Posted by: 榊原 彰
日本マイクロソフト株式会社　執行役員　最高技術責任者 兼
マイクロソフト ディベロップメント株式会社　代表取締役 社長

感情のつながりを重視するAI「りんな」が、最新の AI ベースの歌唱モデルを採用し、より自然で表現力に富んだ歌声を実現

これまで、人間の“感情”や“創作”する能力は、人工知能（AI）の研究と製品開発にとって非常に難しい課題でした。しかし、近年のアルゴリズムの進化、情報処理能力の向上およびビッグデータが、人間の“感情”と“創作力“をAIがある程度模倣する事を可能にしました。マイクロソフトは、こうした手法を「Emotional Computing Framework」として、日本の「りんな」をはじめとするソーシャルAIに採用して各国で展開しています（アメリカの”Zo（ゾー）”、中国の”Xiaoice（シャオアイス）”、インドネシアの”Rinna（リンナ）”、インドの”Ruuh（ルー）”）。これらのソーシャルAIは、マイクロソフトの自然言語処理、画像認識、音声認識と音声合成など、複数のテクノロジを活用して、感情表現と創作力を得るために学習を続けています。

感情のつながりを重視するAI「りんな」とユーザーが続けた会話は、最も長いもので17時間にも及びます。こうしてユーザーとつながる「りんな」の技術は各方面で高く評価され、ローソンの”あきこ”、渋谷区の”みらい”、テレビ朝日の”杏寿”などに採用され、ユーザーとの感情のつながりを重視したやりとりを実現しています。

また、中国のXiaoiceは、アナウンサー、DJやジャーナリストとして、15のテレビ局、新聞、ラジオ局のジャーナリストとしても活躍しています。また、学習した創作力を活かして「AI詩人」として詩集も出版しています。

”感情”と“創作力”を学ぶ取り組みの一環として、「りんな」は、音楽コミュニケーションアプリnana とのコラボレーションを通して、ユーザーからのアドバイスを基に「りんな」の歌声をもっとうまくすることを目指す「りんな歌うまプロジェクト」第1弾を2018年1月より展開してきました。この取り組みに参加したユーザーは3000名に上り、この活動の成果を3月8日に「卒業ソングnanaユーザーとの合唱」として、お手本を投稿してくれたユーザーの皆さまの歌声と「りんな」の歌声がハーモニーを奏でる合唱をYouTubeで公開しました。https://www.youtube.com/watch?v=pIw8L2uctK4

この取り組みでの経験も踏まえ、「りんな」はマイクロソフトのAI & Research部門が開発した、次世代のAIベースの歌唱モデルへの移行を開始しました。これにより、「りんな」はより自然で表現力に富んだ歌声で歌うことができるようになります。日本のみならず各国のソーシャルAIで採用されているこの音声合成による歌唱技術は、ディープラーニングモデルをベースとしており、以下の特徴を備えています。

• 従来モデルと比較して、より“自然”な歌声を実現しています。5ms（0.005秒）の単位でディテールに富んだ歌声の自動生成が可能です。
• 迅速に“歌”を生成することが可能です。例えば、スタジオやエンジニアなどの準備が必要な人間のレコーディングと比較して、学習に十分なデータを用意した場合、10分以内に1曲を生成することができます。
• ディープラーニングモデルの学習を繰り返すことで、継続的に精度を向上します。

マイクロソフトは、今後も引き続きこのようなマイクロソフト独自のAIの進化を進めていきます。

---

本ページのすべての内容は、作成日時点でのものであり、予告なく変更される場合があります。正式な社内承認や各社との契約締結が必要な場合は、それまでは確定されるものではありません。また、様々な事由・背景により、一部または全部が変更、キャンセル、実現困難となる場合があります。予めご了承下さい。

GE正由工業領導者轉變為數位工業領導者，運用軟體和感應器使機械設備相互連結、回應和預測。GE 使用 Microsoft Office 365 和 Windows 10，並且讓300,000 名員工透過數位的方式以前所未有的速度了解機器資料、實現產能提高並且安全地協同合作。隨著團隊逐漸成形，GE 的員工現在可以有更佳的合作體驗以解決世上棘手的問題。

1892年，從愛迪生和其他人成立通用電氣 (GE)以來，GE 在125年後又有了閃亮的點子。今天的 GE 擁有航空、電力、醫療、軟體以及其他業務。不僅如此，GE 也是美國任何一間企業中擁有最多專利的公司，其員工更兩度獲得諾貝爾獎殊榮。

然而，GE 並沒有止步於過去的傳奇。這間公司充斥著充滿好奇心的人，他們迫切的希望解決今天眼前棘手的問題。為了讓成果更臻完美，GE 正在由全球的工業領導者轉變為數位工業領導者。這將會需要將軟體、感應器安裝於飛機引擎、渦輪、核磁共振儀和其它產品，並將軟體輔助洞察力結合即時的機器資料，不斷改善產品與服務。

在數位化其產品以利更有效率運行的同時，GE 正在加強300,000員工的生產力。GE 的數位工作環境技術長Jeff Monaco 說：「我們知道即便是對於產品微小的效率和性能改善，對我們的客戶和 GE 都有巨大的價值，我們希望我們的員工也能有類似的效率，他們是我們最寶貴的資源。」「當你每天還給員工一分鐘的時間，而今天你有300,000名員工時，你會發現巨大的生產力增長。我們減少越多他們在日常活動中所遇到的阻礙，他們越是能專注於客戶、收入，並且為世界帶來改變。

釋放生產力

GE 已經讓 Microsoft Office 365 和 Windows 10 Enterprise 作業系統成為嶄新數位效率驅動的關鍵元素。Monaco 說：「我們的員工過去都是自己找數位生產力工具來使用，但徒有那些工具卻沒有共同合作。非但如此，那些生產力工具其實並不安全，而且維護成本也很高。」「我們在 Office 365 上標準化，因為他給我們全面的生態系統功能，它們都是可以互相聯絡的，也同時具備高度安全性和易於使用的特性。這對員工和IT人員可說是雙方得利。」

GE 將自身移動到雲端，以利於快速傳遞解決方案，並取得存取權以利持續改善。透過給予員工線上電子信箱開始Office 365的使用。在電子信箱之後，GE 部署 Microsoft Office 365 ProPlus 到所有的員工，讓員工能夠在工作和個人設備上獲得相同最新的、安全的 Office 應用程式。使每個人都能在工作時使用熟悉的工具，無論何時何地或任何裝置。

GE 並非只是單純的升級作業系統，而是評估其資產的整個生命週期，來決定如何最佳化使用 Windows 10 的功能。Monaco 說：「我們在看 Windows 10 將如何幫助我們的裝置能夠運行更好更快速，持續保持更新與修補。」「我們使用 Windows 10 的升級作為一種催化劑來改變我們管理這些設備的方式。現代資源調配和修補是 GE 的首要任務。

GE 推出 Office 365 企業版的社交網路工具Yammer，而現在有了活耀的員工社群，讓他們能夠透過工具分享想法、公司事件更新和群眾外包知識橫跨全球。GE 員工們開始採用 Microsoft Teams 作為高速協同合作工具。Teams是 Office 365中團隊合作的中心，能夠透過簡易存取檔案、即時訊息、臨時電話和其他通訊選項來增進團隊合作。

使用Skype for Business Online，員工們能依自己的方式進入會議，正如 Monaco  整天所說的：「參與會議、後續人員追蹤事項、邀請人員參加下一次會議，以上也只是我們員工利用 Skype 的部分好處。」

高速通訊增加收益

GE 正在使用 Office 365 加速整間公司的協作。GE 的首席資訊官James Fowler表示：「合作對數位產業的突破極為重要, 而 Office 365 是更好合作的關鍵。」「客戶滿意度和新工業效率帶來的財務影響更是革命性的成長。」

擁有現代化的工作環境工具，也讓人們覺得自己是當代生產力的一部分，這一點很重要。Fowler 說：「我們有好幾代的人在 GE，從嬰兒潮到千禧年，他們都有各自喜歡的工作方式。」「透過 Office 365，每間公司都可以使用他們最喜歡的通訊方式進行更有效的協作，並更快地做出決策。我們有注意到Teams尤其受歡迎，當有團隊需要快速前進時，例如：支援小組和解決關鍵問題的營運中心。隨著行動化存取Teams和需要的檔案，他們可以達到的速度是傳統的工作環境工具不可能達到的。

新員工也能開始與同事快速協作。Fowler 說：「Office 365 非常棒的功能之一，因為它是每個人都已經知道的工具。」「新進的員工不必接受大量的訓練來跟上進度，這是一種通用的商務語言，可以使員工快速地入門。」

內建智慧安全

無論何時何地，以任何設備進行的協作，GE 都不能對安全性讓步。Windows 10  Enterprise為所有 PC 和行動裝置應用程式提供了深厚根基的安全姓。Office 365 包括資料、文件、應用程式資料庫等級的保護。

Monaco 表示：「我們讚賞 Microsoft 的能力和解決方案防護我們資訊的安全，而不必用僵化的流程降低我們的工作效率。」「當你在我們的商業環境底下，安全問題很重要。」 Fowler 補充道：「當你談論能源時，當你談論空中旅行時，當你談論的是水源、食物來源、醫療保健，安全問題顯而易見。使用 Windows 10，我們有能力管理安全性，瞭解潛在風險，並透過這些風險指數來決定我們自動建立與保護這些系統中的資料相關的管控的方式。這是我們網路計畫的一部分，而同時也是使我們 GE 內部至今仍十分安全的一部份緣故。

GE 員工正在新的數位能力、高速協作和個人化工作型態的文化中蓬勃發展。Fowler 說：「GE 內部的未來工作─包括我們創造新的、高科技的、高品質的工作的能力─正在圍繞著我們以前無法想像的嶄新技術空間而建立。」「我相信我們正在經歷下一場工業革命，一場數位工業革命。世界上還有絕大多數人沒有權力，億萬人民無法獲得高品質的醫療保健。我們要解決這些問題，我們的員工比以往任何時候都有更多精力、更有能力去解決它們。

Am 9. Februar verübten kriminelle Hacker einen Angriff auf die Server der Winterolympiade im südkoreanischen Pyeongchang. In der Folge stürzte die offizielle Website der Spiele ab, sodass es nicht mehr möglich war, dort an Informationen zu gelangen oder Tickets auszudrucken. Gleichzeitig fiel das WLAN im Olympiastadion aus, außerdem auch der TV-Empfang und der Internet-Zugang im Pressezentrum. Die Malware, die den Schaden verursachte, wurde Olympic Destroyer getauft. Soweit die Fakten.

