Today we have a guest post from one of our excellent Premier Field Engineers from the United States – Susan Van Eyck.

In this post Susan explains the pitfalls of comparing different data types in a where clause and how it can hurt performance.

This post is about implicit conversions, or more accurately, it’s about which ones are hurting your query performance.

For SQL Server to compare two values (e.g., a column and literal value as in WHERE b.Status = N'A') both values need to be of the same data type.  If they differ, the one having the lower data type precedence will be (implicitly) converted to match that of the other value.  Practically speaking, the rules of data type precedence are about not losing information.

Imagine a comparison between an Integer and Decimal value .  If the Decimal was converted to an Integer, data could be lost (123.45 >> 123).   The same holds true when comparing an NVARCHAR (Unicode data types can store 64,000 different characters) and VARCHAR (only 256 distinct characters) strings as in the code snippet above.  There are many NVARCHAR values that simply can’t be represented as VARCHAR values, so the implicit conversion must go from VARCHAR to NVARCHAR.

Where we get into trouble is when the leading key value in one of our carefully crafted indexes gets implicitly converted to another data type.  Again referring to the code snippet above, let’s say that b.Status is a CHAR(1) column and that we’ve created an index to support the query (CREATE INDEX ix_Status ON dbo.SomeTable (Status);).  The value we're searching for is an NVARCHAR (as indicated by its "N" prefix) which has a higher data precedence than CHAR so the values in Status must be converted to NVARCHAR before SQL Server can compare them with N'A'.  The net result of this is that we can no longer use our lovely index.

Let's compare the execution plans for this pair of queries where [Status] is a CHAR(1) and is indexed:

SELECT COUNT(*) FROM dbo.SomeTable WHERE [Status] = 'A';

SELECT COUNT(*) FROM dbo.SomeTable WHERE [Status] = N'A';

The plan for the first query uses the index (Index Seek) and is about 5X less costly to execute than the second query.  This is because the second query requires that [Status] be converted to an NVARCHAR which means we can't use our index so have to scan the table instead.  The good news is that SQL Server tells us something is wrong.  Note the warning symbol on the SELECT operator in the second plan.  Looking at the operator's properties you'll see a warning that there was an implicit conversion which may impact our ability to perform an Index Seek

But – not all implicit conversions interfere with Index Seeks, and I wanted to know which ones were problematic and which ones weren’t so I went through an exercise to find out, the final result set of which looks something like this:

The row headers represent our indexed columns' data types and the column headers represent the various data types we might try comparing them against.  The outcomes are color coded – Green (and NULL) where SQL can perform and index seek, Yellow where we fall back to Scans (Nonclustered Index Scans if we’re lucky, Clustered Index/Table Scans if we're not) and Red for illegal comparisons where an implicit conversion can’t be made.

Note that some “legal” conversions may also fail.  For example, we can convert “10” to an integer, but not “XYZ”!

Happy Exploring!

本記事は、Microsoft Secure ブログ “How to disrupt attacks caused by social engineering” (2018 年 1 月 10 日 米国時間公開) を翻訳したものです。

執筆者: Milad Aslaner (Senior Program Manager, Windows & Devices Group)

10 年前のサイバー攻撃は、企業のインフラストラクチャーを直接攻撃することを目的として、マルウェアまたは複合的な手法をきっかけに開始されるものがほとんどでした。この状況は様変わりし、現在では、ID を盗み取るための洗練された 1 通のメールだけで十分です。

図 1: 複雑なインフラストラクチャーで抜け穴を探す試み

デジタル化は進んでおり、避けて通ることはできません。すべての業界にとって不可避であり、社会の自然な進化段階の一部です。デジタル トランスフォーメーションがいつ起こるのか、本当に起こるのかどうかではなく、どのように起こるのかが重要です。マイクロソフトのセキュリティに対するアプローチは、安全なデジタル トランスフォーメーションを実現することに焦点を当てています。お客様がサイバー犯罪に対する保護、検出および対応を実現できるよう支援することで、この目的を達成します。

ソーシャル エンジニアリングの手法自体は新しいものではなく、ブロードバンド接続がない時代から存在していました。当時、その脅威アクターはハッカーではなく、詐欺師と呼ばれていました。Abagnale & Associates 社のシニア コンサルタントである Frank Abagnale 氏は、かつてこのようなことを言っています。「昔の詐欺師は見た目が良く、温厚で、身なりに気を使い、話し方も上品でアピールの仕方をよくわかっている人でした。現在では、そのようなことが必要なくなりました。なぜなら、これらの犯罪を実行している人たちは、遠く離れた土地にいるからです。」

STRONTIUM などの脅威アクター グループは、現代版の詐欺師の集団です。従来の詐欺師と同じアプローチを取りますが、活動する場所はデジタルな世界です。重要なインフラストラクチャーに直接アクセスするための新しい抜け穴や脆弱性を見つけるよりも、高機能なフィッシング詐欺メールを送る方が簡単なため、このアプローチを選ぶのです。

図 2: STRONTIUM のフィッシング詐欺メールの例

米国会計検査院のチーフ テクノロジスト、Keith A. Rhodes 氏は「ネットワークに侵入するための技術的な方法は必ず存在しますが、会社の従業員を利用して入った方が簡単な場合があります。彼ら自身のセキュリティを引き渡すよう騙すのです」と話しています。

Verizon 社が 公開した 2016 年の「データ漏洩/侵害調査報告書」によると、フィッシング詐欺メールのうち 30% が開封されています。受信者は平均してたったの 40 秒でメールを開封し、その後、悪意のある添付ファイルを開くまでに 45 秒しかかかっていません。すべてのフィッシング詐欺メールのうち 89% は組織的な犯罪シンジケート、9% は国家支援を受けた脅威アクターによって送信されています。

図 3: Verizon 社の「2016 年データ漏洩/侵害調査報告書」

一番の弱点が人であることに変わりはありません。ユーザーが責められるべきだと主張する人もいますが、標的型のフィッシング詐欺メールの多くは大変洗練されており、平均的なユーザーが悪意のあるメールと正規のメールを見分けるのは不可能であるのが現実です。

図 4: 初見では正規のメールに見えるフィッシング詐欺メールの例

フィッシング詐欺メールは数分もあれば作成することができます。まず、脅威アクターはソーシャル ネットワークや専門家のネットワークを這いまわり、攻撃対象の個人情報をできる限り探します。これには組織図、企業文書のサンプル、共通で使用しているメールの見出し、従業員バッチの写真などが含まれます。公開データベースや漏えいされたデータベースから、これらの情報を引き出すプロフェッショナル ツールもあります。実際、必要があれば脅威アクターはダーク ウェブで情報を買うこともできます。例えば、侵害された 100 万個のメールとパスワードは約 25 ドル、銀行アカウントのログインはアカウント当たり 1 ドル、社会保障番号は生年月日の照合も含めて約 3 ドルで取り引きされています。次に、脅威アクターはパスワード リセットの通知など受信者が見慣れているメールのテンプレートを用意します。最後に、そのメールをユーザーへ送信します。

ソーシャル エンジニアリングは多くの脅威アクターにとって強力な手段であり、目的によってコンピューターベース、モバイルベース、またはヒューマンベースのソーシャル エンジニアリングを使い分けます。

図 5: フィッシング攻撃のステージ

• フェーズ 1: 脅威アクターは、フィッシング キャンペーンを介して標的とする従業員を決める
• フェーズ 2: 従業員が受信したフィッシング詐欺メールを開封する。これによって、脅威アクターは悪意のあるペイロードを読み込んだり、ユーザー ID を侵害することが可能になる
• フェーズ 3: ワークステーションが侵害され、脅威アクターはマルウェアを存続させて資格情報を収集する
• フェーズ 4: 脅威アクターは盗み取った資格情報で侵入を拡大して未承認のアクセスを取得し、重要なインフラストラクチャーの構成要素を侵害する
• フェーズ 5: 脅威アクターは、PII (個人情報) や他の機密性の高いビジネス データを抜き取る

組織は Enterprise Mobility + Security、Windows 10、Office 365、および Microsoft Azure に組み込まれた機能で、これらの攻撃を止めることができます。以下は、各フェーズに対応している機能が一目でわかるよう図式化したものです。

今日、脅威アクターがサイバー攻撃を仕掛ける入口のハードルは大変低く、それ故にサイバーセキュリティは CEO が取り扱うべき問題です。組織は「ファイアウォールとウイルス対策、ディスク暗号化の技術を採用しているので安全である」という考えから離れ、「サイバー攻撃は起こりうる。壁を作ることだけに焦点を当てるのではなく、迅速に侵害を検出し対応できるようにするべきだ」というマインドセットに移行する必要があります。侵害を想定することが要です。組織の規模や業界に関係なく、すべての企業には脅威アクターや、場合によっては国民国家にとって価値のあるデータが存在するのです。

今日の世界では、情報セキュリティへの一貫した取り組みが必須です。適切なインシデント対応プロセスの整備、サイバー攻撃に対する保護、検出と対応を可能にするテクノロジの活用、そして IT とエンドユーザーの準備が完了していることが重要です。

マイクロソフトのセキュリティ製品やソリューション、またお客様のセキュリティ戦略に役立つリソースの詳細については、https://www.microsoft.com/secure を参照してください。

Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Microsoft Office Professional Plus 2016 and Office 365 ProPlus 2016 apps. Please evaluate this proposed baseline and send us your feedback via blog comments below.

Download the content here: Office-2016-baseline-DRAFT

The downloadable attachment to this blog post includes importable GPOs, scripts for applying the GPOs to local policy, a custom administrative template (ADMX) file for Group Policy settings, all the recommended settings in spreadsheet form and as Policy Analyzer rules. The recommended settings correspond with the Office 2016 administrative templates version 4639 released on December 15, 2017 that can be downloaded here.

