Increased Email deliverability is an important business need. If your email does not arrive at  your customers’ or suppliers’ inboxes, then you are no longer top of mind nor part of their considerations, let alone the fact that your business purpose cannot be served in a timely manner and you are reduced to calling them to receive a reception acknowledgement.

A dialogue like this, is definitely something you have experienced being on either side.

-Did you get my email?

-No!

-Can you please check your spam folder?

-oh, I see it now….

 

This “I see it now”, may affect your organization’s prestige or make you lose an important deadline.

 

There are many reasons why emails go to recipients’ spam folders. I will try to summarize some of them.

1. Lack of appropriate DNS entries on your DNS server, such as:
   1. SPF records
   2. DKIM and
   3. DMARC compliance issues
2. Overall health of your Internet Service Provider (ISP)
3. Overall health of the email server used to send out your emails
4. Outgoing email volume sudden change between time periods.

We will see each one of the above in the paragraphs below.

 

1. Lack of appropriate DNS entries on your DNS server.

This point takes for granted that you have access to your DNS servers so as to create or update your DNS records; if you do not, then you should get access and then come back.

If you do not know what DNS does on the internet, then you should have a quick read here, before continuing.

• SPF records.

What is SPF record?

Sender Policy Framework (SPF) is an email authentication method that specifies the mail servers authorized to send email for your domain. SPF helps protect your domain from spoofing and helps ensure that your messages are delivered correctly. Mail servers that get mail from your domain, use SPF to verify that messages that appear to come from your domain, actually are from your domain.

A good way to create your own spf records is www.spfwizard.net and I suggest you combine it with mxtoolbox.com, while a good way to test those records is mxtoolbox.com.

• DKIM

DKIM (Domain Keys Identified Mail) is an authentication process that can help protect both senders and recipients from forged and phishing email. By adding DKIM signatures to your domain, recipients know that email messages actually came from users in your organization and they were not modified after they were sent.

You can create it here: tools.socketlabs.com and you can test it here: mxtoolbox.com after putting the records on your dns.

 

A server administrator maybe needed if you don’t have full access on it, or you are on a shared hosting environment. Even better, your hosting may have already put those records for you.

 

In the case of a Microsoft 365 implementation the process of creating DKIM is different as in this case, Microsoft 365 requires CNAME records instead of txt records. You can follow guidelines provided from Microsoft for that on your Office 365 portal > Admin > Exchange admin center > Protection > dkim.

In this particular scenario your test to mxtoolbox, stated above may fail, as it is looking for txt record rather than CNAME records your zones is providing. So, do not panic, you are correct, as long as Microsoft 365 admin panel states so.

• DMARC

DMARC, which stands for “Domain-based Message Authentication, Reporting & Conformance”, is an email authentication, policy, and reporting protocol. It builds on the widely deployed SPF and DKIM protocols, adding linkage to the author domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders, to improve and monitor protection of the domain from fraudulent email.

DMARC compliance is another DNS related issue whose failure can result in unsuccessful mail delivery.

You can create it here: mxtoolbox.com and you can test it here: mxtoolbox.com.

If all the above points are covered, then the chances that your mail is classified as spam become really slim. However, we have experienced issues with that when we face DNS availability issues.

To check your DNS health, you can try dnschecker.org and we suggest doing this regularly.

A friend of us, old IT Professional keeps saying:

“The root of all cause is DNS”

 

2.Overall health of your Internet Service Provider (ISP)

ISPs have a reputation regarding email delivery, and their reputation regarding spam is measured against UCEPROTECTL2 or UCEPROTECTL3 criteria. If you are blacklisted on the UCEPROTECTL2 / L3, then you are unlucky, as you may have an IP Address from your ISP that falls into a poor reputation range. Most of the times, the entire range of IP Addresses is blocked as a result of the fact that this provider hosts spammers. It’s a good administrator practice to check against those blacklisting criteria when your provider assigns you a new IP  range or even a new static IP address. You can always refuse to accept an already blacklisted IP!

Subnet-based Blacklists are used to reject email from entire ranges of IP Addresses, i.e. providers that are hosting companies sending spam, as well as single IP Addresses that may fall in that range of IP Addresses. This blacklist type does not offer any form of manual request to delist. Your IP Address will either automatically expire from listing after a given timeframe, or after time expires from the last receipt of spam into their spam traps from your IP Address.