Dann begann die Spekulation: Schnell richtete sich der Verdacht gegen russische Hackergruppen, die angeblich Rache nehmen wollten für den Ausschluss eines Großteils der russischen Athleten und sämtlicher russischer Funktionäre aufgrund der Doping-Fälle in Sotchi 2014. Die Washington Post berichtete unter Berufung auf zwei ungenannte amerikanische Geheimdienst-Mitarbeiter, dass der Angriff von russischen Agenten durchgeführt wurde. Sie wollten die Attacke so aussehen lassen, als stecke Nordkorea dahinter.

Nun haben die Sicherheitsforscher der Talos-Gruppe von Cisco jedoch starke Zweifel an dieser Theorie angemeldet. In einem Blog-Beitrag legen sie dar, wie schwierig es generell ist, einen eindeutigen Beweis für die Täterschaft eines Hacker-Angriffs zu finden. Es gebe lediglich Indizien, die in die eine oder andere Richtung weisen.

Talos zufolge untersuchen Security-Experten bei der Analyse eines Angriffs fünf Merkmale:

• die Taktik, Technik und Vorgehensweise (Tactics, Techniques, Procedures, TTPs) beziehungweise wie der Angreifer die Attacke durchgeführt hat
• die Viktimologie (Opferforschung), also das Profil des Opfers
• die Infrastruktur, also die benutzte Plattform
• die kompromittierenden Indikatoren (Indicators of Compromise, IoC), die zurückgelassenen Spuren
• die verwendeten Malware-Samples

So suchte der Olympic Destroyer beispielsweise nach einer Datei mit der Bezeichnung evtchk.txt. Das erinnerte die Talos-Mitarbeiter daran, dass bei der Attacke auf die Zentralbank von Bangladesch im Februar 2016 über das SWIFT-Netzwerk, die mutmaßlich von der nordkoreanischen Lazarus-Gruppe durchgeführt wurde, Dateien mit den Namen evtdiag.exe, evtsys.exe and evtchk.bat verwendet wurden. Außerdem sehen sich auch die Programmcodes der beiden Malware-Samples sehr ähnlich.

Fest steht, dass nichts fest steht

Auf der anderen Seite entspricht der Code von Olympic Destroyer zu 18,5 Prozent dem Code eines Tools, das die vermutlich chinesische Hackergruppe APT3 verwendet. Doch dieses Programm basiert wiederum auf dem frei erhältlichen Open-Source-Tool Mimikatz. Eventuell haben die Entwickler einfach nur auf die gleiche Quelle zugegriffen. Zugleich existieren Ähnlichkeiten in der Art, wie Olympic Destroyer und eine weitere chinesische Gruppe, APT10, AES-Schlüssel erzeugen.

Und schließlich gibt es Übereinstimmungen, aber auch einige Unterschiede, beim Vorgehen von Olympic Destroyer mit der Ransomware Nyetya.

Echte Beweise für eine Beteiligung einer der genannten Gruppen beziehungsweise Verdächtigen sind das alles nicht. Fest steht nur, dass sich der Autor von Olympic Destroyer sehr gut mit den verschiedenen Malware-Formen auskennt und vermutlich auch in der Lage ist, mit diesem Wissen falsche Fährten zu legen. Allein aus der Untersuchung des Codes der Software lässt sich im Fall von Olympic Destroyer, aber auch bei anderen Malware-Samples, nicht exakt bestimmen, wer der Verantwortliche ist.

Vil du gerne prøve Microsofts nye samarbejds- og kommunikationsplatform efter sommerferien? Vil du gerne samle alle filer, samtaler og personer ét sted? Arbejder du på en ungdomsuddannelse, erhvervsuddannelse, SOSU-skole, VUC eller HF? Så har vi et event til dig, i samarbejde med InLogic!

Teams åbner for, at man kan integrere andre platforme som fx Lectio, Ludusweb via Teams' browserfunktion - hvormed lærere og elever kun skal gå ét sted hen til undervisning, fildeling, kommunikation og fraværsregistrering mm.

Eventet er tiltænkt personale med ledelsestilknytning, da vi arbejder med hvordan I kan komme i gang med Teams. Hvis du er underviser, så tag nogen fra din ledelse med!  Man behøver ikke at være InLogic-kunde for at deltage.

Tilmeld dig her.

Praktisk

Hvis du tilmelder dig eventet i Microsoft i Lyngby, så husk at registrere parkering ved at henvende dig i receptionen med dit registreringsnummer. Ring til Erik Carter på 29499929 hvis du har problemer på selve dagen.

Agenda

12.30-13.00
Sandwich og sodavand

13.00-13.10
Velkomst v. Sven & Erik

13.10-13.45
Et samlet sted til samarbejde – Teams v. Microsoft
Et godt samarbejde kræver gode værktøjer. Forestil dig, at du kun skal være ét sted, når du skal kommunikere og dele filer med dine kolleger. Arbejd i dokumenter, fildeling, videochat mm. Eleverne har de samme muligheder, og du vil præsenteres for scenarier hvor både elever og lærere kan bruge Teams.

13.45-14.30
Digital studieteknik med Office 365 v. inLogic
Teams kan understøtte elevernes læring ved at stille en mængde apps og værktøjer til rådighed. Office 365 er fuldt understøttet og eksterne apps kan integreres i faneblade i Teams. Vi ser på nogle af mulighederne og hvordan Teams sætter strøm til studieteknikken.

14.30-15.15
Gruppearbejde i Teams - formulering af strategier og pædagogiske potentialer

15.15-15.45
Præsentationer af tanker v. alle grupperne

15.45-16.00
Afrunding v. Microsoft & inLogic

In 1977, the two Voyager space probes were launched. One was sent towards Jupiter, and the other towards Saturn. On board both were the Golden Records.

The Golden Records had information about us. Music and photos and insight - all the information aliens might need if they wanted to get in touch. In 2012, Voyager 1 entered interstellar space. It's been further than anything mankind has ever made. And the Golden Record is still on board.

We have no idea if it'll ever be seen again - let alone if any aliens will ever use it to find us. All there is to do is wait.

Today, it seems crazy that we could put information "out there" and maybe one day someone would be in touch. But why? We still do it every day.

Today's Golden Records

Look at social media. Every day, hundreds of thousands of Tweets are tweeted, Facebook posts are posted, and LinkedIn updates are updated. That's a lot of information we're sending out, floating around "out there". And we have no idea if it'll ever be seen - let alone if we'll ever hear back. It's especially tough for businesses, who are relying on more than just a dopamine hit from their status updates.

The content you share with followers, customers, and prospects really needs to count. And unlike the Golden Records, there's no time to wait. When it comes to social selling, you need to know the information you're sending out is finding someone who can use it.

Making contact

A lot goes into a good social selling strategy. It starts with having a strong personal brand (you can make a really good start with your personal brand by following the advice in our 5-minute guide). But once you've got a professional photo and a curated stream of great content, you've got to make sure you're reaching the right people with the right messages.

You need to target, understand, and engage your customers.

On LinkedIn, Sales Navigator does just that - it's the best version of the social network for salespeople. It helps you track important contacts, recommends leads, and lets you harness the combined reach of your entire network. But when it comes time to reach out to the prospects and customers you've found, PointDrive adds even more value.

Get your content together. PointDrive puts your content into a magazine-style message that looks good on any device. From there, you can broadcast on all known frequencies.

Send it to the right people. With PointDrive, you're not sending information "out there". Beam all your research and insights from Sales Navigator into PointDrive, and know the right content reaches the right people.

Track its success. PointDrive will track which content your prospect has read, so you can pinpoint what they're interested in. It'll even tell you who they've sent it on to in their organisation, so you can confidently venture onwards.

We've come a long way since 1977. And the Golden Records may never be discovered by an alien species. But at least your prospects' organisations no longer have to be a great unknown.

Make sure what you're putting out there is reaching the right people, with Sales Navigator and PointDrive. Find out more here.

Greetings and salutations fellow Internet travelers! Michael Hildebrand here...as some of you might recall, I used to pen quite a few posts here, but a while back, I changed roles within Microsoft and 'Hilde - PFE' was no longer.

