Wednesday, September 22, 2021

RANT TIME: Why do replies to a message I sent go to my spam folder?

Despite what one would think/hope, sending a message to a given address does not inherently give Google a high confidence that a reply from this address is expected (and, for example, that it should bypass spam checks). I have confirmed with Google's tech support that there is no way to automatically have this happen. The user can do the following:

1. Add the address to your contacts list in Gmail.

2. Check spam folder for replies, and mark it as "not spam" if something ends up there, which should influence the fate of future replies received. I can also approve an address at the domain level, i.e. if it is a big vendor or similar. I've had to do this with several of our Chinese vendors. I regularly ask engineering and purchasing to give me a list of the supplies we deal with, so I can approve them as a preventative measure.

For what it's worth, all of the false positive instances of reply -> spam we have experienced have involved the sender's email server having a problem. In the most recent case, it appears that the sender IP address appears on at least two internet blacklists. Since that is beyond my control, but we are trying to do business with these people, I can only add the domain to the approved senders list so that future replies from them should bypass the checks. However, if another company with a problematic email server replies to one of us, their message could very well still end up being marked spam.

Since Google can't help us, I am trying to figure out some kind of human process to defend against this, but to getting to a 0% false positive rate looks kind of ugly.  One idea I had is to make a script that is invoked when a user sends a message, and somehow adds the recipient address  to their contacts and/or some sort of approved sender list. 

Has anyone done this?

Thursday, May 27, 2021

Windows 10: Get rid of Microsoft Teams Auto Startup (from a script)

Situation:

You have installed Microsoft Office on your computer.  Whenever you logon to the computer, you see a Microsoft Teams splash that asks you to login, which you have to close every time if you choose not to login.

Possible remedy:

You can go into task manager, click the "Startup" tab, click Microsoft Teams, right-click and disable.  However, this doesn't work permanently as it will come back if you update or reinstall Office.  Also, other users who login to the computer will still get the Microsoft Teams thingy loading automatically at startup.

"Real" fix:

Add this to a user logon script, such as your domain logon script*:

REM Delete Microsoft Teams Auto startup reg key 
reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "com.squirrel.Teams.Teams" /f

That second bit is all supposed to be on one line.

*if you don't have a domain logon script, you can just put this in a .bat file and stick into 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Now every time someone logs in, the Teams startup will be automatically removed, so that will be the last time they see it.

Monday, March 15, 2021

Scammers can bypass your Google Workspace Safety Checks

A major source of headache for system administrators these days, and has been for some time, is the uptick in phishing messages that fake the sender address so it appears to be from someone within your organization. If you are like me, this is one of the things that keeps you awake at night. Organizations using Google Workspace can take advantage of a safety feature that purports to prevent this from reaching users. You can access its settings from within the admin console under Apps->Gmail->Settings->Safety.




Unfortunately, there are still a ton of legit e-mail servers that don't authenticate, so that safety feature is not going to be very helpful.  However you can enable the checks that detect someone trying to send a message with an employee's e-mail address, your domain (or a variation on it) or even an employee's name.  These are very common attacks, and such checks regularly prevent nefarious messages from reaching our end users.  

The problem is, due to a poorly-planned filter architecture on Google's part, this whole mechanism can be bypassed, allowing a spoofed message to end up in a spam queue that is managed by an end-user.  

Google Workspace Filter Architecture places spam filters and queues ahead of "safety features" such as spoof checks.

As you can see in the diagram above, the spoof checks are effectively circumvented when they are sent to a group.  A moderator will see the message in the group's spam queue, AKA "Pending messages".  If they approve the message, it will then go through the safety checks, but by then the group manager has already seen it, and may act on it.