Instead of retaining the entire Office 2013 baseline and simply adding settings that were newly introduced in the Office 2016 GPOs, we have conducted a thorough review of all available configuration settings – as we did beginning with the Windows 10 baselines – including in the baseline only those settings that address contemporary security threats. In the process we removed over eight dozen settings that had been in previous baselines but that were determined not to advance security posture in a meaningful way, and added a handful of new settings. The result is a more streamlined, purposeful baseline that is easier to configure, deploy, and validate.

Macro security

Office’s support for macros remains a vital tool for enterprise automation and at the same time a vector for attack, so macro security remains an important consideration. Office 2016 introduced a new GPO setting, “Block macros from running in Office files from the Internet” that was also later backported to Office 2013. Enabling the setting disables macros embedded in Office documents that came from the internet, including through email from an external sender. Office displays a notification that does not give the user an option to enable the macros. This baseline enables the setting for all apps that offer it: Excel, PowerPoint, Visio, and Word. Because this setting affects only Office documents received from the Internet that contain embedded macros, we anticipate that enabling this setting should rarely if ever cause operational problems for enterprises. The settings do not affect documents that are received from the enterprise’s Intranet or Trusted Sites zones.

The baseline also retains the “VBA Macro Notification Settings” options from our previous baselines that require that macros embedded in Office documents be signed by a trusted publisher. We recognize that some organizations have had workflows and processes relying on such macros for a long time, and that enforcing these particular settings can cause operational issues. It can also be challenging to identify all the documents and VBA projects that need to be signed. We are considering moving these settings into a separate GPO to make it easier to switch the settings on or off without affecting the rest of the baseline. Please let us know via the comments on this post what you think of that idea.

Blocking Flash activation

We have also added a setting to the custom “MS Security Guide” ADMX that prevents the Adobe Flash ActiveX control from being loaded by Office applications. Vulnerabilities in Adobe Flash are often exploited by sending the victim a Microsoft Office document that contains malformed Flash data and an OLE reference that activates Flash and passes it the malformed data, which triggers the exploit code. This setting allows you to either (1) block all activation of Flash from within Office or (2) only block activation of Flash when it is directly embedded or linked in an Office document. The baseline recommends that you block all activation as it is the safest option available but note that it can impact productivity scenarios (e.g. consuming embedded videos in PowerPoint) within your enterprise. Please test this setting within your environment to identify the appropriate level of protection that balances your security and productivity requirements.

Office has long included a “kill-bit” feature similar to Windows’ that enables administrators to block specific controls from being activated within Office processes. Enabling the new setting in “MS Security Guide” configures Flash kill-bit registry values to block Flash activation in Office processes, reducing your security exposure.

Other changes

Although we have removed many settings from the baseline, there are a few changes to which we would like to call attention. All of these are under User ConfigurationAdministrative Templates.

• Microsoft Outlook 2016Account SettingsExchange, Authentication with Exchange Server: we are keeping this setting enabled, but changing its configuration from “Kerberos/NTLM Password Authentication” to “Kerberos Password Authentication.” We do not anticipate operational issues from strengthening this setting. Please test this change in your environments and let us know what you observe.
• Microsoft Office 2016Manage Restricted Permissions, Always require users to connect to verify permission: we are removing this setting from the baseline, but there is a security and usability tradeoff, and our finding is that the security benefit is too small for the usability degradation. The setting ensures that if someone’s access to a rights-managed document or email is revoked after they have received it, they will be blocked from opening it the next time they try. The downside is that this blocks all offline access. In our experience, this kind of revocation is far less common than the need to open rights-managed items when in airplane mode.
• We have dropped the “Disable all trusted locations” Trust Center settings, but disabled two additional “Allow Trusted Locations on the network” settings that had been overlooked in past baselines for Project and Visio.

We look forward to your feedback on this beta so that the final version strikes the correct balance between security and usability. Thank you.

Basierend auf der GDPR / DSGVO Demopalooza hier das Demo zum Reporting von bestimmten Office/Azure Diensten.

Wie immer aufgeteilt in zwei Bereiche: Das "Why" und das "How"

Why

Einer der Hauptaspekte der DSGVO dreht sich um den eigentlichen Schutz der PII (Personally identifiable information). Um diesen Schutz gewährleisten zu können ist es unumgänglich, dass eine Unternehmung genau weiß was auf den technischen Systemen passiert. Dazu gehört , dass durch regelmäßige Überprüfungen sichergestellt ist, dass nur diejenigen über entsprechende Adminrechte verfügen, die diese Recht auch haben sollten. Das schließt mit ein, dass ein solches Reporting auch offenlegt, wenn ggf. ein erfolgreicher Angriff dazu genutzt worden ist sich (wie auch immer) Adminrechte zu übertragen.

Unsere Empfehlungen, welche Reportings regelmäßig zu überprüfen sind können u.a. aus dem Secure Score abgeleitet werden und die hier vorgestellten Reportings beziehen sich auch genau darauf. D.h., dass es noch weitere Reportings gibt, die im Gesamtkontext herangezogen werden müssen, diese werden in diesem Post aber nicht betrachtet.

How

Zu aller erst widmen wir uns der regelmäßigen Überprüfung der Rollen - und starten natürlich mit den global Admins:

1. Dazu gehen wir auf https://portal.office.com/AdminPortal/Home#/users
2. und wählen als "View" -> "Global Admins" aus:
   
3. Unsere Empfehlung ist nicht mehr als 5 Global Admins zu haben, so sollte die Überprüfung hier sehr schnell sein.
4. Neben den global Admins sollte es noch weitere geben. Diese müssen im folgenden über die Veränderung des Views überprüft werden. Damit dies erfolgreich ist, muss zu aller erst ein passendes Admin Konzept erstellt und umgesetzt worden sein. Dazu zählt auch, dass immer klar ist, wer (bzw. welche ID) welche Rolle innehaben sollte, so dass schnell ersichtlich ist, wenn eine ID der falschen Rolle zugewiesen ist:
   
5. Nachdem nun die Administratoren überprüft worden sind - und sicher hier natürlich nichts ungewöhnliches ereignet hat, sollten/müssen wir sicherstellen, dass wir keine ungewollten Rollenaktivitäten haben. Dies könnte ggf. auf side-moves von Angreifern hindeuten und sollte dann entsprechend im Auge behalten werden bzw. Gegenmaßnahmen ergriffen werden.
6. Dazu besuchen wir https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Audit
   
7. Die View kann/sollte ggf. weiter eingeschränkt werden, da die Liste gerne schnell groß wird und wenn dies nicht in kurzen Zyklen (=>mind. wöchentlich) regelmäßig überprüft wird, dann wird es möglicherweise zu umfangreich.
8. Auch sollten die "Risky Signins" kontinuierlich beobachtet werden, damit Dinge wie "impossible travel", "ungewöhnliche Logonorte", "brute force attacks" schnellstmöglich wahrgenommen werden.
9. Dazu muss der Report https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RiskySignIns aufgerufen werden:
   
10. Dieser Report kann auch einfach in einem CSV Format heruntergeladen werden, welches dann exemplarisch so aussieht:
    
11. Zusätzlich gibt es in der Advanced Identity Protection noch den Punkt "Vulnerabilities" - welcher ein Stück weit auch in Richtung Secure Score geht.
12. Diese Vulnerabilities sollten ebenfalls regelmäßig kontrolliert werden und es sollte dann auch einen Prozess geben, wie mit diesen umgegangen werden sollte, denn es gibt erkannte Vulnerabilities, die bewusst nicht abgestellt werden (z.B. "kein MFA für jeden").
    
    
13. Beim Klick auf eine gefundene Vulnerability werden noch weiterführende Informationen zu a) der Vulnerability und b) den betroffenen Nutzern dargestellt:
    
14. Neben diesen allgemeinen Themen, gibt es auch noch weitere, etwas speziellere Themen. Dazu zählt z.B. die "Nutzung" einer Mailbox durch andere als den eigentlichen Eigentümer. Dies ist grade im Kontext DSGVO relevant, da in Emails Architektur bedingt nun mal sehr viele PII enthalten sind.
15. Dazu wird https://outlook.office365.com/ecp/Reporting/NonOwnerAccessReport.aspx?rfr=admin_o365&exsvurl=1&mkt=en-US&Realm=ems666407.onmicrosoft.com&RpsCsrfState=83d6c52d-7f69-d045-f91b-b5e52ca810ed&wa=wsignin1.0 aufgerufen
    
16. Last but not least möchte ich hier auf das Reporting zu "safe attachments" bzw. "safe links" eingehen. "Safe Links" dienen dazu "after the facts" [sprich auch nach der Zustellung einer Mail/Dokument] Links zu disablen und somit etwaig gefährliche Links den Zahn zu ziehen. Dazu werden Links [sofern konfiguriert] umgewandelt und beim Aufruf redirected um bei Gefahr geblockt zu werden.
    Die Verwendung von Safe Links/Attachments kann entsprechend ausgewertet werden um hier vorrangig die Gefahr durch Phishing einzugrenzen, welches bei weitem die #1 der Angriffe auf User IDs darstellt.
17. Hierzu wird https://protection.office.com/?pivot=EventType#/reportv2?id=ATPV2Report aufgerufen, welcher dann folgendes Zutage bringt:
    Das Reporting sieht mittlerweile anders aus, da dieses aus dem Exchange Admin Bereich in den O365 Reporting->"Threat protection status" gewandert ist, allerdings habe ich nur Tenants ohne Safe Link Aktivität, denn hierzu wären echte User hilfreich, die ich nicht vorweisen kann! Hier trotzdem ein Blick auf das leere Reporting:
    

    Kleiner Hinweis am Rande: wer Safe Links einmal "positiv" testen möchte, der darf gerne http://www.spamlink.contoso.com/ verwenden!

