Entra ID Set User Account Password to Never Expire

 I ran into this one recently as a user account for Cisco CUC had been created in Entra ID only and not on-premise and allowed to sync.  It's just a few PS commands and you can set the password to never expire.

NOTE:  You must be a global admin or password administrator to perform these changes.

I ran all of these commands from an Exchange 2019 on-premise server running in hybrid mode.

1. Connect to Exchange Online

Connect-ExchangeOnline

2. Connect to Microsoft Graph PowerShell and to the required scopes.

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All"

3. To check a user's account to see if the password expiration is set run this command: 

Get-MGuser -UserId <user id or UPN> -Property UserPrincipalName, PasswordPolicies | Select-object UserPrincipalName,@{N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}

4. To set the password of one user to never expire, run this command:

Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration

These commands will allow you to set the password policy to never expire for just a single user account as needed.  For more details on how to change it for all users and check for all users, you can reference the official Microsoft Learn article HERE.

Good luck!

"The namespace cannot be queried. Access is denied" error when you try to create a domain-based DFS namespace

Working on setting up a new DFS Namespace today.  Ran directly into this issue.  When you sign in to Windows by using an account that belongs to the Domain Admins group, and then you try to create a domain-based namespace on any Distributed File System (DFS) namespace server, the operation fails. Windows returns an error message that resembles the following:

\\domainname.com\Public The namespace cannot be queried. Access is denied.

However, when this error occurs, you can still successfully create a standalone namespace.

The fix is to remove your account from the Protected Users group.

If you're curious, here's why it doesn't work:  When you create a new domain-based namespace, the computer queries the Domain Name System (DNS) server for domain information. The DNS server responds by sending a list of the A records of the domain controllers for that domain. The computer then contacts one of the domain controllers and tries to use your account credentials to authenticate by using NTLM authentication.

If your account belongs to the Protected Users group, your account can't use NTLM authentication. In this situation, authentication fails and generates a STATUS_ACCOUNT_RESTRICTION error.