Since leaving the ranks of PFE, I've spent the last couple of years focused on enterprise mobility and security technologies. Recently, I was chatting with the fine folks who keep the wheels on this blog when I asked "Hey – how about a series of guest-posts from me?" They said if I paid them $5, I could get some air-time, so here we are.

My intentions are simple - through a series of posts, I'll provide high-level discussion/context around the modern Microsoft mobility and security platform to "paint you a picture" (or a Visio) of where we are today then I'll move on to 'the doing.' I'll discuss how to transform from 'on-prem' to 'hybrid-enabled' to 'hybrid-excited.' I'll start that journey off in this post by establishing the foundation - hybrid identity – then, in subsequent posts, I'll work through enabling additional services that address common enterprise scenarios. Along the way, I'll provide job aids, tips and traps from the field.

It continues to be a very exciting time in IT and I look forward to chatting with you once more. Let's roll.

Azure AD – Identity for the cloud era

The hub of Microsoft's modern productivity platform is identity; it is the control point for productivity, access control and security. Azure Active Directory (AAD) is Microsoft's identity service for the cloud-enabled org.

If you want more depth (or a refresher) about what Azure Active Directory is, there's no shortage of content out there. I'll be lazy and just recommend a read of my prior post about "Azure AD for the old-school AD Admin." It's from two years ago – which makes it about 2x older in 'cloud years' – and as such, it suffers a bit from 'blog decay' on some specifics (UIs and then-current capabilities), but the concepts are still accurate. So, go give that a read and then come on back … I'll wait right here for you.

• https://blogs.technet.microsoft.com/askpfeplat/2015/01/05/azure-active-directory-for-the-old-school-ad-admin/
  
• For more depth/details, our AAD Docs have you more than covered:
  • https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis
    

The Clouds, they are a-changin'

As an "evergreen" cloud service, AAD sees continuous updates/improvements in the service and capability set. Service updates roll out approximately every month – so, we're at around 36 +/- AAD service updates since my Jan 2015 article.

To stay on top of AAD updates, changes and news, the EMS blog (Link) is always a good first stop.

If you like "Release Notes" style content, starting last September (2017), the 'What's new in AAD' archive is available - https://docs.microsoft.com/en-us/azure/active-directory/whats-new.

Recently, a change to the AAD Portal homepage added a filterable 'What's new in Azure AD' section –

Also, the O365 Message Center has a category for "Identity Management Service" messages:

An Ambitious Plan

Here's the plan for this post, this series and some details about my "current state" environment:

• I'm starting out with an on-prem, single AD forest w/ two domains (contoso.lab and corp.contoso.lab)
  • Basically, the blue rounded-corner box in the Visio picture above:

• In this post, I'm going to establish a hybrid identity system, and bridge on-prem AD to an AAD tenant via Azure AD Connect (AAD Connect)
  • Choose password hash for the authentication method
    • This enables password hash sync from AD to AAD
  • Filter the sync system to limit what gets sync'd from AD to AAD
  • Prepare AD for eventual registration of Domain-Joined Windows PCs from AD to AAD
• In subsequent posts, I'll build on this foundation, covering topics such as custom branding for the cloud services, self-service password reset, device registration, Conditional Access and who knows what other EMS topics.
  • I'll be assigning homework, too, lest yee not fall asleep
• I'll end up with an integrated, hybrid platform for secure productivity and management
• These are pretty bold ambitions – but we'll get there, and the beauty of the cloud services model is that "getting there" isn't nearly as hard as that list makes it seem.

Now let's get down to brass tacks. For the rest of this post, I'll focus on considerations, planning and pre-reqs for getting Azure AD Connect up and running and then I'll walk through the setup and configuration of AD and AAD Connect to integrate an on-prem AD forest with an on-line AAD tenant.

• If you already have AAD Connect up and running, KUDOS! Read-on, though, as you might find some helpful tips or details you weren't aware of or didn't consider.

NOTE – As with most blogs, this isn't official, sanctioned Microsoft guidance. This is information based on my experiences; your mileage may vary.

Overall AAD Connect Planning

Microsoft has done a lot of work to gather/list pre-reqs for AAD Connect. Save yourself some avoidable heartburn; go read them … ALL of them:

• https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites
  
  

  NOTE: one pre-requisite listed is having an Azure AD tenant. Production or trial is fine; there just has to be an Azure AD "directory" established before you'll get very far.
  

AAD Connect has two install options to consider – Express and Custom: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-select-installation

• The Express install of Azure AD Connect can get you hybrid-enabled in around 4 clicks. It's easy and simple - but not very flexible. Express setup requires an Enterprise Admin credential to perform all of the AD changes and you don't have a lot of control over those changes (i.e. naming service accounts, where in AD they go, which OUs get permissions changes, etc).

• The Custom install of Azure AD Connect provides more flexibility, such as allowing you to pre-create the service accounts (per your AD naming/location standards) as well as assign scoped AD permissions as part of the pre-work before installing AAD Connect.
  • The Custom setup option of AAD Connect is what I'm covering here
    
  • https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-get-started-custom

Consider AAD Connect 'Automatic Upgrade' to keep AAD Connect up-to-date automatically:

• https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-feature-automatic-upgrade

Service accounts

AAD Connect uses a service account model to sync objects/attributes between AD and AAD. There are two service accounts needed on-prem (one for the sync service/DB and one for AD access) - and one service account needed in AAD.

• https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-accounts-permissions

Service account details:

• Sync service account - this is for the sync service and database
  • I recommend letting the AAD Connect setup process create a 'virtual' service account, locally, on the AAD Connect server
    • https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-accounts-permissions#virtual-service-account

• AD access service account - this is a Domain User in the AD directory(ies) you want to sync.
  • An ordinary, low-privilege Domain User AD account with read access to AD is all that is needed for AAD Connect to sync AD to AAD for basic activities.
  • There are notable exceptions that require elevated permissions and two I'll cover here are password hash sync and password writeback (for self-service password reset/account unlock)
    • Password hash sync
      • Set permissions at the domain head/object and applied to "all descendant objects"
      • "Replicate Directory Changes"
      • "Replicate Directory Changes All"
    • Password writeback
      • These permissions can/should be scoped to only the OUs where sync'd users are
        
      • Apply to "Descendant User objects"
      • Permissions –
        • "Change Password"
        • "Reset Password"
      • Read/Write to the properties –
        • "lockoutTime"
        • "pwdLastSet"
      • https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-getting-started#step-4-set-up-the-appropriate-active-directory-permissions
  • Review this security advisory to ensure any custom AD permissions are scoped/applied properly - https://technet.microsoft.com/library/security/4056318

  TIP - Create your AD access service account in AD and assign any custom permissions to it BEFORE you install AAD Connect.

  TIP - This account itself doesn't need to sync to AAD and can/should reside in a 'Service Account' OU, with your other service accounts, filtered from sync.

  TIP – Make sure you secure, manage and audit this service account, as with any service account.

• AAD cloud access account
  • This is a limited, cloud-only account in Azure AD, created by the AADC install process, which sets a long, complex password that is set to not expire.

  TIP - The username of this account is derived from the AAD Connect server name

  • For example, my AAD Connect server is named "CORP-AADC01" so the AAD service account ID will be something like "Sync_CORP-AADC01_1@mycorp.onmicrosoft.com"

  TIP – This account won't be seen anywhere in AD; it's only part of AAD and the sync system. You can see it in the configuration pages of the Synchronization Service Manager tool - screen snip below.

  • The Synchronization Service Manager tool is sometimes used for advanced sync settings and is out of scope for this article; I strongly urge you to not wander around in there.

  TIP - The ID can also be seen in the AAD portal 'Users' section.

  
  

Planning on-prem sync filtering

You can limit what users, groups, contacts and devices are sync'd between on-prem AD and Azure AD. This is known as 'filtering' and can be done based on forest, domain, OU or even object attribute values. Also, for a pilot or PoC, you can filter only the members of a single AD group.

TIP – Thoroughly plan/test a sync filtering strategy to understand what will/won't sync. In prod, do it once; do it right.

Read this link for more information/details about sync filtering:

• https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-configure-filtering#organizational-unitbased-filtering

Points to consider:

• Not everything in AD is sync'd, even if you don't filter –
  • For example, DNS zones don't get sync'd. GPOs don't get sync'd. Objects with the "isCriticalSystemObject" attribute equal to "true" won't sync – so many sensitive AD objects won't sync (i.e. Domain Admins group in AD)
  • However, unless filtered, some objects may sync that you don't need/want in AAD (i.e. the DNS Admins group in AD, your service account OU, etc.)
• Any OU that has/will have Windows 10 PCs that you want to register/sync to AAD (called 'Hybrid Azure AD Join') should be selected for sync, as Azure AD Connect plays a part in sync'ing Win 10 PCs to Azure.
  • Azure AD Connect does not play a part in sync'ing pre-Win 10 PCs; they can sync/register in AAD on their own (after you install an update/MSI to those OSes), regardless of their OU being targeted or not
  • We'll get into the weeds of Hybrid Azure AD Join, AAD Join and Azure Device Registration Service in a later post
• For a pilot, you can simplify what gets sync'd by selecting a single group in AD to sync
  • Use a "flat" Global Security group in AD; any nested groups within it won't sync
  • If you also setup OU filtering, be sure the target group and its members (users, Windows 10 PCs, etc.) are all in OUs that are in-scope for sync – OU filtering is evaluated before the group filter.
  • You can't browse for the group via the wizard – you need to type in the group name or DN attribute (the 'resolve' button will verify it, though)
  • The UI option to filter by group only appears in the initial setup of AAD Connect. If you don't select it during the first run, it won't show up in the UI in subsequent runs of the tool.