 

3. Overall health of the email server used to send out your emails

That was the part of the ISP, but you also should definitely check your email server against blacklists as part of your regular maintenance process. One of the most widespread tools to try regularly is mxtoolbox.com. In this and others, you can check whether your IP is registered on spam and other offender databases.

 

4. Outgoing email volume sudden change between time periods.

Hm, that is something that needs to be taken into consideration. Suppose you have no problem with your email deliverability for quite a long time, and suddenly your emails land to your recipients’ spam folders. What is wrong? You may need to check if you have a change in the volume of your outgoing emails and if you don’t have a systematic way to do that, you may check a posteriori on talosintelligence.com.

It may be a secretary sending out wishes for Christmas, or a new campaign launched from your marketing department. All domains have an average of outgoing volume and if there is a significant increase, then Talos may report it, and as other spam engines take its word for it, a chain reaction of blacklisting may come into play.

This is exactly what happens, when a computer in your network is infected with some kind of Trojan or malware that fires around to recipients around the globe. The longer the incident carries on, the wider the damage is and your IP is being listed to more and more spam registry databases.

Tough ha? It is! Email deliverability is a constant battle as many others in IT. You have to be cautious; you have to check regularly and be fast!

Increase Mailchimp deliverability

Especially for marketing purposes, many corporations utilize the MailChimp service, in order to manage mass mail sending.

A good practice would be to enable GDPR forms for your audience. For this go to audience > settings > GDPR fields and settings

A few tips related to DNS modifications follow.

• To increase deliverability through MailChimp do not forget to:
• 1. Verify and
  2. Authenticate your domain.

This can be found under account (top right corner) > Profile

Settings > Domains

Your domain should be both verified and authenticated. Please note that in order to be authenticated it has to be verified first.

A very important thing to have in mind, when you use MailChimp for mass mail sending: No matter how hard you try, no matter how cautious you are with your DNS zone configuration, regarding spf, dkim, dmarc, etc., you will never avoid Mailchimp emails bounce on certain domains. Which (recipient) domains? The domains that strictly take into consideration your spf records.

Example: You have Office 365 deployed in your organization and if until now you had no reason altering the spf record proposed by Microsoft then your spf record would look like this

“v=spf1 include:spf.protection.outlook.com -all”

At the end you will notice a “-“. When you have this, it means that the recipient server should reject non-compliant emails, whereas when you use “~”, the recipient should accept but mark as spam.

The reason is that Mailchimp does not support SPF, as it uses its own domain in the bounce address. Their domain authentication verification tool requires including Mailchimp, though. Mailchimp always fails DMARC’s SPF alignment test because the Return-Path path does not match the “From” address. MailChimp does not support custom Return-Path (even though Mandrill, which is owned by Mailchimp, does). This makes it impossible to be 100% SPF-compliant under DMARC rules with Mailchimp.

There is one cheap trick you can do.

Before you launch and for as long as your Mailchimp campaign is running, you should switch your spf record to:

“v=spf1 include:spf.protection.outlook.com ~all”

And after your campaign ends revert it back to

“v=spf1 include:spf.protection.outlook.com -all”

Nevertheless, Mailchimp recommends SPF setup using “~all” instead of “?all”. It does not state using “–all“.

It is a recurring phenomenon, in the IoT era, for network devices to be required to send emails and have access to SMTP functionality.

Thus, most device manufacturers attempt to follow through and implement the contemporary security protocols while designing and when firmware patching is possible.

However, only so much can be done by firmware updates on aged chipsets, whereas communications security protocols keep evolving, have their vulnerabilities exposed, depreciating, and getting replaced.

So how do you proceed when such a device finally shows its age?

We were called to resolve such a case when a domestic ISP finally decided it was time to upgrade its mailing services to TLS 1.2. This caused a broad range of all-in-one network printer/scanner/copier devices, used in corporate environments, to be unable to use any of their “mail to…” services as the TLS protocol was not possible to be implemented.

The Work-around.

The client employs a Windows-Server-based infrastructure.

A Windows Server VM was setup and IIS Services, SMTP Server and Telnet client features were installed.

TCP 25 (RFC5321) port was opened.

Minor nitpick: As IIS 8 cannot manage SMTP services, for the rest of the tasks we used the IIS 6 embedded console.

