Outlook Authentication Broken–Username and Password Missing

Posted on Leave a commentPosted in Authentication, windows 10, windows 7

I came across an issue recently where the Outlook security dialog box popup was broken. Rather than looking as below, the username and password fields where missing:

windows_security.jpg

The dialog box appeared as:

image

Notice that the username and password fields are missing! Also missing, and the key to this issue, is the picture is missing too. This is usually an empty box, but for some companies they use Group Policy to push out a different graphic.

That image is a bitmap stored in “C:\ProgramData\Microsoft\User Account Pictures”.

At a client of mine, the marketing department had requested the company logo replace the user picture and provided at 1MB file for this purpose. The file was deployed to all machines and overwrote the user.bmp by way of GPO preferences. Resizing user.bmp to under 48K in “C:\ProgramData\Microsoft\User Account Pictures\” on a single machine resolved the issue for users on that computer. We then changed the source of the image to under 48K centrally to fix all users.

Note that this was Windows 7 – different file sizes and dimensions exist for different versions of Windows. For example a user.bmp file on Windows 10 can be 448×448 and the default is just under 600KB. So again, the 1MB file mentioned above might also break Windows 10, but to fix the issue on that OS I probably dont need to reduce the file size so small.

Azure AD SSO and Disabled Computer Accounts

Posted on 5 CommentsPosted in Authentication, Azure Active Directory, Azure AD, Office, Office 365, SSO

When you set up Azure AD SSO, the Azure AD Connect application creates a computer account called AZUREADSSOACC. Do not disable this account, or SSO stops working.

I’ve had a few clients in the past week disable this when generally disabling all the computer accounts that have not logged in for X days.

Therefore if you have Azure AD SSO enabled, I suggest updating your documentation on disabling computer accounts – ‘cause not all computer accounts actually login as computers (I’m thinking Cluster services here as well) and consider actually whether or not disabling accounts for computers that are not logging in any more is necessary.

Then also take the AZUREADSSOACC account and set a description on it saying do not disable!

image