Abschließend ist zu sagen, dass "Sicherheit" und damit auch "DSGVO Compliance" nicht 'mal eben so' passiert. Hier ist es essentiell wichtig, dass die Systeme (regelmäßig/permanent) im Auge behalten werden und entsprechende Reporting Mechanismen und SIEM genutzt werden. Da dies grade im Zuge der Cloud täglich schwieriger wird muss ein entsprechendes Security Operations Center (SOC) etabliert werden oder ggf. die damit verbundenen Tätigkeiten an vertrauenswürdige Partner abgegeben werden. (->Stw "Security as a Service")
Sprechen sie ihren Microsoft Vertreter oder den Microsoft Partner ihres Vertrauens gerne zu diesen Themen an, wir unterstützen gerne!

Diese Demoanleitung bietet einen Überblick zur Nutzung von O365/Azure Reportings im Kontext von DSGVO und stellt keine rechtlich bindende Aussage dar!

Recently I was involved in a troubleshooting case about the maximum number of logical processor used by a specific application, running on Windows Server 2008 R2, let me give you some data.

ENVIRONMENT:

• OS: Windows Server 2008 R2
• Server model: Cisco UCS Blade Server
• N° of physical socket: 2
• N° of core per socket: 18
• Hyper threading: Enabled
• Processor model: Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz, 2301 Mhz, 18 Core(s)
  
• Total number of logical processor: 72
  

PROBLEM DESCRIPTION:

The customer has recently migrated from an old Windows Server 2008 with 48 Logical Processor to a new Windows Server 2008 R2 with 72 logical processor.

(Why in 2018 some customers migrate their OS [Operating Systems] to 2008R2 instead of 2012R2 or better 2016? Unfortunately, the answer is easy, and in most of the cases is due to their applications requirements, like in this case)

The problem is related to the application installed on the server, because it makes high complex mathematical calculation with heavy use of the CPUs, but during this calculation the customer notice that only 36 (half of the total) of the logical processor was used, and as a result the customer notice that the old hardware with less logical processor (48 exactly) is more fast than the new hardware with 72 logical processor.

RESOLUTION

Windows Server 2008 R2 is a 64-bit operating system and it support more than 64 logical processors on a single computer.

Support for systems that have more than 64 logical processors is based on the processor group.

So, what is a processor group? Is a set of logical processors up to 64, that is treated as a group.

Processor groups are numbered starting from the "Group 0" and if you have a server with less than 64 logical processor you have only the "Group 0", let me show you with the Coreinfo utility:

1. This is the old server, each "*" is a logical processor, and in this case, we have 48 logical processor.
   

    

   
   

    

2. This is the new server with a total of 72 logical processor.
   

    

   
   

We always need to keep in mind that:
=====================================================================
By default, an application is constrained to a single group, which should provide ample processing capability for the typical application.

The operating system initially assigns each process to a single group in a round-robin manner across the groups in the system.

A process begins its execution assigned to one group. The first thread of a process initially runs in the group to which the process is assigned. Each newly created thread is assigned to the same group as the thread that created it.

Reference:
https://msdn.microsoft.com/en-us/library/windows/desktop/dd405503(v=vs.85).aspx
=====================================================================

So how can we solve this kind of problem?

1. Downgrade the processor type, to have a maximum of 64 Logical Processor.

    

2. Modify the application to be compliant with the "Processor Group" (this is my favorite solution)

    

3. Try to disable from the BIOS the Hyper threading functionality, and make a performance test with the application, just to be sure to have an improvement in performance.

    

If you want to rewrite the application, here you can find a reference for the functions for 2008R2:
https://msdn.microsoft.com/en-us/library/dd405527(VS.85).aspx

OTHER INFO

Another thing that you need to keep in mind is that to view all the logical processor from the performance counter you can't use the "Processor" Counter, because it only show the "Group 0"

Use the "Processor Information" performance counter to view all the Logical processor on the server with this syntax:

Also, keep in mind that on Windows Server 2008 R2 you can have a performance issue if you don't have installed the following KB:

========================================================

Performance issues when more than 64 logical processors are used in Windows Server 2008 R2
https://support.microsoft.com/en-us/help/2510206/performance-issues-when-more-than-64-logical-processors-are-used-in-wi

========================================================

Logbucheintrag 180129:

Ob früher alles besser war, sei mal dahingestellt. Aber sicher war früher alles anders. Da hießen zum Beispiel die favorisierten Berufsbilder: Lokomotivführer, Feuerwehrmann und Bauarbeiter. Später wollten alle Betriebswirtschaft studieren oder Informatik. Dann, nach der Jahrtausendwende hieß es: „Irgendwas mit Marketing“ oder „Irgendwas mit Medien“. Morgen dürfte die Antwort auf die klassische Oma-Frage, „Was willst du denn später einmal werden?“, lauten: Data Scientist oder Machine Learning Engineer oder Distributed Algorithms Developer.

Schon heute jedenfalls jagen die Head Hunters verzweifelt hinter den Hochqualifizierten her, die dabei helfen sollen, möglichst hohen Mehrwert aus Systemen der künstlichen Intelligenz zu schöpfen. Datenanalyse, Mustererkennung, Entscheidungsunterstützung, Sprachsteuerung, Robotics und Automation sind gegenwärtig die Schwerpunktbereiche, in denen Unternehmen KI-Software verwenden. Und auch wenn man sich nicht gleich ein komplettes Jobprofil unter den neuen Jobbezeichnungen vorstellen kann - der Arbeitsmarkt ist bereits leergefegt, bevor überhaupt ein richtiger Bedarf entstanden ist.

Kein Wunder also, dass die Gehälter für die neuen AI-Berufe explodieren. Eine Viertelmillion Dollar Jahresgehalt für einen Data Scientist ist im Silicon Valley schon keine Seltenheit mehr. Und auch hierzulande stehen Konzerne und mittelständische Unternehmen bereits im engen Wettbewerb um den Skill der Zukunft. Immer häufiger entscheiden sich die HR-Abteilungen dafür, das austarierte Gehaltsniveau zugunsten eines KI-Spezialisten auszuhebeln. Das ist ein untrügliches Zeichen dafür, dass Unternehmen im KI-Einsatz inzwischen große Benefits fürs Geschäft sehen.

Dabei sind es vor allem die Unternehmensbereiche Kundenkommunikation und automatisierte Produktion, in denen sowohl Kosteneinsparungen als auch Umsatzwachstum durch KI erwartet werden. Wer hier als Microsoft Partner zusätzlichen Skill rund um Azure und KI-Services aufbaut, sichert sich ein starkes Wachstumsfeld für die Zukunft. Denn der Bedarf an Fachkräften in diesem Gebiet wird auf lange Sicht nicht gedeckt werden können.

2,3 Millionen neue Jobs sollen in den kommenden drei Jahren weltweit durch KI entstehen, schätzen die Analysten der Gartner Group. Zwar werden durch die KI-gestützte Automatisierung gleichzeitig rund 1,8 Millionen Jobs verlorengehen, doch sieht Gartner auch langfristig einen positiven Saldo aus Job-Creation und Stellenabbau. Hinzu kommt, dass nach Ansicht der Analysten in den nächsten fünf Jahren ein Mehrwert in Höhe von 2,9 Billionen Dollar entstehen wird. Und KI-Systeme werden durch die Übernahme von Routineaufgaben rund 6,2 Milliarden Stunden Arbeitszeit freigeschaufelt haben.

Voraussetzung für die sinnvolle Nutzung von KI-Services ist freilich die Digitalisierung der Geschäftsprozesse. Und die geht wiederum nicht ohne eine mindestens teilweise Migration in die Cloud. Wer also als Microsoft-Partner und Kunde auf die Azure-Plattform setzt, hat sich den Zugang zu den drei wichtigsten Wachstumsfeldern der kommenden Zeit verschafft. Wer jetzt seine Mitarbeiter in Richtung Cloud-Computing, Digital Management und KI-Training qualifiziert, sichert sich einen unschätzbaren Wettbewerbsvorteil.

Das Thema künstliche Intelligenz dominierte übrigens auch den Weltwirtschaftsgipfel in Davos. Nahezu alle Regierungschefs und Unternehmer sprachen die Auswirkungen von KI auf die Arbeitswelt an. Dabei zeigte sich, dass nicht allein wenig qualifizierte Aufgaben wegfallen können. Je stärker KI-Systeme für die Entscheidungsunterstützung herangezogen werden, umso stärker werden auch Management-Aufgaben obsolet. Schlankere Hierarchien und agile Unternehmen dürften die Folge sein. Auch daraus entsteht ein Mehrwert – und ein gigantischer Beratermarkt.

Denn es wird nicht allein darum gehen, KI-Systeme zu installieren. Rund 90 Prozent des Aufwands wird dafür benötigt, KI-Systeme „anzulernen“ und die verfügbaren Daten richtig zu aggregieren. Deshalb arbeitet Microsoft auch an KI-Systemen, die KI-Systeme optimieren können. Mittelfristig soll damit die Anlernphase von lernenden Maschinen halbiert werden können.

Damit zeigt sich, dass auch die Installation von KI-Systemen immer günstiger wird und damit auch für kleinere Unternehmen erschwinglich sein wird. Doch je breiter der Markt, desto größer wird der Bedarf an Skill. Wer jetzt in KI-Wissen investiert, erntet morgen Markt-Macht.

Howdy folks!

Michele Ferrari here from the Premier Field Engineer-Identity Team in San Francisco, here today to talk about ADFS Monitoring settings for Claims Provider Trust and Relying Party Trust.

This is the question we're going to answer today as part of the Mix and Match series:

How can we Monitor when our partners' Identity Providers update the Signing and Encryption certificates?

Well, what I'm implementing it's something which is still not available today but, our PG is aware, and it will be included in vNext. Before going straight to the solution, I want to present a real scenario and recall some of the basic concepts in the Identity space.

The solution we discuss can be used to monitor either the Claims Provider Trust or the Relying Party Trust certificates => same knowledge can be applied to that as-well.