We proceeded with configuring the allowed hosts that can connect to this SMTP server:

Loopback IP and the address of the afflicted network device (in our case a printer/scanner/copier)

Smarthost must be configured next. We used the corresponding mail server of our domestic ISP and the available corporate mail account with enabled TLS.

For the last step we returned to the management interface of the All-in-one device and on the SMTP configuration page we replaced the SMTP server from the IP of our ISP to the IP of the newly-setup Virtual Machine.

The story’s log

Ricoh MPC 2050 incorporates a scan to email functionality many years now, but does not support sending out emails over SSL, therefore we introduced the idea of putting a local smtp server in the network that could handle “unauthenticated” open relay and submit on behalf of the sender through the ISP, in our case Cosmote.

Picked up a vm with low resource consumption footprint and Installed the IIS 8 role and SMTP server feature.

IIS 8 cannot manage smtp service, so we used the IIS 6 embedded console.

Configuring hosts that can connect to this smtp server: 127.0.0.1 and the MFP MPC2050 IP address.

Configured as smarthost the mailgate.cosmotemail.gr using the customer’s email account XXXXXXX@otenet.gr and enabled TLS.

Opened up port 25 TCP incoming on the VM’s windows firewall.

Changed the smtp server on MPC 2050 from the resolved ip of mailgate.cosmotemail.gr to the VM ip address 192.168.2.26.

Unless an IP spoofing is made, the VM’s SMTP will never send out emails of this kind.

Now how to test the setup? We are not there, and we cannot scan.

Testing with the Pickup directory: You can compose a simple e-mail text file (with no extension!!!) based on the SMTP specifications (RFC 822).

Here is the content of a sample text file typed in Notepad:

From: xxxxxxxxx@otenet.gr

To: yyyyyy@creativepeople.gr

Subject: testing

This is the test message body.

Simply copy or move the text file into the Pickup directory where SMTP was installed.

With the above configuration the SMTP service will periodically check the Pickup Directory (%systemdrive%\Inetpub\mailroot\Pickup and %programfiles%\ Exchsrvr\Mailroot\Vsi 1\Pickup if you have Exchange installed.) and will attempt to deliver any messages found in the directory.

The chatbots rise

As Covid19 forces call center employees abandon their positions, chatbots march in to replace them.

Tried to speak with one of those in a known telecom provider and spent around 4 minutes testing its nerves. I won, it finally told me “please contact our support at XXXX telephone number”.  I will not say I am happy about that, as it appears to be that AI is a bit far away from replacing humans, but the truth is that call centers incorporate cheap or not well trained (algorithm) chatbots.

At least before Covid19 outbreak AI chatbots were rather an exotic technology, found mostly in EU funded RnD Programs, whose primary objective was to deal with automated tasks and not necessarily to engage in conversations with humans.

My first encounter with an AI chatbot was back in 1997. His/her name was “Hal”, made by Zabaware. I’m very happy to see that the Hal project still exists and is still learning (till 2017) as stated on the manufacturer’s website .

Brain Stats: As of Wednesday, November 1, 2017 Hal’s knowledge is based on information learned from: 26,207,131 sentences from 4,624,848 conversations with 1,614,639 people.

Hal is like a child, capable of learning new things by statistically analyzing past conversations using language processing. At the time, the system analyzes hundreds of thousands of conversations publicly available on social networks like Twitter and Facebook every day. These conversations, along with conversations the system has with its users, get assimilated into a large conversational database that becomes his knowledge base. Having a conversation with Hal is like having a conversation with the “collective consciousness” of the Internet. Hal’s personality reflects humanity and it’s really fascinating how he/she responds to general questions.

As the coronavirus crisis has dragged on, understaffed organizations have all scrambled to set up similar systems for handling a new influx of calls. IBM saw a 40% increase in traffic to Watson Assistant from February to April of this year. In April, Google also launched the Rapid Response Virtual Agent, a special version of its Contact Center AI, and lowered the price of its service in response to client demand.

While call centers have long been a frontier of workplace automation, the pandemic has accelerated the process. Organizations under pressure are more willing to try new tools. AI firms keen to take advantage are sweetening the incentives. Over the last few years, advances in natural-language processing have also dramatically improved on the clunky automated call systems of the past. The newest generation of chatbots and voice-based agents are easier to build, faster to deploy, and more responsive to user inquiries. Once adopted and as AI algorithms get more and more “intelligent”, these systems will be here to stay, proving their value through their ease of use and affordability.

