bunch of time to decipher it then you might find this useful.  Especially since configuring Palo Altos is a lot like object oriented programming where you have to 'build' out all your components and then chain them together which makes troubleshooting more fun.

LDAP Config (using PanOS release 7.x):

Step 1 -

Device Tab -> Server Profiles -> LDAP.  From here Add a new Server profile, give it a meaningful name like domain-ldap and populate the server list.
Enter in your base DN
Enter in your Bind DN - which in my case I created a dedicated service account and entered it in UPN format as 'accountname@domainname.com'.  Then enter in the password for the account so it'll be able to access the directory.

For AD LDAP, go ahead an uncheck the Require SSL/TLS checkbox.

And Commit your changes

Step 2

Now go to the Authentication Profile (also on the Device Tab) and click Add.
Give it a meaningful name like ldap-authprofile.
Then choose the Server Profile that we created in step 1 from the drop down list.
The Login Attribute should be sAMAccountame.  (no, I don't know if that's case sensitive).
Important - Fill in the User Domain with the NETBIOS name of your domain.  Yes, I know it's 2016 and we're still stuck with it.  It'll make a difference later on if you try to do Group Filtering.
If you're setting up an Allow list then click the Advanced Tab and enter in the LDAP strings for your groups.

And Commit your changes

Optional Step 3 - Group filtering/search

If you're using Group Filtering, make sure to go under User Identification, then to the Group Mappings setup tab and Add those groups in.
Click Add, then choose your Sever Profile that we created in Step 1.
Go to the Group Include List Tab, and drill down to your group.
Note:  if you can't drill down, then you don't have a working LDAP connection.  check your settings and make sure your AD Controllers are listening.  Also, keep in mind that the traffic will be coming From the MGT port on the Palo Alto which may have a different IP.

Click Ok. Commit your changes.

At this point you should have a fully functional LDAP Authentication Profile which you can feed into other objects like Authentication Sequences, GlobalProtect Gateways, etc.

Troubleshooting tips:
The default caching period is about an hour.  If you're doing testing you'll want to force that cache to empty out.  From a console/ssh connection - run
debug user-id refresh group-mapping all
to refresh the LDAP cache.

PanOS 7.x also has a new feature to help you troubleshoot authentication from a command line. Details here:
http://dsg0.com/t/palo-atlo-networks-user-authentication-test-through-cli/273

Good Luck!

Veeam failed to create snapshot (Microsoft Software Shadow Copy provider 1.0) (mode: Veeam application-aware processing) on hyper-v

We recently abandoned Backup Exec and transitioned to Veeam Backup and Replication and as with most product transitions we ran into a few hiccups.  Aside from having to adjust Shadow Copy space limits on some VMs and Hyper-V hosts, we also ran into snapshot errors.  BE uses agents to handle quiescing while Veeam directly contacts the VM to request snapshot creation.  Some of our VMs were in DMZs and other areas and not on a domain so the default credentials that Veeam was using was not able to authenticate and create snapshots.

The fix for this was to add additional credentials and map them to each of the errant VMs directly.

After we got that sorted out, the rest was a breeze.

Bitlocker could not be enabled - Dell Latitude 7440

Sometimes it just doesn't pay to disable stuff in BIOS.  I recently had problems enabling Bitlocker on some Latitude 7440 units.  After the initial reboot the error would pop up saying that the bitlocker encryption key cannot be obtained.  So I checked the usual suspects - clearing the TPM, making sure the TPM was recognized in device manager, etc.  And then I remembered the USB settings that we'd changed to lock down the laptops more.

Specifically under System Configuration, USB Configuration, "Enable Boot Support" which had been disabled just to make sure our users wouldn't be able to boot off USB devices.  I wouldn't have equated that bitlocker error with that setting but as soon as we undid it on the laptops we were able to enable bitlocker.

Lync 2013 android client error connecting to ADFS 3.0 federated 365 service

So after our migration to ADFS 3.0 from the old ADFS 2.0 servers my Android based Lync users started getting we can't sign you in, please try again errors during login.  After digging around I found this forum entry from Jeffr.M which points out that the Lync android app has an issue with servers that can support multiple certificates on the same IP.

http://community.office365.com/en-us/f/173/t/223414.aspx?pageindex=2

The following command adds a new default catch-all listener to your server.  If you're using a Web Application Proxy like I am you'll want to run this on that server as well.

netsh http show sslcert

The command above will show you all the listeners and their associated certificate hashes and application IDs.  You'll need those for the next step.

netsh http add sslcert ipport=0.0.0.0:443 certhash=INSERTHASHHERE appid='{INSERTAPPIDHERE}'

Note the ticks around the appid.  Powershell sometimes eats curly brackets so you'll get an error if you don't use the "'" marks.  More info here

Note 2: If you're thinking it's easier to just copy/paste the certificate hash from the MMC Certificates panel - Don't. That method often introduces hidden characters which will take forever to debug.

After you do that on your ADFS 3.0 and WEP servers, restart the ADFS services on them and then your Android Lync clients will start working again.