Relying Party signature certificate is rarely used indeed. It is meant when the SaaS application provider also wants to digitally sign the SAML Sign-In request, when the request is sent over to the ADFS server to ensure the SAML request doesn't get modified somehow. There isn't typically anything important in the SAML request but there are cases where the application owner or us want to enforce a certain authentication type. Signing the SAML request ensures no one modifies the request.

It's also possible to encrypt the SAML request but this is definitely rare to see in the real life.
If you want to understand more what a SAML Protocol Sign-In request looks like, read this post from Dave Gregory here=>https://blogs.technet.microsoft.com/askpfeplat/2014/11/02/adfs-deep-dive-comparing-ws-fed-saml-and-oauth/

Ready? Follow me…

Let's start from a practical example:

CONTOSO.COM wants to allow his employees to access a 3^rd party application called ClaimsWeb hosted by MISTERMIK.COM , providing the SingleSignOn experience.

èJohn, an employee at CONTOSO.COM wants to access an expense note application (ClaimsWeb).

Let's break this down and identify all the moving parts involved:

• John, is an User member of CONTOSO.COM. It's called Subject.
  
• CONTOSO.COM is the Identity Provider (abbreviated IP in WS-Federation, IdP in SAML) authenticates a client using, for example, Windows integrated authentication. It creates a SAML token based on the claims provided by the client and might add its own claims.
  èA Relying Party application (RP) receives the SAML token and uses the claims inside to decide whether to grant the client access to the requested resource.
  
• MISTERMIK.COM is a software vendor offering
  SaaS solutions in the cloud.
  

  MISTERMIK.COM decides that its ClaimsWeb application should trust CONTOSO.COM because of CONTOSO.COM purchasing a license for the ClaimsWeb application.
  

  MISTERMIK.COM here plays the role of the Relying Party STS,
  è which does not authenticate the client, but relies on a SAML token provided by an IP-STS that It trusts (CONTOSO).
  

• CLAIMSWEB.mistermik.com is the Relying Party
  Application. Synonyms for an RP include "claims aware application" and "claims-based application".
  è A relying party is a Federation Service or application that consumes claims to make authorization decisions: an application that trusts an Identity Provider is referred to as a relying party or RP.
  

  Claims provider trust:
  èit is a trust object that is created to maintain the relationship with another Federation Service that provides claims to this Federation Service.
  

  MISTERMIK'S ADFS has a claims provider trust with CONTOSO'S AD FS = CONTOSO'S ADFS provides CONTOSOJohn's claims to MISTERMIK'S AD FS.
  

  Relying party trust:

  è it is a trust object that is created to maintain the relationship with a Federation Service or application that consumes claims from this Federation Service.
  

  CONTOSO'AD FS has MISTERMIK.COM's AD FS as Relying Party Trust. MISTERMIK.COM consumes claims coming from CONTOSO'S AD FS.
  

Now that we have covered the terminology with the entities that will play the role of the IdP or IP, and RP, we want to make it perfectly clear in our mind and go through the flow one more time.

Let's write something on the whiteboard and focus on steps:

Step : Present Credentials to the Identity Provider

1.1. When John from CONTOSO.COM attempts to use ClaimsWeb App for the first time (that is, when he first navigates to https://clamisweb.mistermik.com ), there's no session established yet. In other words, from an identity's point of view, the User is unauthenticated. The URL provides the application with a hint about the customer that is requesting access

1.2. The application redirects John's browser to the Identity's issuer (the federation provider/AD FS). That is because MISTERMIK.COM'S federation provider is the application's trusted issuer. As part of the redirection URL, the application includes the whr parameter that provides a hint to the federation provider about the customer's home realm. The value of the whr parameter is http://contoso/trust.

1.3. The MISTERMIK.COM 's federation provider uses the whr parameter to look up the customer's Identity Provider and redirect John's browser back to CONTOSO issuer.

Assuming that John uses a computer that is already a part of the domain and in the corporate network, he will already have valid network credentials that can be presented to CONTOSO.COM's Identity provider.

1.4. CONTOSO.COM's Identity provider uses the User's credentials to authenticate him and then issue a security token with a set of CONTOSO.COM's claims. These claims are for instance the Username, Group Membership and other attributes.

Step : Transmit the Identity Provider's Security Token to the Federation Provider

2.1. At this point the Identity Provider's Federation Service transforms the organization claims to a set of outgoing claims. The outgoing claims are sent to the Federation Service of the resource provider, MISTERMIK.COM.
The CONTOSO'S Identity Provider uses HTTP redirection to redirect the security token it has issued to MISTERMIK.COM's federation provider.

2.2. MISTERMIK.COM's federation provider receives this token and validates it.

Step : Map the Claims

3.1. MISTERMIK.COM's federation provider applies token mapping rules to the CONTOSO's Identity Provider security token. The claims are transformed into something that ClaimsWeb Application understands.

3.2. The federation provider uses HTTP redirection to submit the claims to the User's browser (John).

Step : Transmit the Mapped Claims and Perform the Requested Action

4.1. The browser sends the federation provider's security token, which contains the transformed claims, to the ClaimsWeb Application.

• The application validates the security token.
  
• The Expense Note Application ClaimsWeb, an ADFS-enabled Web application also defined as Claims aware application, it consumes the organization claims and uses them to Authorize the user or to personalize the application for the user, for example showing the expense notes related to John and other John's financial data.
  

Ok folks, I know it's a lot to digest but, you will appreciate having this perfectly clear on your next Identity conversation. We have now to understand how the Identity Provider and the Resource Provider can trust each other.

Claims Provider Trusts

We can use the Claims Provider Trust to federate to ADFS implementation to other organization or 3rd party federated identity providers (Ping Federate, Siteminder, etc).

When you configure a claims provider trust or relying party trust in your organization with claim rules, the claim rule set(s) for that trust act as a gatekeeper
for incoming claims by invoking the claims engine to apply the necessary logic in the claim rules to determine whether to issue any claims and which claims to issue.

We can't really talk about Trusts without introducing the Claim Pipeline:

The Claim Pipeline represents the path that claims must follow before they can be issued.

• Accepting incoming claims
  
  • The acceptance rules are run
    
• Authorizing the claims requester
  
  • Access Control Policy for Authorization decision
    
• Issuing outgoing claims
  
  • Issue outgoing claims and package into a security token
    

The Relying Party trust provides the configuration that is used to create claims. Once the claim is created, it can be presented to another Active Directory Federation Service or claim aware application.

Claim provider trust determines what happens to the claims when it arrives.

Let's apply what we discussed here to our practical example:

Claims Provider Trusts and Relying Party Trusts

In order to accept incoming claims from a Claims Provider (IdP-STS), you must first establish trust by creating a Claims Provider Trust on your Relying Party (RP-STS). (Gatekeeper).
èMISTERMIK.COM (RP-STS) -------Claims Proivider Trust---à CONTOSO.COM (IdP)

In order to send outgoing claims from your IdP-STS, you must first establish a trust by creating a Relying Party Trust on your IdP-STS. A Relying Party Trust can be another STS which is relying on claims from your STS.
èCONTOSO.COM (IdP) --------------Relying Party Trust---à MISTERMIK.COM (Resource Provider)

MISTERMIK.COM has a Relying Party Trust à ClaimsWeb Application, which close the circuit as Relying Party Trust can be a web application or service which is relying on claims from your STS.

Properties of a Trust Relationship

Monitoring – The Federation Metadata URL is used to obtain policy from the partner STS. This policy information is pulled on a regular interval which is called trust monitoring. Trust monitoring can be disabled and the pulling interval can be modified.

Identifiers – Display Name determines how the trust is viewed in the AD FS MMC and also how it appears on the home realm discovery page. The Claims provider/relying party identifier is a unique identifier in URI format. The default identifier for AD FS STS's is http://{dns_name}/adfs/services/trust.

Certificates – The public key portion of the Claims Provider partner's token-signing certificate is stored.

Encryption – The public key portion of the partner's token-encryption certificate is stored.

Signature – This is the verification certificate for a Relying Party used to verify the digital signature for incoming requests from this Relying Party.

Offered Claims – The Claim Descriptions that are published by the Claims Provider partner STS are shown. If the Claim Type of the Claim Description matches the Claim Type of a Claim Description on your STS, then the display name is shown. Otherwise, you will see the Claim Type of the offered claims.

Now that we've reviewed the basics, discussed the moving parts and broke the flow in detail and understood their correlation, we're ready to make the next step into certificates and why is so important these are up-to-date.

Certificates

Each federation server uses a token-signing certificate to digitally sign all security tokens that it produces. This helps prevent attackers from forging or modifying security tokens to gain unauthorized access to resources.

When we want to digitally sign tokens, we will always use the private portion of our token signing certificate. When a partner or application wants to validate the signature, they will have to use the public portion of our signing certificate to do so.

CONTOSO.COM, the IdP (Identity Provider) has an X.509 certificate. When John, a CONTOSO employee authenticates for accessing the ClaimsWeb App in MISTERMIK.COM .COM, the IdP uses the private key associated with the X.509 certificate to digitally sign the token. The Federation Service in MISTERMIK.COM verifies the digital signature using the public key confirming the token has been produced only by CONTOSO.COM's Identity Provider and that the content has not been altered from the moment it was signed. https://docs.microsoft.com/en-us/windows-server/mistermik.com /ad-fs/design/token-signing-certificates

Then we have the Token Decryption Certificate. This certificate would be used to encrypt SAML tokens from the Identity Provider.
Encryption of tokens is strongly recommended to increase security and protection against potential man-in-the-middle (MITM) attacks that might be tried against your AD FS deployment. Use of encryption might have a slight impact on throughout but in general, it should not be usually noticed and in many deployments the benefits for greater security exceed any cost in terms of server performance.

Encrypting claims means that only the relying party, in possession of the private key would be able to read the claims in the token. This requires availability of the token encrypting public key, and configuration of the encryption certificate on the Claims Provider Trust (same concept is applicable at the Relying Party Trust).