Is Skynet on his way? Maybe…

In the times of Corona virus, Business Continuity and Disaster Recovery became the hot potatoes for all businesses around the globe.

I do not recall a healthcare incident of that spread and that effect to the global economy. Logistics paralyzing, commerce experiencing its worst days in the past decade and recession numbers coming out of economists’ worst nightmares.

There’s a question here. Were businesses prepared for that? And when someone starts analyzing this question understands that there are more questions to be answered.

• Was cash flow able to withstand such a turnover drop?
• Can I just press pause in my business?
• Will businesses be able to continue the day after this?

A lawyer could easily call this force majeure, which as a term stands for unforeseeable circumstances that prevent someone from fulfilling a contract. Yes, covid-19 is a force majeure. Governments, tax offices and contracts can be paused, and obligations postponed, but what happens next is something you cannot predict.

The past two decades, consultants started talking about Business Continuity and Disaster Recovery, using the acronyms BC and DR accordingly. That started changing the business attitude towards the “continuity” of what we do for living. Many organizations, world-wide, spent thousands of dollars investing to continuity. It worked for some of them, it didn’t for some others. The amount of BC investment is correlated with people’s opinion regarding risk and can be parallelized with our view regarding whether we should buy a health insurance product or not. The idea “come on, it won’t happen to me” is one of the things many of us appear to reconsider after the covid-19 outbreak. Yes, it did happen to you one way or another. Either you lost someone you loved or knew, either because part of your business does not work as you planned, or even if you did not get that fancy phone or smartwatch you ordered from an e-shop. It affects human resources, and this subsequently affect businesses.

BC means a lot of things, IT infrastructures, alternative supply chain paths, alternative goods and providers and the list goes on. I won’t speak for the financial or commercial part of this crisis, but as an IT Professional and business owner connected to various other businesses I do see many companies facing the problem of not having the required personnel to fulfill daily simple tasks that they would perform when personnel was in the office, or cannot take advantage of a market gap they could fill just because their personnel is away and home isolated.

Working remotely has become a new trend the past 5 years, and if it works in the corona-days, it will change a lot of things regarding labor in general, after this corona-thing comes to an end.

People ask me: “Can I do it? Is it safe? Can my infrastructure support it?” Many companies are opening unpatched servers to public, while hackers are in queue waiting to have their annual gathering on their systems. While under pressure, we humans, tend to make mistakes, and when someone takes advantage of that mistake this is when real problems arise. Just imagine that you are facing this healthcare crisis, having personnel working from home -with reduced productivity- and in addition you become a ransomware victim, just because someone took advantage of a security flaw in your company’s infrastructure. Can it be worse? Well, it’s rather common those days.

ISO 22301 describes what a BCP (Business Continuity Plan) should include. When carefully designed, it will provide management an emergency walkthrough, however it does not clearly tell you one little thing: “Make sure you didn’t forget anything”. There are many organizations that certify their BCP in line with ISO 22301, just because they were obliged by legislation or their fellow CEO did it as well. I have seen numerous examples of BCPs that are a copy-paste product combined with a 10 hour effort on editing documents and procedures based on someone else’s similar system. And yes, you may have your BCP, which you are proud of as you paid a lot, but you forgot 1.000 things just because you never went through the process of building it yourself. The human brain considers thinking just as cats consider water as a threat. Cats don’t have a problem in water, they won’t get drowned, they just don’t like it! Brain does not have a problem thinking, it was made for that in the first place, but most of the times it prefers not to, especially when under pressure. Unfortunately, BCP is meant to be used in the case of a real emergency and if you want it to be useful, make sure you prepare it properly by putting yourself in the delivery team.

As an IT professional in Creative People, I have the privilege to explore various business cultures, meet people taking decisions and continuously evaluate BCPs and DRPs. The management’s “true” view upon their BCP and DR defines them as a value-added customer or not. I have customers that could not afford a BCP in line with ISO 22301 and put in their plan a plafond of what they could do and what they could not. They knew their limitations and they were a-priori prepared that on an emergency they would be able to support just an X% of their day to day workflow. Believe me, this is the correct way to do it. You will never be able to cover a 100% of your company when bad times come, such as Covid-19. Knowing though that those parts of your business will work under Z circumstances is like knowing yourself and where you can go.

