To do list when an employee departs an organization

When an employee leaves an organization, these are the steps that should be followed after his/her departure:

1. change password in ADUC
2. change password on email service, if managed separated
3. remove user from all distribution groups he/she may be a member of
4. ask the user's manager what should be done with his/her email.  This post discusses common options

resetting admin password on a Mac

I had a client with a Mac where we did not have the admin credentials for the sole administrator on the laptop.  I was luckily able to find this option to tell the mac to set itself up from scratch by removing the file that tells the Mac it has already gone through the initial setup process so it goes through the initial setup process again on the next reboot.  That is described here:

http://osxdaily.com/2010/08/10/forgot-mac-password-how-to-reset-mac-password/

In case this that post is ever removed, here are the steps:

Restart the Mac holding down the Command+S keys, this will take you into Single User Mode and its Terminal interface

type:
mount -uw /

type:
rm /var/db/.applesetupdone

type:
reboot

This worked very well for me and allowed me to create a new account on the Mac and did *not* delete the existing data already on the Mac on the user whose password we did not know.

removing password change requirement on Office365

By default, Office365 forces you to change your password every three months.  Should you want to keep Office365 from forcing you to change your password every three months, these instructions will help:

Follow steps 1 through 4 here:
http://www.christiano.ch/wordpress/2012/03/28/office-365connect-to-msonline-using-powershell/

This gets you to the powershell for your account.  Now, you need to enter the command to disable the password change requirement.

The command is:

Get-MsolUser | Set-MsolUser -PasswordNeverExpires $true

It looks like this:

It doesn't give you any confirmation, but it works.

resetting a password on a Mac

This is a good article on resetting your Mac password if you have lost it and you have the original Mac OS installation discs:

http://kb.wisc.edu/helpdesk/page.php?id=3853

resetting a domain admin password on Windows 2008

I had lost the main admin password on one of my client's Windows 2008 SBS boxes, and I thought I'd have to try one of the many utilities that exist for changing passwords outside of Windows, but instead I found this:

http://lordoftheping.blogspot.com/2009/05/i-did-not-use-my-tests-virtual-machines.html

Using just the Windows 2008 DVD, you can reset any domain admin password.

Info recreated here just in case that page is ever taken down:
* Boot onto DVD of Windows Server 2008
* Choose “Repair your computer”
* Launch cmd
* Go to c:\windows\system32
* Rename Utilman.exe to Utilman.exe.bak
* Copy cmd.exe to Utilman.exe
* Reboot on Windows
* Do the keyboard shortcut Windows + U when on the logon screen
* net user administrator Newpass123 inside the cmd
* log on with the domain admin account and this new pass
* change the password to remember it if needed
* Reboot on the DVD to put back the original Utilman.exe


Youtube video of the process here:
http://www.youtube.com/watch?v=Ar-VoO9ogHc

altering the default lockout policy on Server 2003 (SBS or Standard)

For servers that are publicly facing, it's possible that hackers will attempt to hack you. Recently, I had a hacker try to guess logins and passwords over and over and over again (thousands of times) over port 25. I was able to thwart that by disabling port 25 for a bit (15 minutes) and the hacker lost interest. But theoretically, had I not seen the hacker attempting, he could have tried hacking forever, just guessing and guessing.

There's no lockout policy for invalid usernames. If the hacker is guessing on jsmith and you don't have a jsmith user, he can keep guessing forever. The lockout policy will not apply. But if the hacker is trying legitimate user names, the hacker should be locked out after a limited number of attempts. I have seen the default as no limit and as 50 attempts on SBS machines.

The number of attempts should be 6 or fewer and the lockout times should be 15 minutes or longer.

You can get to the appropriate place via:

Group Policy Management -> expand to default domain policy, right click on default domain policy and click edit. Then edit these fields:

Removing password requirement for mobile devices on Exchange 2007 and/or SBS 2008

When you put in a Windows 2008 SBS box, it puts in a password requirement once the mobile device (for example - an iphone) has an active Exchange ActiveSync connection.

You can alter that setting in Exchange Management Console under Oragnization Configuration -> Client Access -> right click on Windows ... Mobile Policy ... and unchecking require password on the password tab.

In my experience, you need to remove and re-add the account on the mobile device after making the settings change (at least on an iphone 3Gs I tested on)

More details here:

http://msmvps.com/blogs/bradley/archive/2009/07/04/you-deployed-a-new-sbs-2008-and-now-the-phones-demand-a-password.aspx