Recalling our practical example, when CONTOSO.COM, the IdP sends MISTERMIK.COM /RP a token, AD FS will use the private key of his token signing certificate and optionally, the public key of his partner's token encryption certificate.

By default, these certificates are valid for one year from their creation and around the one-year mark, they will renew themselves automatically via the Auto Certificate Rollover feature in ADFS if you have this option enabled. We don't in our Lab and we want to monitor when a certificate is changed.

This tab governs how AD FS manages the updating of this claims provider trust. You can see that the Monitor claims provider check box is checked. This indicates that AD FS will periodically check the Federation Metadata URL shown in the dialog and compare it with the current state of the claims provider trust.

ADFS starts the trust monitoring cycle every 24 hours (1440 minutes).

Get-ADFSProperties | select MonitoringInterval

PS C:MF> Get-ADFSProperties | select MonitoringInterval

MonitoringInterval

------------------

1440

From the AD FS/Admin log we can see:

1.
Log Name:      AD FS/Admin
Event ID:      336
The certificate management cycle was initiated.

2.
Log Name:      AD FS/Admin
Event ID:      337
The certificate management cycle was completed.

Federation Metadata

When creating a federation trust between Federation Services, we utilize the /FederationMetadata/2007-06/FederationMetadata.xml endpoint. This endpoint is enabled and enabled for proxy by default. The FederationMetadata.xml file is held in memory by the AD FS Windows service and is never written to disk, so if the AD FS Windows service is not running the FederationMetadata.xml data is not accessible.

Once the federation trust is created between partners, the Federation Service holds the Federation Metadata endpoint as a property of its partners, and uses the endpoint to periodically check for updates from the partner. For example, if an Identity Provider gets a new token-signing certificate, the public key portion of that certificate is published as part of its Federation Metadata. All Relying Parties
who partner with this IdP will automatically be able to validate the digital signature on tokens issued by the IdP because the RP has refreshed the Federation Metadata via the endpoint.

The Federation Metadata.XML publishes information such as the public key portion of a token signing certificate and the public key of the Encryption Certificate. What we can do is creating a schedule process which:

1. Download the partner FederationMetadata.XML
2. Extrapolate the Signing and the Encryption certificates
3. Compare the Thumbprints between these certificates and what the Federation Service has
4. Create an event to inform the status of certificates: Error if different=certificates were updated
5. From here there are then a number of secondary actions customer can take (emails, other tasks etc.).

Case1

Monitor the Relaying Party Trust certificates (From CONTOSO Vs SaaS provider offering the Application)

The script assumes the existence of an EventLog source: ADFSCert

You can create the source with the following line as an Administrator of the server:

New-EventLog –LogName Application –Source "ADFSCert"

More Info: https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/

From CONTOSO'S AD FS, the Identity Provider, I want to monitor the Signing and Encryption certificate with MISTERMIK'S SaaS Provider / Relying Party STS.

Signing Certificates and Encryption Certificates were changed

Signing Certificate	Encryption Certificate

If all is good:

Signing Certificate	Encryption Certificate

Case2

Monitor the Claims Provider Trust certificates (From the SaaS provider offering the Application Vs my Customer IP/CONTOSO)

Signing Certificates and Encryption Certificates were changed

Signing Certificate	Encryption Certificate

If all is good:

Signing Certificate	Encryption Certificate

Signing Certificate was changed from the Partner Federation Service.

I also write when the trust was last monitored and Updated.

Be aware, that the 'LastMonitoredTime' is updated, whether or not the monitoring was successful.

THAT'S IT!!!!

We introduced today a solution which included the establishment of a claims-based architecture with an issuer that acts as an identity provider (IdP/IP) on the customers' side and an issuer that acts as the federation provider (FP) on Mistermik.com side: a gateway between a resource and all of the issuers that provide claims about the resource's users.

As part of my Mix and Match series, we went through concepts and terminologies of the Identity metasystem, understood how all the moving parts operates across organizational boundaries.

We discussed the certificates involvement in AD FS and how I can use PowerShell to create a custom monitor workload and a proper logging which can trigger further automation.

I hope you have enjoyed and that this can help you if you land on this page.

Michele Ferrari (MisterMik)

Premier Field Engineer

Find resources that help you build and sustain a profitable cloud business, connect with customers and prospects, and differentiate your business. Read previous issues of the newsletter and get real-time updates about partner-related news and information on our US Partner Community Twitter channel.

Subscribe to receive posts from this blog in your email inbox or as an RSS feed.

Looking for partner training courses, community calls, and information about technical certifications? Read our MPN 101 blog post that details your resources, and refer to the Hot Sheet training schedule for a six-week outlook that’s updated regularly as we learn about new offerings. To stay in touch with us and connect with other partners and Microsoft sales, marketing, and product experts, join our US Partner Community on Yammer.

Top stories

New posts on the US Partner Community blog

• Part 2 – Identifying the different use cases for partner offerings and solutions scenarios
• Part 1 – Implementing a multi-tenant offering in Azure using CSP
• Build a Profitable New Cloud Practice in 2018!
• Attend an Azure Linux Migration Workshop
• Microsoft 365 Business Updates
• Partner Spotlight: GE Grid Solutions and Alpine Metrics
• Deep Dive: Citrix App Layering in Microsoft Azure
• Plan for an easy renewal of your Microsoft partner program membership in 2018
• Deep Dive: VDI with Citrix Cloud on Microsoft Azure
• Give customers an interactive tour of the value of your Microsoft Office 365 solutions
• Drive professional services engagements with Microsoft funded security offerings for partners – Part 2 of 2
• New toolkits for security and GDPR
• Join the first SMB Partner Insider call of 2018!
• New tools to accelerate sales cycles and promote consulting services
• Spark Your Data Modernization Practice!

New on demand videos

• MPN 101: Partner Marketing Resources
• January 2018 Modern Workplace Windows & Devices Partner Community call
• January 2018 Applications & Infrastructure Partner Community call
• January 2018 Modern Workplace Productivity Partner Community call
• January 2018 Modern Workplace Security Partner Community call
• Partner Spotlight: GE Grid Solutions and Alpine Metrics
• January 2018 Business Applications Partner Community call
• MPN 101: Renewing your competencies
• MPN 101: New Partner Orientation January 2018

MPN news

• Transformation, momentum, and unprecedented opportunity ahead for Microsoft partners
• An intelligent approach to building your AI practice
• COPA-DATA helps machine builders and manufacturers deliver value
• Invest in yourself: Marketing training and storytelling tips
• Looking ahead: Opportunities for partners in 2018
• Unlocking your story: Three keys to creating a powerful narrative
• Are innovators born or made?
• To transform or optimize your digital business. That is the question?
• NRF 2018: Where Microsoft partners bring intelligent retail
• NeoLedge sees global expansion success with help from Microsoft
• Your resolution: prepare for GDPR!

Partner webinars available this winter

• Grow Your Practice and Increase Profitability with Azure Data Services + SQL Server 2017
• Cloud Practice Development Workshops
• Cloud Application Development Partner Practice Enablement
• Azure Government boot camp training
• Microsoft Cloud Platform Immersion experiences
• ISV Application Builder Training Series
• Immersion experience facilitator boot camp training
• Join the Cloud Ready program and grow your cloud practice
• Cloud Growth and Profitability Office Hours Series
• The Leading Edge Webinar Series
• Hot Sheet training schedule

Learning news

• Progressive Discounts on MCP Exams
• New DevOps Workshop released to support the Microsoft Professional Program
• Microsoft Certified Trainer Program Resources Now Available
• Azure Learning Initiative for Learning Partners
• North America MCT Summit: February 2018

Upcoming events

• January 30: MPN 101 Roadshow in Bellevue
• February 13: IoT In Action in San Francisco, CA
• ISV Application Builder training events in February and March

US Partner Community partner call schedule

Community calls and a regularly updated, comprehensive schedule of partner training courses are listed on the Hot Sheet.

• Friday, February 2, 10:00 am Pacific Time, Data & AI Partner Community call: Power BI Embedded

Are SharePoint users getting the message "Sorry, this site hasn't been shared with you." when trying to give them access to a SharePoint site that uses SAML authentication? Below I explain some of the common mistakes that administrators make when giving users permissions to a SharePoint site that is using SAML authentication.

Giving users access to SharePoint using SAML
When using SAML claims with SharePoint, depending on your SAML configuration. You can give your users access either by using the user's identity claim or Group/Role claim. Below I go over both methods.

Giving access using the Identity claim of the user
To give access using the user's Identity claim, you first need to determine which claim is configured as the Identity claim in your SharePoint farm. This is the special claim that SharePoint uses to identify the user. If you are not sure which claim has been configured to be the identity claim in your farm. Then run the following PowerShell script on one of your SharePoint servers using the SharePoint Management Shell. In the screen shot below you can see that my identity claim is "E-Mail Address". In other cases, it might be configured as the UPN, SamAccount, or some other type of claim used for identifying the user.

Get-SPTrustedIdentityTokenIssuer | % {$_.IdentityClaimTypeInformation}

Now that you have found your identity claim type. We need to determine if the user is getting added to the site correctly.
If you do not have a custom claim provider configured on your farm. It is important to understand that it is very easy to add the user in-correctly to SharePoint. SharePoint will not validate the user against the identity provider like you are used to when using Windows claims. This means you must enter the user's identity claim correctly without typos.

Incorrectly adding the user
Since my farm doesn't have a custom claim provider configured, I can accidently add the user in correctly. I should be using the E-Mail address claim and not something like the users display name.

Correctly adding the user
When picking your user, make sure you select the user in the list that has the identity claim and not some other claim that is not the user's identity claim. In the screen shot below I am choosing the user with the E-Mail claim by hovering over it to see the claim type.

Giving access by using a Group/Role claim
Depending on your custom claim provider, you might call your groups "Roles" or "Groups. They are both the same thing. Using the group/role claim can be just as tricky because they can come in a few different formats. Depending on the custom claim provider configuration, you could be using one of a few formats for groups. For example, they might be in the format as "domaingroup name" or just "group name" without the domain name. Below I show examples of a few group format examples.