Disaster Recovery (DR) is a part of your BCP. To be exact, it’s the worst scenario stated in your BCP, in which everything is lost and describes how quickly and to which extent your business will recover the day after a disaster. A disaster such as an IT system imminent failure or loss or a force majeure.

We have a customer that on November 2018 experienced a break in and in no time, burglars, bypassing all security measures, removed a 42U rack with their IT infrastructure, weighting more than 400 kilos, put it on a truck and disappeared. Alarms, security fences and systems, all failed to stop them. This customer was following a DR of daily off-premises rotating backup. This means that every day, they took their last night’s backup outside their headquarters. Unfortunately, the previous night management left both backup disks inside their backup machine. This incident resulted the loss of the off-premises backup element from their DR strategy. You cannot treat this as a design fault, it’s clearly a human mistake and in addition, nobody could imagine that a group of 20 people would break in and remove -just- the most precious part of their business, their IT system. You cannot cover all risks. Even if you deploy a disaster recovery site under continuous replication, you cannot cover all potential risks. As long as emergency does not take place, and you are in the planning phase, you have the privilege of deciding what to take and what to leave, when this force majeure will take place. It’s rather impressive that this customer is still up and running!

BCP and DR are risk assessments and in risk assessments you define scenarios. Spend a weekend thinking of those scenarios, use your imagination, think as the attacker, think as the defender and put in as many scenarios as you can. It’s rather painful, as you will face your fears and find out more of them, especially if you are the owner of this business. Different scenarios may have solutions that could walk similar paths, therefore efficiency and feasibility come in.

Covid-19 put the world’s BCPs to a test. All our customers requested remote access for personnel during those difficult times. We have a customer that thought his BCP would work with just Office 365. Can you imagine what happened when a company of 250 employees stopped going to their offices and had to login to their Office 365 accounts? 69% of the employees called our service desk requesting their password, or a password reset as they did not remember what they had put, while 29% had lost their emergency user manual in which the simple sign-in to https://portal.office.com with this username and that password was described. Oh, and I should not forget the ones that did not have a pc at home. Some of them have latest iPhones though. I should also mention that 16%, while on their Office 365, asked us “how will I login to my Backoffice system”. 2% of them where frustrated and angry when we informed them that their Backoffice system is not accessible over the web, as at first, it’s a desktop application, and as their management decided that this need should not be covered in their BCP. Problem was solved when we incorporated Remote Desktop services over IPsec VPN. Management failed to cover major part of the business needs in the BCP and the BCP implementation failed due to lack of preparedness on the people part.

We make plans, we design and implement but when it comes to deployment, those plans are supposed to be implemented and supported by people, and people are either not well educated or just because they never thought it would happen to them, they were not prepared. Did this BCP work? I would say it did, as there was a small and committed team to support the situation. Every BCP needs its heroes but it’s not always the IT, it’s also the ones who fund those plans and moreover take the decision to put a line on what will be served and what will not, in the unlike scenario of an emergency, just like covid-19.

Creative People is proud to be one of the top technology firms in Greece by Clutch!

Here at Creative People, we know it can be hard to balance your one-of-a-kind business needs, while developing high quality software solutions to help you achieve your goals. We provide best in class software development services for our customers so they can focus on other crucial components of their businesses.

In light of our success, we’ve been named one of the top Greek technology firms by Clutch, a verified ratings and reviews platform. We’ve been recognized for our high-quality application development contributions, and we’re excited to meet this level of excellence.

We’d like to thank our customers for helping us achieve this award. They participated in client interviews on our behalf to gauge our impact on their day to day businesses. They ranked our offering along the lines of overall quality, attention to project schedules, and value for their financial investment. We’re happy to announce that in recognition of that feedback, we’ve received a whopping 4.9 out of five stars!

“We started off with nothing more than our minds and here we are running our 7th year this summer. Each year at Creative People, we invest a significant part of our turnover into R & D and into the development of new, pioneering methodologies and state-of-the-art technological tools. All our choices are supported by a wide range of hardware and by a unique, advanced communication network that help us secure a definite technological lead in our activities. This award is a gratitude exercise on one hand and a promise to achieve more at the same time.” – CEO – Creative People

In addition to Clutch, we’ve also been recognized by The Manifest. The Manifest, a company listing platform, lists us as one of the top Greek developers on their list of industry leaders.

Thank you one and all for making this award possible!