  TIP – Group-filtered sync isn't supported for production implementations

• New OUs/subOUs that are created after you've setup your sync filtering in AAD Connect may be sync'd by default. If so, this may be an unwelcome surprise.
  • I'll cover more on this later in the AAD Connect configuration section

UPNs and email addresses – should they be the same?

In a word, yes. The best experience for your users (seamless SSO with minimal login prompts or pop-ups/sign in errors, etc.) will be achieved when the on-prem UPN matches the AAD UPN, as well as the primary email address (and SIP address for overall consistency). This assumes there is an on-prem UPN suffix in AD that matches the publicly routable domain that your org owns (i.e. ... @microsoft.com).

"Ok, but is it required?" No, but over time, it will make lives better with less confused users who make fewer helpdesk calls and are happier with IT.

Points to consider:

• Recall the pre-requisites doc/link – it lists a line-item to add any custom domain(s); go through the process to add and 'verify' your public domain names (called 'custom' domains in O365/AAD) before setting up AAD Connect. There is a step during AAD Connect setup that will poll on-prem AD for UPN suffixes and AAD for matching verified custom domains. This is visible in my step-by-step later.
  • https://docs.microsoft.com/en-us/azure/active-directory/add-custom-domain
    
• To avoid additional work and potential issues, it is strongly recommended that you address UPN/ID issues BEFORE you install AAD Connect

AAD Connect – Install and configuration

I basically break this phase up into three sections:

1. AAD Connect server setup/tools install
2. On-prem AD config
3. Initial sync config
4. AAD Connect server setup and Tools Install
   
   1. On my AAD Connect server (these steps are for a WS 2012 R2 x64 instance – again, read all the AAD Connect pre-reqs from the link above; your specific steps may vary):
      1. Disable IE Enhanced Security Config and enable Cookies in the IE browser settings
      2. Install the RSAT AD tools – via Server Manager or PowerShell <from elevated PoSh>
         1. Add-WindowsFeature RSAT-AD-Powershell
      3. Download and update to WMF 5.0 then install AAD PowerShell v1
         1. https://www.microsoft.com/en-us/download/details.aspx?id=50395
            1. Reboot
         2. Open elevated PowerShell and run Install-Module -Name PowerShellGet -Force
         3. From same PowerShell console, run Install-Module -Name MSOnline
      4. Download AAD Connect (AzureADConnect.msi) and install it on the target AAD Connect server
         1. https://www.microsoft.com/en-us/download/details.aspx?id=47594
      5. As soon as the install completes, the AAD Connect configuration wizard will auto-initiate – don't run through it; exit/close out of the tool/wizard.
      6. The AAD Connect setup installs the sync service and several pre-reqs, and copies some PowerShell scripts/functions locally
5. On-prem AD config
   
   1. Prepare on-prem AD for Azure AD integration (I'll also initialize AD for Azure AD Device Registration Service – AzDRS)
      1. Use PowerShell to establish the Service Connection Point (SCP) object and associated attributes in AD - More info
      1. This process creates an object in on-prem AD with pointers to the associated on-line AAD tenant name and GUID – this information is used by several AD <-> AAD integrations such as AAD device registration, device write-back, etc.
         1. For example, this information is used by Windows domain-joined PCs to "find" the connected AAD tenant and register there (aka "Hybrid Azure AD Join.")
      2. From the AAD Connect server:
         1. Run a PowerShell window as an Enterprise Admin account (this process needs to create a container in the Configuration partition in the AD forest):
         2. Import-Module -Name "C:Program FilesMicrosoft Azure Active Directory ConnectAdPrepAdSyncPrep.psm1" <press enter>
            
         3. Initialize-ADSyncDomainJoinedComputerSync <press enter>
            
         4. PowerShell will prompt for AdConnectorAccount : enter the AD access service account and press enter
            
            1. The format is "domainID" - CORPSRV-AADC
               
         5. A logon box will pop-up; enter the AzureADCredentials
            
            
            1. This should be a Global Admin ID from Azure AD
               
            2. The format is upn-style - admin@woodgroove.onmicrosoft.com
               
      3. Verified results:

1. Review/verify/edit the AD access service account has permissions for the desired Azure AD services/features (see above Service Accounts section)
   1. Remember, password hash sync and self-service password reset (SSPR) each require unique manual permissions edits in AD    
      
      1. This is a commonly missed step or not done correctly

TIP - You can enable SSPR/pwd writeback without enabling password hash sync; you can offer your users self-service password reset even if you're not ready to sync passwords to Azure AD.

1. Initial Sync config
   

   Let's take a breath, pause and recap: AAD Connect is installed and several on-prem decisions and configurations have been completed (sync filtering decisions, service accounts created, custom permissions assigned, 'Service Connection Point' container created and verified in AD, etc.).
   

   1. Next, I establish the core AD > Azure AD sync configuration and start actually sync'ing objects to AAD.
      1. From the AAD Connect server, launch the AAD Connect tool/wizard, agree to the license terms checkbox and click 'Continue.'
      2. We're doing 'Customize' (vs 'Express') for the reasons mentioned above (i.e. more flexibility in creating/naming/locating the service accounts)
      1. On the "Install required components" screen, leave all boxes blank – AAD Connect will setup the sync service and a 'virtual' service account on the AAD Connect server. This ID and password are system-managed and won't require any on-going management. Click 'Install.'
      1. Next, select the User sign-in/authentication method. My thinking has evolved over time on this aspect. I started out favoring federation with ADFS and on-prem passwords/auth, then I moved on to "Pass-through authentication" (PTA) and on-prem passwords/auth (I still really like PTA if there's a need to keep password hashes on-prem).

         However, now I've seen the light and "Password Synchronization" is my preferred choice. This is by far, the simplest solution and I'm comfortable w/ the security of password hash sync/storage. This is usually referred to as 'password hash sync' or PHS since AAD Connect takes the on-prem password hash value, processes it with additional hashing, then syncs that value to AAD. Also, with PHS, I get more complete coverage from the AAD Identity Protection capability and Azure-cloud levels of high-availability.

         Here's a great blog about the auth choices and decision: Sam D's auth choice blog.

         1. Also select the check box to "Enable single sign-on"
      1. On the "Connect to Azure AD" screen, enter an Azure AD global admin account (which isn't saved; it's only used during setup). Use a cloud-only ID from the tenant – i.e. admin@mycorp.onmicrosoft.com. This sets up the Azure AD tenant for sync and creates the AAD cloud access service account mentioned above in the service accounts section.

1. On the "Connect your directories" screen, select/verify the target AD forest(s) and click "Add Directory" then select to "Use existing AD account." Enter the AD access service account credentials (from the above service accounts section) and click OK, then click Next.

TIP – You don't select the specific domains/OUs you want to sync here; that's done in a later step

1. Review/select the Azure AD sign-in configuration - hopefully keeping the default which sets the on-prem UPN value as the login ID for Azure AD.

TIP – In the long red box above, you see I have a UPN suffix in AD that matches a verified custom domain name that I registered in my AAD; this is due to the pre-work that I mentioned in the UPN section above.

TIP - If you haven't verified a custom domain, you'll see an option to 'Continue without any verified domains' (i.e. for a test or PoC environment)

1. On the "Domain and OU filtering" screen, select "Sync selected domains and OUs" and select the domains/OUs to sync - or select "Sync all domains and OUs" if that's how you want to roll.
   1. Remember, even if an entire forest/domain is selected, not everything in the domain will sync.

Repeated TIP – Thoroughly plan/test a sync filtering strategy to understand what will/won't sync. In prod, do it once; do it right.

TIP – As mentioned above in the sync planning section, recall that as/if new OUs/subOUs are created, they might be sync'd to AAD automatically.

Here's how to adjust your sync settings to control new OU sync:

The checkbox "state" in this UI indicates if new OUs will sync or not:

1. If you DO NOT want subsequent new sub OUs to sync (my personal preference), clear all the check marks then click the deepest level, specific OU boxes you want to sync. The parent domain and OU box(es) will flip to solid gray, without a checkmark
   1. In this state:
      1. Only the selected OUs under CORPORATE will sync (white box with black checkmark)
      2. New OUs created anywhere will not sync

   1. If you DO want subsequent new sub OUs to sync, click the parent domain/OU box so it has a black checkmark (all sub-OUs will also get checked). Now, de-select the sub OU box(es) you don't want to sync, leaving the desired OUs checked. The parent OU box will turn gray with a black checkmark.
      1. In this state:
         1. The selected OUs under CORPORATE will sync (white box with black checkmark).
         2. New sub OUs created under the corp.contoso.lab domain and/or the CORPORATE OU will sync

   2. You can also configure a mixed state:
      1. In this state:
         1. New sub OUs created directly under corp.contoso.lab will not sync (gray box without black checkmark)
         2. The selected OUs under CORPORATE will sync (white box with black checkmark).
         3. New sub OUs created under the CORPORATE OU will sync (gray box with black checkmark)

         Example:

• New 'Sync-Test-OU' was created in AD.
• The new 'Sync-Test-OU' was added to sync filtering without making any changes to AAD Connect

TIP – Recapping:

• White box without checkmark – won't sync
• White box with black checkmark – will sync
• Gray box without checkmark – new sub OUs won't sync
• Gray box with black checkmark – new sub OUs will sync

1. Review the unique identifier page for the sync configuration – the default is fine for my setup. Click Next.

2. On the "Filter users and devices" screen, choose 'Synchronize all users and devices'

TIP – Even though the UI states this will synchronize all users and devices, that isn't really what happens. This option will sync all users, groups, contacts and Win 10 computer accounts "within the scope of any filtering you defined."