Unique Group name – "Group A"

Domain name with group name – "ContosoGroup A"

If you are not sure what format your Group/Role claim is in. You can capture a Fiddler trace of the user to collect SAML token being created for the user. There we can determine if we are using the right claim format. See the next section below.

Collecting the SAML token with a Fiddler trace
If you have determined that you are correctly giving your user permissions either by the identity claim or by Group/Role claim. We can take a Fiddler trace from the user's workstation during the login process to the SharePoint site. You can validate what claims your custom claim provider is provider to the SharePoint server on for the user.

Step 1 – Download and install the Fiddler application to the user's workstation - Fiddler Download Here. Installing Fiddler is straight forward, just go through the install wizard selecting Yes to all the menus till its completed.

Step 2 – Once you have Fiddler installed, start the Fiddler application. Next make sure you enable HTTPS so we can decrypt the SSL packets. To do so, select "Tools/Options" on the Ribbon, then select the "HTTPS" tab. Check the box next to "Capture HTTPS CONNECTs" and the box next to "Decrypt HTTPS traffic". Select OK to complete the configuration.

Step 3 – To start and stop the capturing, you can click on File in the top ribbon and select "Capturing Traffic" or by clicking "F12". When it's capturing you will see the words "Capturing" in the lower left corner.

Step 4 – Once you have Fiddler capturing, have the user log in to the SharePoint site using Internet Explorer. The user should be re-directed to the custom claim provider for authentication. 

Step 5 – Once the user gets the error message, stop the Fiddler trace by pressing F12.

Step 6 – Now review the Fiddler trace looking for the URL that contains "/_trust/". See my screen shot below. You can see in frames 2 through 5 the user accessed the SharePoint site and was re-directed to the custom claim provider in frames 7 through 9. Frame 10 is where we get the SAML token that was generated by the custom claim provider. Select the "Inspectors" tab and then the "WebForms" tab. Locate the "wresult" section and copy everything opposite from it in the value Colum.

Step 7 – Paste the contents into a Notepad and save it as a XML file, see below. Be sure to switch your Save as type to "All Files (*.*)".

Step 8 – Open the saved XML file using your web browser. Reviewing the information in the SAML token you can see the claims provided by your custom claim provider.

SAML token explained:
GREEN Box – Here you can see the email address identity claim for the user. This is the claim we are looking for when identifying the user. When giving this account permission to the SharePoint site, it has to be in the same format as found in the Fiddler trace above..
BLUE Box – Here you can find the role claims for the user. Take note of the format of the role claims in your SAML token, this is the format you should use when adding it to your SharePoint site with people picker.
YELLOW Box – Here we can find the SAML Life time by subtracting the Created time from the Expired time. This value is set by the claim provider. In this example its set for 1 hour.

STEP 9 – Using the information in the SAML token you can validate if you are giving the user permission correctly to the SharePoint site using the correct identity or Group/Role claims. Try re-adding the user to the site collection using one of the claims found in the users SAML token captured in the Fiddler trace and have the user test again. Once you get the right claim added the user should be able to access the SharePoint site successfully.

Note – If you do not see the correct claim information in the SAML token. Then there must be a configuration problem with your custom claim provider.

(この記事は年月日にMicrosoft Partner Network blog に掲載された記事  Building the apps of the future at Connect(); 2017　の翻訳です。最新情報についてはリンク元のページをご参照ください。)

マイクロソフト パートナー様のすばらしいアイデアを実現する新たなテクノロジをご紹介することは、この上ない喜びです。パートナー様の画期的なソリューションには、いつも驚かされます。そのため今回も、ニューヨークで開催した Connect(); 2017 (英語) で発表されたテクノロジについてお伝えできることを非常に嬉しく思います。今回発表された新機能を活用すると、クラウドで開発作業を行うパートナー様は、さらにインテリジェントかつ革新的なアプリを開発してお客様に提供できるようになります。

最先端のアプリで世界を変える

私は、一般ユーザーとビジネス ユーザーの両方に向けてリッチで直観性に優れた最新のエクスペリエンスを提供する手段を探しているパートナーの皆様から、定期的にお話を伺っています。アプリに AI 機能を組み込むことで、操作性を強化し、カスタマー エクスペリエンスを差別化することができます。

住宅のリフォーム アプリの作成を例に考えてみましょう。古いキッチンの寸法と外観を記録、分析し、新しい電化製品を配置したり、色を変えたりすると共に、お勧めのアップグレードの方法を提案できたならどれほどすばらしいことか、おわかりいただけると思います。あるいは、個人経営の農場向けの農場管理アプリを作成し、天候パターンや土壌サンプル、収穫スケジュールを基に、個別の条件に応じて水や肥料の与え方をアドバイスするといったことも考えられます。このように、無限とも言える可能性が広がっているのです。

マイクロソフト テクノロジの活用

パートナー様がこうしたインテリジェントなアプリを作成できるように、マイクロソフトはこのたび、Visual Studio に新たな AI 開発ツールを追加しました。このツールは MPN メンバー特典としてご利用いただけます。また、新しい Azure IoT Edge サービスも発表しました。Azure IoT Edge は、コンテナーを利用して、クラウド インテリジェンスを IoT デバイスにデプロイするサービスです。さらに、Azure Machine Learning、Azure Functions、Azure Stream Analytics などのサービスを IoT Edge で実行する新しい画期的なクラウド機能が導入されました。これらのツールの詳細については、こちらの記事 (英語) をご覧ください。

そして、幅広いデータ ソースを利用したデータおよび分析ソリューションの開発に取り組んでいるパートナー様向けに、データ資産全体の柔軟性を向上させるテクノロジもいくつか発表しました。その 1 つが Azure Databricks (プレビュー版) です。この高速で使いやすく、共同作業に対応した Apache Spark™ ベースの分析プラットフォームを使用することで、データ サイエンティスト、データ エンジニア、開発者は企業全体のデータを処理、管理して、すばやくインサイトを入手できます。もう 1 つは Azure Database for MariaDB (プライベート プレビュー版、英語) です。これにより、多くの開発者が愛用している MariaDB にフルマネージド サービスの機能が提供されます。さらに、Azure Cosmos DB の機能も強化され、Azure Cosmos DB と Apache® Cassandra API のプレビューが開始されています。

データ移行に強い関心をお持ちの皆様は、こちらの記事 (英語) もご覧ください。Microsoft Data Accelerator Program を利用することで、ISV パートナー様はデータ ワークロードのクラウド移行に関するお客様からの需要の増大に対応することができます。

AI を利用したデータの活用は、ますます簡単になりました。マイクロソフトの AI School では、各自のペースで手軽に学習できる無料のオンライン モジュールを提供しています。この優れたリソースの詳細については、こちら (英語) をご覧ください。

アプリ開発をすべての人の手に

最後に、Visual Studio App Center の一般提供開始も発表されました。Visual Studio App Center はお使いの開発環境に依存しない (Objective-C、Swift、Java、Xamarin、React Native のほか、新しい Azure DevOps Projects 機能、一般提供が開始された Visual Studio Team Foundation Server 2018、Visual Studio Code の Python 用拡張機能をサポート)、最も包括的な機能を備えたアプリ開発ライフサイクル ソリューションです。Cloud Solution Provider (CSP) プログラム経由で購入した Visual Studio サブスクリプションでご利用いただけます。Visual Studio App Center の詳細については、こちらの記事 (英語) をご覧ください。

今回発表した新たなサービスは、パートナー様がビジネスを差別化させるうえで大きな役割を果たすでしょう。

マイクロソフトは、皆様がこれらのテクノロジを活用できるようにご支援してまいります。

Teams裡的訊息如果太多太龐雜，有什麼方法可以讓重點訊息一目瞭然呢？今天小編就要來教大家幾個關於Teams訊息的操作撇步，讓您在找特定訊息時不需費時費力，閱讀訊息更清楚！

書籤儲存功能

▲按粉紅色書籤，儲存團隊中的訊息

▲儲存的訊息會在Teams畫面左下角，點擊個人頭像後的「已儲存」欄位中

無論是自己或他人發佈的訊息，只要想儲存，就可以按粉紅色的書籤。下次如果想找出來不用再慢慢翻，直接利用這個功能就可以在Teams左下角的「已儲存」中快速找到自己需要的訊息。

重要訊息功能

▲發佈重要性較高的訊息時，可以按！標示

特別重要的訊息，可以在發佈時標示為重要，告知團隊中的其他人。若忘記標示也不需要緊張，按編輯再標示上去就可以囉！

加入底色功能

▲自己發佈的訊息中，欲強調的重點可以加底色

在自己發佈的訊息裡，如果有特別要強調或提醒大家的文字，像是開會時間、地點等資訊，可以加入底色特別標記。有數種底色可以選擇喔！

客製化貼圖

▲Meme建立客製化貼圖，增加互動性

▲Designers、Devs、Legal可更改預設文字，製作專屬貼圖

除了有內建的貼圖可以使用，Teams中還有一些貼圖客製化功能-Meme、Designers、Devs、Legal。Meme是選擇內建的圖檔後，輸入欲放上的字即完成，而Designers、Devs、Legal是選擇內建的圖檔時，圖檔上已經有預設的字樣，點擊即可更改！這三種客製化貼圖的字體相較於Meme的更生動喔！

以上就是小編整理的四個Teams操作撇步，您學會了嗎？

日本マイクロソフト株式会社 (本社: 東京都港区) は、2018 年 ２ 月 1 日 (木) より『Xbox One 1 TB (Forza Horizon 3 同梱版)』などの参考価格を、従来の 34,980 円 (税抜) から 29,980 円 (税抜) に価格を改定します。また、『Xbox One S 1 TB Minecraft リミテッド エディション』の参考価格を、従来の 39,980 円 (税抜) から 34,980 円 (税抜) に改定します。