On a related note, if your Onedrive authentication isn't working - try disabling the /adfs/services/trust/2005/windowstransport endpoint.  (disable on proxy if using a proxy or just disable both modes just in case).  There's a bug with the windowstransport endpoint in ADFS 3.0 and Onedrive authentication.

Fix for Wake after sleep freeze on Dell Latitudes

This turned out to be an issue with the O2Micro SD/MMC drivers on the E6420/E6430 units that we had. After adding new drivers to our MDT server I started getting reports from users stating that their laptops were completely freezing up after waking from sleep - no response to keyboard, mouse, etc.  No mini dumps were generated, powercfg - energy didn't show any major issues, and event viewer was useless.  It was occuring both on Windows 7 and Windows 8.1 builds.

It wasn't until after I started disabling hardware components in Device Manager that I found a correlation between disabling the O2Micro SD/MMC controllers and it being able to wake from sleep.  (I rebooted after each diagnostic test just to make sure all changes were in full effect)

Installing an older version of the driver and rebooting fixed the problem on all the laptops that were having the hang issue.  Of course, just disabling the SD/MMC controllers is a fine fix too.

How to access BIOS on a Dell Venue 8 Pro

Turn the Tablet off.
Press the power button once and then hold the Volume down button for a few seconds.  Let go a couple of seconds after the Dell logo appears.
And now you're in BIOS.

Exchange 365 hybrid Remote move request- found yet another method for getting the operation could not be performed because the GUID could not be found.

Just when you think you've got the hang of your hybrid exchange deployment (on-premise and cloud), the cloud throws another curve ball at you.   I thought I had the process nailed down but apparently I forgot the old rule of 'order is important'.

Scenario:  You need to create a new user so you go to the AD controller and create or copy them.  Then I went to my DirSync server and forced a "Start-OnlineCoexistenceSync" and then waited a few minutes for it to finish.  Now at that point what I should have done was go to the on-premise Exchange server and created the new mailbox, and then ran DirSync.  Instead since I already had the office365.com admin portal up I went ahead and assigned a license to the user since the object was already sync'd up on the cloud.  When I went to submit a Remote Move Request of the mailbox from my on-premise server to the cloud, I got the friendly "The operation couldn't be performed because object couldn't be found on  .   At this point I hadn't figured out what I'd done wrong so I forced DirSync a few more times, unassigned the license, reassigned the license, etc.  In the end, I actually wound up having to delete the new AD account I'd created and do the whole thing over again but this time I created the local mailbox BEFORE I assigned a license in the cloud.  Apparently if you assign a license to the user and they don't have an Exchange GUID in their AD attributes yet, it hoses things up.  

Order:
1. Create AD user
2. Create local mailbox
3. Force DirSync
4. Move mailbox to the cloud
5. Assign a license in the 365 admin portal

Notes:
Steps 4 and 5 are interchangeable.
We create the mailbox locally first so that we retain the ability to move it back from the cloud to on-premise later if needed.  DirSync does NOT replicate a GUID created initially from the 365 cloud back to your local AD.

Migrating from on-premise BES on Exchange 2010 to Blackberry cloud services on office 365

I'd been waiting a very long time to finally be rid of my on-premise blackberry enterprise server and the blackberry cloud services (at the compelling price of free) was a light at the end of the tunnel for the office 365 upgrade.  But as you know, with Blackberry there are many things that can go wrong and most roads lead to phone wipes - which wasn't an option for me.

The initial activation was a piece of cake.  I just went into the office 365 admin portal and activated it under Service Settings -> Mobile.  Then waited 20 minutes as recommended on this guide:  http://www.proexchange.be/blogs/office365/archive/2012/03/08/migrate-from-on-premise-blackberry-enterprise-server-to-blackberry-business-cloud-services-in-office-365.aspx

Before proceeding I had all my blackberry users check to make sure they had the Enterprise Activation App installed.  

Then I added my first user and sent them the invite and migrated their mailbox to office 365.  At which point I found out that the user had never verified their blackberry ID so they couldn't download the app.  Oh, and they were on their last password attempt before it would wipe on them.   After having fixed that, we then tried the activation and it balked and told us to wipe the device because there was already another account on it.  Now wiping this particular employee's device was really just not an option.  So after digging around, I found a page that told us we could initiate an organization data only wipe from the BES console.

http://docs.blackberry.com/en/admin/deliverables/27983/How_device_deletes_work_data_1303191_11.jsp

"In the Device activation list, click Delete only the organization data and remove device. "

That worked properly and then we were able to get a little further along into the enterprise activation where it decided to get stuck forever while contacting the server.  To fix that, we just yanked out the battery for 30 seconds, then plugged it back in and tried again.  And voila - a fully functional blackberry on blackberry cloud services connected to an office 365 account.

remote move request not an accepted domain for your organization

So you've got your fancy Hybrid configuration all set up between your on-premise Exch 2010 SP3 server(s) and the office 365 cloud and you only get this error on some mailboxes.  Your dirsync is working fine, and your ADFS is even working for once.  Depending on your situation you may even have noticed that it's mostly older user mailboxes that are giving you grief.  In my case we used to have other domain names in use and when those were decommissioned, the extra Email addresses were never removed from the mailboxes.  For the Remote move to work, the only email address domains that can be attached to that mailbox have to be listed under the Domains tab in the office 365 admin page.  Once you remove the extras, then wait a while, then force a Dirsync, then wait a while and try again it'll go through.