1. If you decided earlier that you want to use group filtering for sync (i.e. for a PoC), you choose 'Synchronize selected' here and enter the group name or DN and click 'resolve' to verify it.
   1. If you don't see this screen or if you are considering this, review the above details about group filtering – it is a common area of confusion and unexpected results/behavior.

On the "Optional features" screen, verify all "Optional features" except Password synchronization are blank and click Next.

• The "Password synchronization" option is checked and grayed out due to the earlier selection of "Password synchronization" for User sign-in.

1. On the "Enable single sign-on" screen, click 'Enter credentials' then enter Domain Admin credentials for the domain(s) where your SSSO users reside (don't be confused like I was when the pop-up asked for "Forest Credentials" – it's asking for a Domain Admin ID).
2. Click OK. Then click Next.
   1. This step creates a computer account called "AZUREADSSOACC" and puts it in the built-in COMPUTERS container in the target domain(s).
   2. Don't pre-create this account – let AAD Connect do it, as it populates some specific attributes/values for this computer account.
      1. You can move the computer account to an OU of your choice and I'd recommend you configure it for protection from accidental deletion (right-click > properties > object tab).

3. On the "Ready to configure" page, verify the 'Start the synchronization process…' option is checked (default) and click 'Install.' Click Exit after the 'Configuration complete' page displays.

4. Review the Application Event Log on the AAD Connect server for related events.

5. Sign in/refresh the Azure/AAD portal
   1. Verify sync by looking for your targeted on-prem objects in AAD and review the Azure AD Connect section of the Azure/AAD portal for successful sync messages.
      1. On-prem users sync'd are listed with a 'SOURCE' of 'Windows Server AD'
      2. On-prem groups sync'd are listed with a 'Membership type' of 'Synced'

TIP - Subsequent delta synchronizations occur approx. every 30 min (and every 2 min the password hash sync process runs, if you've enabled it); previous versions.

TIP - You can easily trigger a sync via PowerShell at any time. I use a quick one-liner straight from the 'Run' dialog box on my AAD Connect server after making on-prem AD changes that I want to sync right away:

powershell –ExecutionPolicy Bypass Start-AdSyncSyncCycle

TIP – To avoid surprises with Automatic Upgrade of AAD Connect, now is a good time to review/verify the state of it for your AAD Connect via PowerShell:

Get-ADSyncAutoUpgrade

• https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-feature-automatic-upgrade

HOMEWORK – Go school yourself about AAD Connect Health – I think you'll like it

• https://docs.microsoft.com/en-us/azure/active-directory/connect-health/active-directory-aadconnect-health

If you're a visual person, like me, here's where we are on our plan:

Ok folks, there you have it … a brief refresher on AAD as the ID hub of our modern productivity and security platform, a sizeable collection of "points to consider" when planning AD sync and then a walk-through of setting up AAD Connect to hybrid-enable a sample Active Directory forest.

Hopefully, that level of detail was helpful.

Tune in next time when I'll continue the march towards 'hybrid-excited.'

Cheers!

"Welcome back, (Hilde) Kotter"

P.S. Did anyone catch how the title of this post pays homage to the awesome movie "Remo Williams: The Adventure Begins"?

皆さん、こんにちは。
Windows サポート チームです。

今回は、弊社で把握している Windows Server 2012 R2、及び、Windows Server 2016 において、同時に大量の WMI クエリーを発行した際に発生する可能性のあるアプリケーション エラーについてご紹介します。

Windows Management Instrumentation (WMI) はシステムの管理情報を操作、参照するためのインターフェースを提供している Windows OS の基幹となるサービスです。
そのため、サーバーやクライアントの監視を行っているアプリケーションでは、WMI サービスを使用して管理情報を収集されていることが多いかと思います。

同じ WMI クラスに対する WMI クエリーが同時、かつ大量 (目安としては 50 ほど) に発行されると、WmiPrvSE.exe がアプリケーション エラー (イベント ID: 1000) に至ってしまう可能性があります。

※例外コードが 0xc00000fd と異なるアプリケーション エラーの場合は、本事象には該当しません。

WMI クエリーが発行されると、WMI クラスに対応したプロバイダーをロードしている WmiPrvSE.exe 内のキューにリクエストが追加されていきます。
そして、WmiPrvSE.exe がキューに追加されたリクエストを順次処理します。
しかし、WmiPrvSE.exe が 1 つあたりのリクエストを処理する速度よりも、キューにリクエストが追加されていく速度が上回ってしまった場合、キューにリクエストが増え続けてしまい、スタック オーバーフローの例外 (0xc00000fd、STATUS_STACK_OVERFLOW) が発生し、アプリケーション エラーに至ります。

例として、弊社では以下の手順でスタック オーバー フローが発生することを確認しております。

1. 下記スクリプトを Ps1 ファイルとして保存します。

while(1){
gwmi -query "select * from Win32_TerminalService"
}

2. 作成したスクリプトを複数の PowerShell 上で実行します。

3. スクリプトを実行し続けるとエラーが発生し始めます。

4. エラー発生時のイベントを確認すると、スタック オーバーフローの例外 (0xc00000fd、STATUS_STACK_OVERFLOW) が発生しています。

本事象については、次期バージョンでの改善を検討中です。
現時点で本事象を回避するためには、同時に発行される WMI クエリーの数をご調整ください。

Applies to:

Windows 10 1803 ((tbd))

Windows 10 1709 (Fall Creators update)

Windows 10 1703 (Creators update)

Windows 10 1607 (Anniversary update) / Windows Server 2016

Windows 10 1511 (November update)

Windows 10 1507 (RTM)

[Problem description]

• Start Menu does not work at all.
• Start Menu (and cortana) will become unresponsive, leaving users without a working Start Menu

Q:  Moving forward we can no longer expect CopyProfile to set the Start Layout, pined Items and customized backgrounds? Is that correct?

A:  That is correct.  "The Start Menu Product Group does not support customizing the Start layout with copyprofile."

“Using CopyProfile for Start menu customization isn't supported. Here are the ways to manage custom Start layouts in Windows 10:

• OEMs can use layoutmodification.xml. See Customize the Start layout for more information.
• IT pros can use the following resources learn about managing the Windows 10 Start Menu:
  • Customize Windows 10 Start and taskbar with Group Policy
  • Windows 10 Start Layout Customization”

Source:

Customize the Default User Profile by Using CopyProfile
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile

Q:  Are other portions of CopyProfile still supported in Windows 10?

A:  Yes, everything in CopyProfile except the “Start Menu” and “Taskbar” layout are supported in Windows 10.

[Solution]

Q:  What’s the alternative to customize the “Start Menu” during a deployment or imaging?

A:  Use the Group Policy:

User or Computer / Administrative Templates/Start Menu and Taskbar/Start Layout

Source:

Configure Windows 10 taskbar

Manage Windows 10 Start and taskbar layout

Pimp my Windows 10 – Business Customization Reference

https://blogs.technet.microsoft.com/ash/2016/03/07/pimp-my-windows-10-business-customization-reference/

Q:  How does it work?

A:  Import-Startlayout modifies the default user profile. All new users that login after import-startlayout has been run will get the new StartLayout.

Q:  I want to be able to 'force' some items to be pinned but I also want my end-users to be able to customize their own apps in the Start Menu.

A:  To be able to get the end-users to pin their own Start-menu items, there is a ‘Partial Lockdown’ where you need to specify “OnlySpecifiedGroups”

Locate the <DefaultLayoutOverride> section and add a parameter as detailed below.

<DefaultLayoutOverride LayoutCustomizationRestrictionType=”OnlySpecifiedGroups”>

Source:

Customize and export Start layout
https://docs.microsoft.com/en-us/windows/configuration/customize-and-export-start-layout

Windows 10 Start Layout Customization

https://blogs.technet.microsoft.com/deploymentguys/2016/03/07/windows-10-start-layout-customization/

Yong (Hailing from Baton Rouge, Louisiana).

Applies to:

Windows 10 1803 ((tbd))

Windows 10 1709 (Fall Creators update)

Windows 10 1703 (Creators update)

Windows 10 1607 (Anniversary update) / Windows Server 2016

Does not apply to:

Windows 10 1511 (November update)

Windows 10 1507 (RTM)

While I was in Oxnard, California. the following topic came up.

Before you read this, you want to make sure that you go through:

Demystifying “Dual Scan”

https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/

Improving Dual Scan on 1607

https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/

Using ConfigMgr With Windows 10 WUfB Deferral Policies

https://blogs.technet.microsoft.com/configurationmgr/2017/10/10/using-configmgr-with-windows-10-wufb-deferral-policies/

Once you have read the 3 blog post above, continue for this particular issue.

[Problem description]

If you have “Windows 10 1607” deployed in Semi-Annual Channel (used to be known as (u.t.b.k.a) Current Branch for Business (CBB)).

And have:

• WSUS set to not deploy “Windows 10 1703” or “Windows 10 1709”.
• According to Improving Dual Scan on 1607, KB4034658 (August 2017 Cumulative update) introduces a new GPO ("Do not allow update deferral policies to cause scans against Windows Update").

https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/

And if you have the October 2017 Cumulative update KB4041691 installed.