今回の価格改定対象製品と新価格は以下の通りです。

『Xbox One S 1 TB』 本体価格改定の対象製品

* お客様の購入価格は、販売店により決定されますので、販売店にお問い合わせ下さい。

その他、現在発売中のすべての『Xbox One』本体および基本情報については製品サイトをご参照ください。

Xbox One 製品サイト

• Xbox One 本体とセット

Azure VM 可以支援 Service Map 的相依性代理程式了!! 將相依性代理程式加入 Azure 的方法很簡單，只需要一行 Powershell 指令，或者在您 Azure 資源管理模板裡做一些小改變即可。

這個產品現在有兩個擴充，一個是適用於 Windows (DependencyAgentWindows)，另一個是適用於 Linux (DependencyAgentLinux)。兩個的發行者都是 Microsoft.Azure.Monitoring.DependencyAgent。

以下是一些 PowerShell 的範例，它將相依性代理程式裝在 Azure 資源群組裡每個 VM 上。

$version = "9.1"

$ExtPublisher = "Microsoft.Azure.Monitoring.DependencyAgent"

$0sExtensionMap = @{ "Windows" = "DependencyAgentWindows"; "Linux"

="DependencyAgentLinux" }

$rmgroup = ""

Get-AzureRmVm -ResourceGroupName $rmgroup |

ForEach-Object {

""

$name = $_.Name

$os = $_.StorageProfile.0sDisk.0sType

$location = $_.Location

$vmRmGroup =$_.ResourceGroupName

"${name}: ${os} (${location})"

Date -Format o

$ext = $0sExtensionMap.($os.ToString())

$result = Set-AzureRmVMExtension -ResourceGroupName $vmRmGroup -VMName -Location

$location `

-Publisher $ExtPublisher -ExtensionType $ext -Name "DependencyAgent"

=TypeHandlerVersion $version

$result.IsSuccessStatusCode

}

相依性代理程式 VM 擴充還是要仰賴 OMS 代理程式，因此在添加相依性代理程式前，您需要確認您的 VMs 有安裝 OMS 且有在執行 OMS。

Мы постепенно разворачиваем предварительную версию приложения Доска Майкрософт — цифрового холста для свободного совместного творчества, объединяющего людей, идеи и контент. Его уже можно скачать на устройства с Windows 10*. Доска Майкрософт создается для тех, кто привык свободно разрабатывать свои творческие идеи в поисках конечного результата. Приложение предназначено для групп, которые генерируют идеи, развивают их и работают совместно как в личном контакте, так и удаленно, используя различные устройства.

В ходе закрытого бета-тестирования мы наблюдали, как молодые компании использовали предварительную версию Доски Майкрософт для сбора изображений, набросков и заметок, превращая холст в источник вдохновения для новых грандиозных идей. Мы видели, как маркетинговые агентства используют приложение в онлайн-совещаниях с клиентами для работы над дизайном продуктов в режиме реального времени. Наконец, мы сами используем его, создавая схемы наших разработок. При этом удаленные участники одновременно работают над своими участками на общем холсте. Таким образом, мы наблюдаем, как Доска Майкрософт помогает людям эффективно проходить путь от первой идеи до готового продукта — через мозговые штурмы и групповые обсуждения.

Удобная совместная работа

Неограниченная поверхность гарантирует, что на холсте хватит места для каждой идеи — а также для ее развития. Ваши коллеги смогут в режиме реального времени участвовать в процессе, используя разные устройства и находясь хоть в другом конце комнаты, хоть на другом континенте. Вы будете видеть, с каким участком полотна работает каждый из них и какие изменения вносит, будь то добавление изображений, написание заметок или создание диаграмм. Теперь даже удаленные сотрудники легко могут присоединиться к творческому процессу и принять участие в обсуждении.

Естественный интерфейс

Доска Майкрософт позволяет творить наиболее привычными и удобными для вас способами. Технология, ориентированная на использование пера и сенсорного экрана, поддерживает разнообразные жесты и проработку деталей пером. При помощи пера можно добавлять заметки, вычерчивать точные схемы и искать изображения в сети. С помощью пальцев можно легко перемещаться в разные части доски, поворачивать виртуальную линейку под нужным углом и перетаскивать изображения для создания подборки. При использовании как касаний, так и пера Доска Майкрософт распознает ваше намерение и мгновенно выполняет необходимое действие.

Цифровое творчество

Предварительная версия Доски Майкрософт поддерживает интеллектуальный рукописный ввод, который распознает рисунки от руки и преобразует их в стандартные фигуры, позволяя без труда создавать профессионально выглядящие таблицы, диаграммы и блок-схемы. В отличие от обычных офисных досок, изображение с которых могут нечаянно стереть, Доска Майкрософт автоматически сохраняет данные, так что вы всегда можете продолжить с того места, где прервались, а также делиться ссылками на свои доски, чтобы другие могли дополнить вашу работу*. Вам больше не потребуется фотографировать свою доску и отправлять изображения по электронной почте, чтобы другие могли оперативно ознакомиться с вашими наработками.

Мы не сомневаемся, что работа с предварительной версией Доски Майкрософт поможет вам раскрыть свои творческие возможности и полнее задействовать потенциал ваших рабочих групп. Мы будем рады получить ваши комментарии, предложения и заявки на разработку новых функций через Центр отзывов о Windows, доступ к которому есть в приложении.

— Рабочая группа приложения Доска Майкрософт

* Предварительная версия приложения Доска Майкрософт будет развернута для всех английских версий Windows 10 в течение ближайших 24 часов, а на других языках появится в ближайшие месяцы. Использование приложения бесплатно на всех устройствах с Windows 10, однако для совместной работы хотя бы один из участников должен иметь личную, рабочую или студенческую учетную запись Office 365. Для пользователей SurfaceHub предварительная версия приложения Доска Майкрософт в конечном итоге заменит аналогичное приложение, которое установлено на устройствах SurfaceHub сейчас. Но пока это не произошло, вы можете установить предварительную версию Доски Майкрософт параллельно с имеющимся приложением.

Jste enterprise firma a myslíte to s cloudem vážně? Pak určitě budete chtít dobře řídit governance – kdo co smí, co komu patří, jaké politiky se mají vynutit, jak si rozdělit práci, jak řídit náklady. V tomto seriálu se na to zaměříme.

Dnes se podíváme na jemné řízení přístupu k zdrojům v Azure a také na vytváření provozních politik.

Detailní demo k dnešnímu tématu najdete na mém GitHubu zde: https://github.com/tkubica12/azure-policy-rbac-demo

Role-based-access-control vs. Azure Policy

Nejprve se vysvětleme to, co mají administrátoři zprvu problém odlišit. RBAC vs. provozní politika. Důležitá zpráva na začátek – obě se implementují na nízkoúrovňových přístupech (API resp. ARM), čili fungují pro všechny typy přístupu – portál, CLI, PowerShell, ARM šablona, SDK, Ansible či Terraform.

Role based access control je o tom, co který uživatel smí dělat. Funguje to na úrovni API, tedy jakou část stromu prostředků a akcí nad nimi smí využívat. Každá akce v Azure (API volání) je vlastně něco jako URL cesta začínající providerem (například Compute, Storage, Networking), následuje identifikací subscription, pak resource group, pak samotného zdroje a nakonec je akce (start, stop, …). Na této úrovni lze tedy přístup řídit velmi jemně.

RBAC tedy znamená, že řeknete které subscriptions, resource groups nebo jednotlivé zdroje uživatel vidí, do kterých může i zapisovat a jaké akce s nimi může provádět.

Azure Policy je něco jiného, je to o definici pravidel pro práci se zdroji, které musí všichni uživatelé ctít. Funguje na úrovni ARM a můžete v politice reagovat na přítomnost určitých políček v ARM šabloně a omezit jejich hodnoty.  Lze tak například v subscription omezit možnosti používání diskových obrazů jen na ty, které vytvořila a schválila securita. Nebo dokážete vynutit přítomnost metadat, tedy tagování zdrojů tak, že musí obsahovat třeba kontaktní osobu, typ prostředí nebo kategorii zpracovávaných dat. Dá se také uzamknout virtuální stroje v nějaké resource group do konkrétního subnetu a zabránit tak přemostění připravených síťařských pravidel a zařízení.

Azure Policy definuje provozní pravidla platná pro všechny zdroje, ke kterým jsou přiřazena (třeba Resource Group) bez ohledu na to, kdo je uživatel. Tato pravidla řeší nejen co, ale i jak, protože vidí do obsahu akcí (například jaký konkrétně subnet se uživatel snaží přiřadit ke své VM).