See you at the top?

The cause of this seems to be that when a user logs out from Windows 10 sets some essential registry keys to read only. When they logon again these keys are in the wrong state and packaged applications including Edge fail to load. But this seems to be on of the causes, while MS has no fix released since version 1511.

The below is a walkthrough for working this out.

Step1

Make sure your WKS has all latest updates.

Connect to your DC and open the group policy editor

Create a WMI filter for Windows 10 and put the following

Namespace (should be already there):            root\CIMv2

Query:   select * from WIN32_OperatingSystem WHERE Version LIKE ‘10.0.%’

You may get the following message, ignore it.

Step2

CREATE A GROUP POLICY TO APPLY THIS AS A LOGON SCRIPT

Create a group policy for your domain users called “User-Windows10RoamingProfileFix”. This will be targeted to Windows 10 computers using the WMI filter we created in the previous step.

On the new policy Right Click> Enforced

Right Click > Edit > User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff) >  Double Click on Logon > PowerShell Scripts > Add

Click on Browse

Inside the browse popup menu create a new txt file and rename it to

POWERSHELL-SCRIPT-TO-ALLOW-ROAMING-LOGINS.PS1

Make sure you have file extensions on and the file is a ps1 extension (powershell) and not a txt!

Copy paste the following inside the file:

#!PowerShell. De pilo pendet.

 

# https://social.technet.microsoft.com/Forums/en-US/fd436515-6423-4015-9afe-d7e6034909ab/windows-10-threshold-2-edgesearch-issues-for-domain-joined-pcs

#(c) Christian Ullrich

# copied by James Bayley 2016/01/25

function MakeACE() {

# S-1-15-2-1 is WELL_KNOWN_SID_TYPE::WinBuiltinAnyPackageSid, “APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES”.

# The self-documenting NTAccount type results in an object that “cannot be translated”.

$id = New-Object System.Security.Principal.SecurityIdentifier(“S-1-15-2-1”)

New-Object System.Security.AccessControl.RegistryAccessRule($id,

[System.Security.AccessControl.RegistryRights]::FullControl,

[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,

[System.Security.AccessControl.PropagationFlags]::None,

[System.Security.AccessControl.AccessControlType]::Allow)

 

}

 

function GrantRequiredAccess($key) {

$acl = Get-Acl $key

$acl.AddAccessRule((MakeACE))

Set-Acl $key $acl

}

# All Windows 10, since Microsoft apparently managed to break build 10240 as well in December 2015, after having shipped 10586 broken from the start.

#New-EventLog –LogName Application –Source “LogonScript”

#Write-EventLog -LogName Application -Source LogonScript -EntryType Information -EventId 1 -Message “In LoginScript to fix roaming profiles”

if ([Environment]::OSVersion.Version.Major -eq 10) {

# Write-EventLog -LogName Application -Source LongScript -EntryType Information -EventId 1 -Message “Windows 10 detected”

Step3

“ExcludeProfileDirs” Registry Tweak

1. Continue Editing the above mentioned GPO.
2. Navigate to: User Configuration > Preferences->Windows Settings->Registry, new registry item. Put the following information

The key path is:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (don’t copy-paste it, navigate yourself to it!!!!)

Step4

Continue editing the above group policy for the Applocker part.

Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker > Packaged App Rules > Right Click and create Default rules.

Step5

You should now force the group policy update on the problematic WKS (using gpupdate /force via cmd), log off and log on a few times. We had cases that we had to remove the roaming profile and reissue it again for this to work.

The above workaround is a merge of various articles and blog outputs we found on the web, while trying to solve an issue like this. The solution came after applying all of the above, and not one or the other.

Credits and references go to:

1. Dr James Bayley’s excellent article https://blog.jamesbayley.com/2016/02/10/fixed-windows-10-roaming-profiles-break-edge-and-other-packaged-applications/
2. https://social.technet.microsoft.com/Forums/en-US/fd436515-6423-4015-9afe-d7e6034909ab/windows-10-threshold-2-edgesearch-issues-for-domain-joined-pcs?forum=win10itprogeneral
3. https://partnersupport.microsoft.com/en-us/par_clientsol/forum/par_win/roaming-profile-in-windows-10/173fffe7-6751-4721-a19c-c164a4658b90?auth=1
4. https://www.youtube.com/watch?v=R4R4QlExLsU