Example:

UserA has these email addresses:
usera@contoso.com
usera@contoso.mail.onmicrosoft.com

UserB has these email addresses:
userb@contoso.com
userb@contoso.mail.onmicrosoft.com
userb@notcontoso.net

If the domains tab in office 365 only has contoso.com and contoso.mail.onmicrosoft.com, then UserA will move but UserB will fail.

Windows RT touch cover keyboard not working fix

So one of my managers got their brand new, shiny Windows RT units in today.  And the touch keyboard wouldn't work at all.  Of course, finding any hints online during the launch week of a new device is fun and after trying out several solutions such as re-docking, refreshing, and cursing profusely, we tried one last thing we saw on the forums - rubbing alcohol.
Yes, after seeing a post from rhalbert10 at http://forums.wpcentral.com/surface-windows-rt/199669.htm we grabbed a bottle of rubbing alcohol and some q-tip swabs and cleaned off both sets of shiny, brand new, untarnished, pristine looking connectors.  We let it air dry for 3 minutes and then redocked the touch cover.  And it started working fine...

Lync 2010 clients stuck in Offline state after patching

So after applying all the latest patches to my Lync 2010 server, my users started complaining that they were stuck in the Offline state but still 'connected'.  I noticed some errors in the event log related to SSL problems so after digging around I went into the Lync Deployment Wizard and ran the certificate wizard.  One of my external certificate entries was displaying as 'missing'.  After digging further I figured out that one of my certificates had expired but hadn't caused any problems so I hadn't noticed.  So I just installed an updated certificate and Assigned it using the wizard and shortly after all my Lync clients switched back to an Available status.

Scheduling non-humans in project 2010

So I was helping someone muddle through making a Project plan and ran into scheduling fun.  Some human performed tasks had to be scheduled with Predecessors that were computer days.  The humans only work monday-friday as opposed to the computers which ran 7 days a week.  I found several articles online that showed how to make a copy of the Standard calendar and they all said to change the days to include the weekends.  This seemed to work until we got a dozen or so entries into the plan and then it tried to schedule a Finish task on the same day as a Start for the same computer resource.  After fumbling around for a bit I figured out how to change the Display from just Date to Date and Time (00/00/00 00:00am/pm) and I noticed some odd start/stop times.  Ultimately the issue was that the Standard calendar Work week has the time defined as 08:00 to Noon and 13:00 to 17:00.  My cloned calendar had just been set to 08:00 to 17:00 which Project treated as a 9 hour work day and applied 8 hours of work which left a remainder.  So yes, now my computers get a lunch hour too and all is well.

Syncthru LDAP to 2008 active directory

I had the opportunity recently to work with one of the newer large multifunction Samsung copiers this month.  The Syncthru web interface is fairly feature rich but the documentation really could use more examples in some places.  My bane for 2 hours was figuring out how to populate the address book inside it by doing an LDAP pull from Active Directory.
The initial setup of the LDAP connector went through pretty quickly.  I just went to Security -> Network Security and then down to LDAP Server on the left menu.  I then clicked Add to enter in my LDAP server.  I added in the IP address of one of my domain controllers and then used Port number 3268 to start with because you want to keep it simple initially and introduction SSL LDAP would just add one more thing to troubleshoot.  Fill in your AD Domain name in DC=yourdomain,DC=com format.  Choose simple and enter in your username in DOMAINNAME\username format.  Note that this is the first oddity in that we're mixing netbios/domain name\username format and LDAP convention on the same form.

On the second half of that window, don't check the LDAPS yet!!!  

Click on the TEST button at the very bottom and make sure you get all OK/Success. 

Once that works, then click the Apply button at the top to save these settings.

So now we're halfway done and ready for the twists.  Go to the Address book and then click on the LDAP button at the top right.

Now for the GOTCHAS!   

a)  I couldn't get it to search recursively

b)  It only worked when the user account I used to authentication against AD was in the same ORG that I was searching.  (My AD is set to not allow anonymous searching so I have to use authentication)

c)  The login ID is in CN=firstname lastname format.  This is different than the domainname\username from the other LDAP screen.

d)  The search root is the full path to the exact ORG that you want to pull from. (note the OU=test, OU=US prepended)

To keep it simple, I used (mail=*) for my search filter.  Click on the Search button when done and IF you are successful, a list of people will show up.  Just click the Apply button to pull them all into the Address book (you can always delete the ones you don't want later from inside the copier).  If you botched it, you'll get Incorrect Filter errors.

Repeat for your other ORG units, remembering to use an account inside each one for the Login ID.  If you make it past the inconsistencies of the interface and the limitations of the AD implementation of LDAP you're home free.  Once you're done you'll have a fully functional Scan to Email function that works great.