Pokračujte ve čtení

こんにちは Azure サポート チームの村田です。

Azure Automation においては昨年価格体系が変更されました

具体的には以下のように以前の Free、Basic という概念がなくなり、以下のように統合された価格体系となっております。

■ 以前の価格体系

Free - 月あたり 500 分の無料時間が付与され、超過した場合はジョブが実行されなくなります。

Basic - 従量課金として、0.23円 / 分 で課金が発生します。

■ 変更後の価格体系

無償の500分のジョブ実行時間が付与され、超過した分に関しましては、

0.23円 / 分 で課金が発生します。

<参照情報>

Automation の価格

https://azure.microsoft.com/ja-jp/pricing/details/automation/

以前は Basic プランの場合、最初の1分から課金対象となっていましたが、

新しいプランでは、必ず 月あたり 500 分の無料ジョブ実行時間がつくので

プラン的にはお得になってますね。

しかし、この価格体系の変更に伴い、Automation アカウントの画面内から、

月のジョブの実行時間の累計を表示する項目が消えてしまいました。

したがいまして、今どの程度ジョブの実行時間を消費しているのかわからないとご質問をいただく場合がございます。

そんな場合に備え、今回はローカルから PowerShell を実行する事で、特定の期間のジョブの実行時間を

取得するスクリプトをご案内します。

日別にジョブ実行時間が取得できるため、特定の日時のみジョブの実行時間がとても長い際などには、

トラブルシューティングにも便利ですので是非ご利用ください。

スクリプトの実行環境要件

Windows 10またはWindows Server 2016でコンピュータを実行している場合は、

すでにPowerShell 5以降がインストールされているため,この手順は必要ありません

今回の場合、PowerShell のバージョンは 3.0 とのことですので、

PowerShellを含むWindows Management Framework（WMF）の最新バージョンに更新する必要がございます。

・WMFの最新バージョンを入手するには、次のURLにアクセスしてください。

https://www.microsoft.com/en-us/download/details.aspx?id=54616

・WMFとパッケージ管理へのリンクを含むPowerShell Galleryの使用に関する詳細は、

http://www.powershellgallery.com/ を参照してください。

Azure RM モジュールのインストール

AzureからPowerShell経由で情報を照会できるようにするには、

Azure Resource Management（AzureRM）モジュールをインストールする必要があります。

先に進む前に、お使いのコンピュータがパッケージ管理の要件を満たしていることを確認してください。

AzureRMモジュールをインストールするには、以下の手順に従います。

1. [管理者として実行]オプションを使用してPowerShellセッションを開きます。

2. Install-Module -Name AzureRM -Force -Verboseと入力し、Enterキーを押します。

3.インストールが完了するまで待ち、PowerShellのプロンプトに戻ります。

4.モジュールがインストールされたことを確認するために、

Get-Module -Name AzureRM -ListAvailableと入力し、Enterキーを押します。

<実行スクリプト>

PowerShell ISE を起動し、以下のスクリプトを貼り付け、期間を指定して

実行します。

==========================================

Add-AzureRMAccount | Write-Verbose

#ジョブの実行時間を保存するディレクトリを記載します。

$CSVFile = "c:tempautomation.csv"

#ジョブの実行時間を取得する期間の開始日時を指定します

$StartTime = "12/01/2017"

#ジョブの実行時間を取得する期間の終了日時を指定します

$EndTime = "12/08/2017"

#ジョブの実行時間を取得するサブスクリプションID を記載します

$SubscriptionID = 'Subscription ID'

 Set-AzureRmContext -SubscriptionId $SubscriptionID | Write-Verbose

$UsageInfo = Get-UsageAggregates -ReportedStartTime $StartTime -ReportedEndTime $EndTime -AggregationGranularity Daily -ShowDetails $true

 Do {

    $UsageInfo.UsageAggregations.Properties | Where-Object {$_.MeterSubCategory -eq 'Automation'} | `

            Select-Object `

            UsageStartTime, `

            UsageEndTime, `

            @{n='SubscriptionId';e={$SubscriptionId}}, `

            MeterCategory, `

            MeterId, `

            MeterName, `

            MeterSubCategory, `

            MeterRegion, `

            Unit, `

            Quantity, `

            @{n='Project';e={$_.InfoFields.Project}}, `

            InstanceData `

            | Export-Csv -Append:$true -NoTypeInformation:$true -Path $CSVFile

     if ($UsageInfo.NextLink)

    {

        $ContinuationToken = [System.Web.HttpUtility]::UrlDecode($UsageInfo.NextLink.Split("=")[-1])

        $UsageInfo = Get-UsageAggregates -ReportedStartTime $StartTime -ReportedEndTime $EndTime `

                            -AggregationGranularity Daily -ShowDetails $true -ContinuationToken $ContinuationToken

    }

    else

    {

       $ContinuationToken = ""

   }

 } Until (!$ContinuationToken) 

--------------------------------------------------

なお実行時に下図のエラーが発生する場合は

System.Web アセンブリがよみこまれていない可能性が高いため、

以下のコマンドをローカルの環境にてご実施いただければと存じます。

エラー画面

実行していただきたいコマンド

PS C:> Add-Type -AssemblyName System.Web

==========================================

結果として下図のように日時別のジョブの実行時間が CSV で取得できます。

”Quantity” 欄にて分単位でジョブの実行時間が表示されるのが確認できます。

この結果では 9 月で約67分のジョブ実行時間なので無償の範囲内ですね。

月別に出力して、管理することで、変遷を確認するなど運用にお役に立てていただければ幸いです。

皆さん、こんにちは。Windows プラットフォーム サポートの今入です。
今回は、RemoteFX USB リダイレクトを利用する際の設定について紹介します。
OS のバージョンによって変わる

まず、RemoteFX USB リダイレクトを利用するためには、以下の要件が必要となります。

===============
接続元コンピューター
===============
・クライアント OS : Windows 7 以降
　※ OS エディション :
　　- Windows 7 Professional, Ultimate, Enterprise
　　- Windows 8.1 Pro, Windows 8.1 Enterprise
　　- Windows 10 Pro, Windows 10 Enterprise

===============
接続先コンピューター
===============
・クライアント OS : Windows 7 以降
　※ OS エディション:
　　- Windows 7 Ultimate, Enterprise ("RemoteFX vGPU が利用できる RDP 7.1" または "RDP 8.0" が必要 (参考))
　　- Windows 8.1 Enterprise
　　- Windows 10 Enterprise, Windows 10 Pro (1607 以降)
・サーバー OS : Windows Server 2012 以降
　※ RD セッション ホストの役割のインストールが必要です。

次に、接続元コンピューター　と　接続先コンピューターの両方で、以下の設定が必要になります。

===============
接続元コンピューター
===============
ローカル グループ ポリシー エディターにて、以下のポリシーを設定する必要があります。

[コンピューターの構成] - [管理用テンプレート] - [Windows コンポーネント] - [リモート デスクトップ サービス] - [リモート デスクトップ接続のクライアント] - [RemoteFX USB デバイス リダイレクト]

"サポートされている他の RemoteFX USB デバイスの、このコンピューターからの RDP リダイレクトを許可する"
　設定: 有効
　オプション: "管理者とユーザー" または "管理者のみ"
　※ 設定後、再起動が必要

===============
接続先コンピューター
===============
Windows 7 + RDP 8.0 を使っている場合、以下のポリシーをご設定頂く必要があります。

[コンピューターの構成] - [管理用テンプレート] - [Windows コンポーネント] - [リモート デスクトップ サービス] - [リモート デスクトップ セッション ホスト] - [リモート セッション環境]

"リモート デスクトップ プロトコル 8.0 を有効にする"
　設定: 有効
　※ 設定後、再起動が必要

Windows 10 / Windows Server 2016 を利用している場合、以下のポリシーの既定値が変更されていますので、明示的に "無効" にしていただく必要があります。

[コンピューターの構成] - [管理用テンプレート] - [Windows コンポーネント] - [リモート デスクトップ サービス] - [リモート デスクトップ セッション ホスト] - [デバイスとリソースのリダイレクト]

"サポートされているプラグ アンド プレイ デバイスのリダイレクトを許可しない"
　設定: 無効
　※ 設定後、再起動が必要

Windows 7	Windows 10

また、Windows 7 においては、USB 3.0 ポートが OS 標準でサポートされていないため、USB 3.0 ポートを使って RemoteFX USB リダイレクトはできませんので、ご注意ください。
参考 : Windows 7 での RemoteFX USB リダイレクトについて

Like many IT Professionals and enthusiasts, I have a lab.  Mind happens to sit on my laptop and various components will be spun up / down / torn apart as I need.

One I happened to keep together was my Domain Controller.    Sure they're not difficult to spin up and bring online with Windows PowerShell.

But this particular one I had MDT and WDS on there.  I used it as a standalone appliance for Deploying Server 2016 as I needed.   It works and works well.

Last night I fired it up and went to deploy a Server 2016 box only to find out nothing was grabbing an IP address.

I checked over logs and scanned through.   Active Directory was good but over and over DHCP was complaining it couldn't find an Active Directory controller... on the same box.

I did a bit of digging in our local forums and ran across a user with a similar issue.   If you looked at the DHCP Server it showed up as a 169.x.x.x (IPIPA) address.   Running Ipconfig I couldn't see it anywhere but this user mentioned that the issue turned out to be a second network card, with no cable attached.   The answer was "Disable the NIC"

Sure enough on my Virtual box I had a second NIC I installed and forgot about.   Disabled it internally on the server, bounced once and life was good.

Silly me, I should have cleaned up my old NIC's

Cheers!

Sean

Microsoft occasionally offers promotions on license-based subscriptions, allowing you to pass the savings on to customers and grow your business.

Microsoft offers two kinds of promotions; those available to all eligible partners in the Cloud Solution Provider (CSP) program, and those available only to partners in a particular geographic region.

Promotion pricing is automatically applied to your net price when you purchase new subscriptions at the promotion price. In addition, any licenses you add to a subscription purchased with promotion pricing are added at the promotion price.

Take a moment to review these important facts about promotions:

• A subscription’s promotion price applies only for the duration of the subscription. When a subscription you purchased with promotional pricing expires, the renewal subscription’s price reverts to the price in the price list. This means that any subscriptions set up for automatic renewal will renew at the prevailing price. You can find the price list on the Pricing and offers page.
• If a subscription is eligible for multiple promotions, the promotion with the highest percentage off is automatically applied.
• Cancellations of promotion-priced subscriptions follow the same process and policy as regularly-priced subscriptions.

See available promotions

You can see which promotions you’re eligible for, if any, on your Promotions page. Select Promotions from your Dashboard menu to see a list of current promotions, along with the discount, promotion type, and start and end dates for the subscription. If no promotions are available, you'll see a message indicating this.

Note
You can also see promotions when making a purchase. When you select a subscription, the promotion pricing appears on the Review page.

Purchase subscriptions at promotion prices

1. On your Dashboard menu, select Customers and then select the customer who’s buying the subscription.
2. Select Add subscription.
3. On the New subscription page, select the subscription the promotion applies to.
4. Enter the number of licenses the customer needs.
5. Review the order. You'll see the promotion pricing that will be applied in the Discount column.
6. select Submit to purchase. Your customer will see the promotion price on their next bill.