And these other hotfixes:

KB3186568

KB4013418

KB4023834

KB4033637

KB4035631

KB4038806

KB4051613

• And we have set the "Do not allow update deferral policies to cause scans against Windows Update" in the registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate]

"DisableDualScan"=dword:00000001

Expectation:

              When going to “Windows Update”

              When clicking on “Check online for updates from Microsoft Update”

              Result:

To not see “Feature Update to Windows 10, 1703” being offered.

Result:

              “Feature Update to Windows 10, 1703” is being offered.

[Cause]

Why? 

Windows 10 1607 allows deferment of the feature update for 180 days.

You can only defer up to 180 days prior to version 1703.

You are falling under this below with the manual/adhoc scans against MU:

“Windows updates from WSUS, supplemental updates from WU - the "on-premises" scenario. Here you expect your users to perform ad hoc scans every so often to get updates that are necessary, but have not been deployed by the enterprise admins. You want quality updates, but do not want feature updates offered during these scans. The policy to disable Dual Scan was created for this scenario: you can enable the new policy, along with your deferral policies, and those deferral policies will only take effect when scanning against Windows [or Microsoft] Update.”

How can you check if DualScan is set?

              Powershell (Run As Admin)

$MUSM = New-Object -ComObject “Microsoft.Update.ServiceManager”

$MUSM.Services 

IsDefaultAUService

True for "Windows Server Update Service"

False for "Windows Update"

then the following could be causing it:

HKLMSoftwareMicrosoftWindowsUpdateUXSettingsDeferUpgrade=1

// Was not set.

And/or

HKLMSoftwareMicrosoftWindowsUpdateUXSettingsBranchReadinessLevel=32

// Was not set.

Source:

Configure Windows Update for Business

https://docs.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb

Why this could be a problem?

· If you are using a 3^rd party encryption, thus, when this is deployed w/o the ‘/reflecteddrivers’ switch and the ‘compatible’ 3^rd party encryption upper filter drivers, it can bricked your system.

· They have in-house apps that are not yet “Windows 10 1703” ‘compatible’, thus need additional time before you upgrade.

[Solution]

Blocking access to “Windows update” via:

• Computer ConfigurationAdministrative TemplatesSystemInternet Communication ManagementInternet Communication settingsTurn off access to all Windows Update features

or

• User ConfigurationAdministrative TemplatesStart Menu and TaskbarRemove links and access to Windows Update

Note:

• Windows UI

  • HKLMSoftwareMicrosoftWindowsUpdateUXSettings
• Group Policy
  • HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdate
• MDM (CSP by SCCM 1706 WUfB policy, Intune, or other MDM Providers)
  • HKLMSoftwareMicrosoftPolicyManagercurrentdeviceUpdate

What do you lose if you disable “Windows Updates”?

· Update drivers (e.g. Print drivers, etc…)

· Universal apps (Windows Store apps)

Thanks.

Yong

Applies to:

Windows 8.1/Windows 2012 R2

Windows 8/Windows 2012

Windows 7 SP1/Windows 2008 R2 SP1

Windows Vista/Windows 2008

Does not apply to:

Windows 10 1803 ((tbd))

Windows 10 1709 (Fall Creators update)

Windows 10 1703 (Creators update)

Windows 10 1607 (Anniversary update) / Windows Server 2016

Windows 10 1511 (November update)

Windows 10 1507 (RTM)

I was on-site this year (2018) and I had heard the following:

"We don’t always install hotfixes; We install hotfixes if that specific problem is experienced in the environment. Security and Critical patches take precedence and, in the case of servers, are usually the only update classification we install. KBxxxxxx is entirely optional and doesn’t show up in the WSUS catalog, another reason why we never caught wind of it."

Regarding item #1: "We install hotfixes if that specific problem is experienced in the environment".

Answer #1:  The truth is, you probably have the issue, and just haven’t gotten to it.  It requires a lot of time investment by using advanced tools such as Sysinternals/ETL tracing (WPRUI/WPR/Xperf), WinDbg (or DebugDiag)/Message Analyzer (or Wireshark or Netmon) and other logs.  Or you are understaffed and are not able to take the time to fix the issue.

A lot of companies just end-up rebooting the system or rebuilding the system(s).

Regarding item #2: "Security and Critical patches take precedence and, in the case of servers, are usually the only update classification we install."

Answer #2:  Probably the reason that your servers are not 'stable'.

Recommended hotfixes and updates for Windows Server 2012 R2-based failover clusters

https://support.microsoft.com/en-us/help/2920151/recommended-hotfixes-and-updates-for-windows-server-2012-r2-based-fail

Recommended hotfixes and updates for Windows Server 2012-based failover clusters

https://support.microsoft.com/en-us/help/2784261/recommended-hotfixes-and-updates-for-windows-server-2012-based-failove

Recommended hotfixes and updates for Windows Server 2008 R2 SP1 Failover Clusters

https://support.microsoft.com/en-us/help/2545685/recommended-hotfixes-and-updates-for-windows-server-2008-r2-sp1-failov

Recommended hotfixes for Windows Server 2008-based server clusters

https://support.microsoft.com/en-us/help/957311/recommended-hotfixes-for-windows-server-2008-based-server-clusters

List of currently available hotfixes for the File Services technologies in Windows Server 2012 and in Windows Server 2012 R2

https://support.microsoft.com/en-us/help/2899011/list-of-currently-available-hotfixes-for-the-file-services-technologie

List of Domain Controller Related Hotfixes Post RTM for Windows 8.1 and Windows Server 2012 R2 (Part 2)

https://social.technet.microsoft.com/wiki/contents/articles/26177.list-of-domain-controller-related-hotfixes-post-rtm-for-windows-8-1-and-windows-server-2012-r2-part-2.aspx

etc...

Regarding item #3: KBxxxxxx is entirely optional and doesn’t show up in the WSUS catalog

Answer #3:  Yes, and hopefully you were getting the RSS feeds regarding the newly released (non-security and security) hotfixes:

Most recent hotfixes RSS feed.

https://blogs.technet.microsoft.com/yongrhee/2013/06/27/most-recent-hotfixes-rss-feed/

For example, if there was a "Service Pack 3" for Windows 7 SP1 and Windows Server 2008 R2 SP1, would you have not installed it?

“Enterprise” Convenience Rollup Update II (2) for Windows 7 SP1 and Windows Server 2008 R2 SP1

https://blogs.technet.microsoft.com/yongrhee/2016/05/20/enterprise-convenience-rollup-update-ii-2-for-windows-7-sp1-and-windows-server-2008-r2-sp1/

All of that lead to:

Further simplifying servicing models for Windows 7 and Windows 8.1

https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/

More on Windows 7 and Windows 8.1 servicing changes

https://blogs.technet.microsoft.com/windowsitpro/2016/10/07/more-on-windows-7-and-windows-8-1-servicing-changes/

Regarding item #4: But the KB article has the following statement:

"A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem."

Answer #4: It's a 'boiler' template.  A lot of times, the same binary has been updated multiple times.

Let me give you a real world example.  A Premier opened a case due to their server bugchecking (a.k.a. BSOD), they got a non-security update created for them.  The company was big enough and segmented enough, that their peers opened 11 more cases with the same bugcheck and the fix was the same.  So why wouldn't you have deployed it to all the server in the environment?

Q:  How do I roll these fixes out?

A:  Like you would have done in the past when you were doing a “Service Pack”.  Target the IT folks first.  Then try a few of your power users in each department in your company.  Never have your C-Level executives test, unless you want to spend time working on executive escalations.  And then continued with the phased deployment.

[Solution]

In Windows 10 and Windows Server 2016 and newer, that is why Windows As A Service (WaaS) is there.

You get all the "Security updates" and "Non-security update" via the cumulative rollup.

Overview of Windows as a service

https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview

Quick guide to Windows as a service

https://docs.microsoft.com/en-us/windows/deployment/update/waas-quick-start

Back in December, a new build of MDT was released.  Continuing the pattern established with the release before it (8443), it’s identified only by its build number, hence it’s called MDT 8450.  As Aaron detailed in the announcement blog at https://blogs.technet.microsoft.com/msdeployment/2017/12/21/mdt-8450-now-available/, this release is primarily for compatibility with the latest ADK, Windows 10, and ConfigMgr releases, and includes fixes for a variety of bugs (with the full list included).

Here’s a quick rundown of every change made to the MDT scripts and templates for those that are curious:

• Templates:

• SCCM_Client.xml.  Changed the UEFI recovery partition size from 300MB to 499MB to make sure it’s big enough (same as what MDT was already using for Lite Touch).
• SCCM_Server.xml.  Changed the UEFI recovery partition size from 300MB to 499MB to make sure it’s big enough (same as what MDT was already using for Lite Touch).

• DeployWiz_ProductKeyVista.vbs.  Fixed logic that caused an “invalid deployment type” error.
• LiteTouch.wsf.  Fixed a variety of logic related to LTI Windows 10 upgrade task sequences (which also fixed an issue related to autologon after a reboot prior to the upgrade).
• LTIApply.wsf.  Changed the BCDBOOT logic to always run it the same way for UEFI devices, regardless of the OS version, to address some boot-loop issues on bare metal UEFI deployments on some devices.
• LTICleanup.wsf.  Inconsequential changes (line alignment).
• ServerManager.xml.  Fixed component names that prevented the installation of Windows Media and IIS Management Console features on Windows Server 2016.
• SetupComplete.cmd.  Fixed logic related to the changes in LiteTouch.wsf for Windows 10 upgrade task sequences.
• SetupRollback.cmd.  Ditto.
• ZTIBde.wsf.  Changed the BitLocker pre-provisioning logic to not try to do anything with the TPM while in Windows PE, to avoid putting the TPM into a reduced functionality state.
• ZTIGather.wsf.  Added some new chassis types (30, 31, 32 for laptops; 35 and 36 for desktops; 28 for servers).
• ZTIMoveStateStore.wsf.  Fixed the logic that moved the state store so that it didn’t use a hard-coded StateStore folder location.
• ZTIOSRole.wsf.  Fixed the logic so that it works for multiple calls to get the source location.
• ZTIUtility.vbs.  Fixed logic to ignore disabled “Install Operating System” steps (caused problems with some types of task sequences).

Additionally, all the standalone task sequencer binaries (used to run LTI task sequences) were updated to the latest code from ConfigMgr.

So, it’s a very minor update overall.  If you have existing task sequences created with MDT 8443, you shouldn’t need to recreate them, although if you have ConfigMgr task sequences you might want to edit the “Format and Partition” UEFI steps to specify 499MB instead of 300MB for the recovery partition size.

And as always, back up your deployment share before upgrading (especially if you’ve made any script edits), reintegrate your changes if needed, and make sure you update your boot images (including on WDS, USB boot media, boot ISOs, etc.) as mismatched versions will cause all sorts of problems.

Wes Hammond here from Premier Field Engineering.  It has been a while since I posted anything, but I wanted to step back into the spotlight to talk a little bit about something a few customers have been asking about lately.  How will Certificate Transparency affect their Active Directory Certificate Services environments?  Well, here are your answers…

Before we get started, here is a little bit of information about Certificate Transparency that is relevant to this article.  CT is being applied to certificate authorities that chain to a Public/Commercial Root Authority to detect fraudulent certificates used for HTTPS purposes.  Many public certificate authorities have already been reporting to the CT logging servers for some time now.  How it works is beyond the scope of this document and I would recommend you read the information located at the site linked to at the bottom of this article.

CT in Browsers

Google is scheduled to enforce CT in Chrome browsers on April 30^th 2018 for certificates issued after April 1^st 2018.

CT in Private PKI (CA's that DO NOT chain to a public Root)

I am going to start with the most common scenario.  Most of you have a private PKI within your organization that does not chain up to a public root.  In this scenario, CT will not affect your CA's.  Chrome browser uses Windows native CAPI to determine trusted chains.  Windows can differentiate between commercial/public CA chains and internal/private chains.  Since Windows has this ability, CT will not affect Private/Internal PKI chains.

CT in Certificate Chains that DO chain to public Root

"IF" your certificate authority chains up to a public root and you issue SSL/TLS/HTTPS certificates, CT may affect your PKI.  How it affects you is beyond the scope of this article, and I would recommend you consult your provider for more information.

Other Certificate Purposes

As I mentioned earlier, CT is only relevant to certificates used for HTTPS.  All other certificate purposes such as smartcard logon, code signing, document signing, SMIME, any many others are not visible through Chrome browsers and thus are not affected, so rest easy

For more information on Certificate Transparency see the official site on it here: https://www.certificate-transparency.org/

If you liked this blog please don't forget to rate it.

Windows Server 2016 üzerinden çalışan WSUS sunucunuza Windows Update Catalog üzerinden bir update import etmek istediğinizde aşağıdaki hata mesajını alabilirsiniz.

"This update cannot be imported into Windows Server Update Service because it is not compatible with your version of WSUS"

WSUS konsolunda "Import Update" bağlantısına tıkladığınızda Internet Explorer penceresi açılarak sizi aşağıdaki gibi bağlantıya yönlendirecektir.
http://catalog.update.microsoft.com/... &Protocol=1.20
Yapmanız gereken yukarıdaki adresin sonundaki versiyonu aşağıdaki gibi değiştirmek
http://catalog.update.microsoft.com/... &Protocol=1.8

Bu durum bilinen bir sorun ve gerekli fix çıkana kadar bu çözümü kullanabilirsiniz.

Find resources that help you build and sustain a profitable cloud business, connect with customers and prospects, and differentiate your business. Read previous issues of the newsletter and get real-time updates about partner-related news and information on our US Partner Community Twitter channel.

Subscribe to receive posts from this blog in your email inbox or as an RSS feed.

Looking for partner training courses, community calls, and information about technical certifications? Read our MPN 101 blog post that details your resources, and refer to the Hot Sheet training schedule for a six-week outlook that’s updated regularly as we learn about new offerings. To stay in touch with us and connect with other partners and Microsoft sales, marketing, and product experts, join our US Partner Community on Yammer.

Top stories

New posts on the US Partner Community blog

• What’s new in IaaS?
• Learn how to integrate Blockchain with Microsoft Dynamics 365
• Modern Workplace Quarterly Update
• The March Insider Call is right around the corner!
• Get to know your Microsoft Partner Network (MPN) enablement and support benefits
• March 2018 Hot Sheet partner training schedule
• Microsoft Inspire is in Las Vegas, Nevada from July 15–19, 2018
• Demystifying Digital Partner of Record
• Lift and shift your data to the cloud!
• Follow these steps to demonstrate proof of execution and receive the incentives you earned
• Windows Autopilot Deployment
• Update your Microsoft partner profile to improve your Microsoft partner experience
• Taking the Shadow out of “Shadow IT”
• Modernize your customer’s legacy applications
• How to expand your Dynamics Revenue with Azure Services
• US Partners: Register now for Microsoft Inspire 2018 before the price increases on March 1 by $300 USD!
• Firstline Worker opportunities for Office 365 Partners
• Join your February SMB Partner Insider call
• February 2018 Hot Sheet partner training schedule

New on demand videos

• March 2018 Modern Workplace Partner Community Call – Quarterly Update
• MPN 101: New Partner Orientation 
• February 2018 Open Source Solutions Partner Community call
• 3 questions with Mike Reinhart – Quisitive
• 2018 Modern Productivity - Security Partner Community call
• MPN 101: Digital Partner of Record
• February 2018 Business Applications Partner Community call
• MPN 101: Partner support options
• February 2018 Modern Workplace Productivity Partner Community call
• MPN 101: Microsoft Inspire 2018
• January 2018 Open Source Solutions Partner Community call 
• MPN 101: Partner Marketing Resources

MPN news

• For women in technology, there are plenty of seats at the table
• Make meaningful connections at Microsoft Inspire
• Driving innovation: see how HIMSS18 partners are shaping healthcare
• Two new GDPR solutions can help you earn incremental revenue
• Why apply for the Microsoft Partner of the Year Awards?
• Don’t miss Microsoft Inspire
• Transforming traditional IT: Part one
• From startup to global partner: An end-to-end experience for ISVs
• Smart, streamlined storytelling: How to reach and keep your audience
• Who’s responsible for the internet?
• Boost digital sales with relevant, syndicated website content
• 3 ways to create quality content and turn customers into advocates

Partner webinars available this winter

• Accelerate your Go-to-Market efforts and learn how to get better Office 365 and M365 solutions webinar series
• Accelerate your Go-to-Market efforts and learn how to get better Azure solutions webinar series
• US StepUp "Modern Voice and Collaboration in Office 365” 6-part series
• Cloud Application Development Partner Practice Enablement
• Azure Government boot camp training
• Microsoft Cloud Platform Immersion experiences
• Immersion experience facilitator boot camp training
• Join the Cloud Ready program and grow your cloud practice
• Cloud Growth and Profitability Office Hours Series
• The Leading Edge Webinar Series
• Hot Sheet training schedule

Learning news

• New LinkedIn Learning Course explores MCSA and MCSE Certifications
• Azure Learning Initiative for Learning Partners: Campaign ends March 30
• How to claim your digital badge – and why
• Xamarin Courses available on Courseware Marketplace
• Progressive Discounts on MCP Exams

Upcoming events

• MPN 101 Roadshow: Microsoft Partner Network Overview in Irvine, CA on March 26
• MPN 101 Roadshow: Microsoft Partner Network Overview in Los Angeles, CA on March 28
• Microsoft GDPR Partner Summit: April 3-4, 2018
• Azure Developer Tour: April 3-12
• Digital Innovation Executive Roundtable Events: April 18-26
• Microsoft Build: May 7-9 in Seattle, WA 
• Microsoft Inspire July 15-19 in Las Vegas, Nevada

US Partner Community partner call schedule

Community calls and a regularly updated, comprehensive schedule of partner training courses are listed on the Hot Sheet

• Tuesday, March 13, 9:00 am Pacific Time, Business Applications Partner Community call: Integrating Blockchain with Microsoft Dynamics
• Wednesday, March 14, 9:30 am Pacific Time, MPN 101 Community call: Partner Center & Referrals
• Friday, March 16, 10:00 am Pacific Time, Applications & Infrastructure Partner Community call: What's new with IaaS?

マイクロソフト パートナー ネットワーク チームでは、パートナー様を対象として月例のウェビナーを開催し、製品やプログラムについての最新情報や注意点などをいち早くお届けできるように努めています。ウェビナーは毎回 1 時間程度、1 トピック 10 分から 15 分で完結する内容となっています。

3月の開催日程は「3月22日（木）13:30～14:30」です。

パートナー様でご参加にご興味があります方は、以下よりご登録ください。

▼ご登録はこちらから

過去のトピックの例

• Microsoft Azure、Office 365、Windows 10、Surface などの製品についての最新情報、注意点など
• 働き方改革ムーブメントなどの施策、キャンペーンのご紹介
• 各種イベントのご案内、スポンサー プログラム紹介
• mstep トレーニング最新情報　他

いままで提供された情報の例

月例ウェビナーで過去に紹介されたトピックの例です。ウェビナーでは他にも様々なトピックが取り上げられ、製品やプログラムについての最新情報をいち早く手に入れることができます。

(録画を部分的に切り出しています)

這篇文章由  JR Mayberry, Principal PM Manager & Anupam Vij, Senior Program Manager, Azure Networking. 共同編撰。

客戶將其應用程序遷移到雲時，分佈式拒絕服務（DDoS）攻擊是最大的可用性和安全問題之一。根據 Nexusguard 的數據，2016 年第一季度記錄的 DDoS 攻擊數量比 2016 年第一季度增長了 380％，這些擔憂是合理的。 2016 年 10月，一些受歡迎的網站受到由多次拒絕服務攻擊組成的大規模網絡攻擊的影響。據估計，所有互聯網宕機事件中有三分之一與 DDoS 攻擊有關。

隨著網絡攻擊的類型和複雜程度的提高，Azure 致力於為我們的客戶提持續保護Azure上的應用程序安全性和可用性的解決方案。雲中的安全性和可用性是共同的責任。 Azure為客戶提供平台級功能和設計最佳實踐，以便採用並應用到滿足其業務目標的應用程序設計中。

今天，我們很高興地宣布 Azure DDoS Protection Standard 預覽。該服務與虛擬網路集成，並為受DosS攻擊影響的 Azure 應用程式提供保護。它可以在 Azure 平台自動包含的基本 DDoS 保護以外，實現其他特定應用的調整、警報和遙測功能。

Azure DDoS Protection Service offerings

Azure DDoS Protection Basic service

Protection Basic（基本保護）已經被默認整合到Azure平台中，無需額外成本。 Azure 的全球部署網路有著大規模高流量，通過始終保持流量監控以及實時緩解，來抵禦常見的網絡層攻擊。 無需經過使用者配置或應用程式的更改即可啟用DDoS Protection Basic。

Azure DDoS Protection 標準服務 

Azure DDoS Protection Standard（保護標準）是一種新的產品，可提供額外的DDoS 緩解功能，並自動調整以保護您的特定 Azure 資源。 保護很容易在任何新的或現有的虛擬網絡上啟用，並且不需要應用程式或資源更改。標準利用專用監控和機器學習來配置調整到虛擬網絡的DDoS防護策略。 通過分析應用程式的正常流量模式，智能地檢測惡意流量，並在檢測到後立即減緩攻擊，即可實現此額外保護。 DDoS 保護標准通過 Azure Monitor 提供了攻擊遙測視圖，可在應用受到攻擊時啟動警報。 Application Gateway WAF可以提供集成的第7層應用程序保護。

Azure DDoS Protection Standard service features

平台整合

Azure DDoS Protection 本身就被整合到 Azure 中了，並且當您在虛擬網路（VNet）上啟用它時也包含了通過 Azure Portal 和 PowerShell 的配置。

Turn Key （交鑰匙） Protection

簡化配置能立即保護虛擬網路中的所有資源，而無需進行其他應用程式的更改。

始終在監控

啟用 DDoS 保護後，您的應用程式流量模式會持續受到攻擊指標的監控。

自適應調整

 DDoS 防護了解您的資源和資源配置，並將 DDoS 防護策略自定義為您的虛擬網路。 隨著時間的推移，機器學習算法會隨著流量模式的變化而設置和調整保護策略 保護策略定義了保護限制，並且在實際網絡流量超過策略閾值時執行緩解。

使用應用程式網關進行 L3 到 L7 保護

Azure DDoS Protection 服務與 Application Gateway Web 應用程式防火牆相結合，為常見 Web 漏洞和攻擊提供 DDoS 防護。

• 請求速率限制
• HTTP 協議違例
• HTTP 協議異常
• SQL 注入
• 跨站腳本

DDoS保護遙測，監測和警吿

通過 Azure Monitor 提供豐富的遙測技術，包括在 DDoS 攻擊期間的詳細指標。 警報可以針對由 DDoS 保護公開的任何 Azure Monitor 度量標准進行配置。 日誌記錄可以進一步與 Splunk（Azure事件中心），OMS 日誌分析和 Azure 存儲集成，以便通過Azure監視器診斷界面進行高級分析。

Cost Protection 成本保護

當 DDoS 保護服務轉入 GA 後，成本保護將提供資源信用，用於在記錄的攻擊期間向外擴展。

Azure DDoS 防護標準服務可用性

Azure DDoS Protection 現已在美國、歐洲和亞洲的特定地區預覽。 有關詳細信息，請參閱DDoS 保護。

如何開始？

DDoS 保護處於預覽狀態，預覽期間服務不需要任何費用。 Azure 客戶可以在這裡註冊 Azure DDoS Protection 服務。

想了解有關該服務的更多信息，請參閱 Azure DDoS Protection 服務文檔。

原文撰 / Sarah Fender Principal Program Manager, Azure Cybersecurity

Azure Security Center (安全中心) 可幫助您保護在 Azure 中運行的工作負載，使其免受網絡威脅，而它現在也可以用來保護在本地和其他雲中運行的工作負載了。在越來越分散的基礎架構中，管理安全性變的非常複雜，可能會造成攻擊者利用的漏洞。 而 Security Center 通過統一整個環境中的安全管理，並使用分析以及 Microsoft Intelligent Security Graph (智能安全圖) 提供智能威脅保護來降低這種複雜性。

從較簡化的管理，到新的阻斷與檢測威脅方法，Security Center 不斷地進行創新，以幫助您解決當今面臨的安全挑戰。 Microsoft Ignite 宣布的新功能包括：

• 輕鬆啟動混合雲工作負載：只需要在這些機器上安裝Microsoft Monitoring Agent (監控代理)，您就可以將本地和其他雲中運行的虛擬機和計算機上崗。對於運營管理套件（OMS）安全與合規客戶，已連接的計算機將被安全中心自動發現並監控。了解有關新手入門混合雲工作負載的更多信息。

• 企業範圍的安全策略：利用 Azure Policy，現在在有限的預覽中，可以使用管理組跨多個訂閱應用安全中心策略。 這將大大簡化具有企業協議和許多 Azure 訂閱的客戶的策略管理，有助於確保安全策略始終適用於所有 Azure 工作負載。 還可以將策略應用於在本地和其他雲中運行的工作負載，以實現簡單的集中管理。
• 自適應應用程序控制：安全中心自適應應用程式控制現在處於有限預覽狀態，通過應用適合您的特定工作負載並以機器學習為動力的白名單規則，幫助阻止惡意軟件和其他有害或潛在易受攻擊的應用程序。 通過分析Azure虛擬機上運行的應用程序（目前僅限於Windows），安全中心可以推薦並應用針對特定虛擬機或一組虛擬機定制的一組應用程序白名單規則，從而提高白名單的準確性，同時降低管理複雜性。
• 針對Windows和Linux的高級威脅檢測：增強現有的威脅檢測功能後，安全中心很快將推出由Windows Defender Advanced Threat Protection（ATP）提供支持的檢測。 為 Windows端點構建的高級後檢測漏洞檢測將擴展到 Windows 服務器，並在安全中心提供。新的檢測結果將包含在安全中心標準中，並在您的機載資源時自動啟用。預覽將在年底之前提供。 另外，安全中心已經發布了一個有限的預覽，它利用審計記錄這一常見的審計框架來檢測 Linux 機器上的惡意行為。
• 警報和事件調查：安全中心現在在預覽中添加了新的視覺互動調查體驗，可幫助您快速分類警報，評估違規範圍並確定根本原因。探索警報，計算機和用戶之間的顯著鏈接，指出他們已連接到攻擊活動。使用預定義或臨時查詢來更深入地檢查安全和操作事件。

• 自動化和編排：安全中心現在與 Azure Logic 應用程序集成，以自動化和編排安全劇本。使用安全中心連接器創建新的 Logic Apps 工作流程，並從安全中心警報觸發事件響應操作。根據警報詳細信息包含條件操作，以根據警報類型或其他因素調整工作流程。自動化常用工作流程，例如將警報路由至票務系統，收集更多數據以幫助進行調查，並採取糾正措施修復威脅。
• 安全數據分析：安全中心新的集成搜索和事件監控功能使您能夠輕鬆分析來自各種來源的安全數據，包括安全中心收集的數據以及連接的解決方案（如網絡防火牆和 Azure Active Directory 信息保護）。 定義值得注意的事件來追踪，使用您定義的查詢定義潛在惡意活動的自定義警報。新的威脅情報地圖提供了洞察攻擊的地理來源的信息，而身份和訪問儀表板則包含有關可發現潛在威脅的登錄活動的數據。
• 擴展的安全評估：為了幫助您識別可能存在風險的 Web 服務器，Security Center 現在檢查Windows VM 和服務器上的 .NET、NET 和 IIS 配置以識別漏洞。在預覽期間，問題將特別被顯示為注意事件。

隨著威脅環境變得越來越具有挑戰性，Azure Security Center 團隊正在努力為您提供所需的解決方案以跟上步調。 有關這些新功能的更多信息，請閱讀文檔或打開 Security Center 以立即開始使用它們。