Итоги 2014 года–о проектах, образовании и карьере…
Microsoft Dynamics CRM Online Government Now Generally Available to All U.S. Government Customers
To complete the US government cloud trifecta, Microsoft announced today that the Dynamics CRM Online for US Government service is generally available. Office 365 has had a dedicated/isolated US government cloud for years, while the Azure US government cloud was just announced in early December. Adding CRM Online to the party makes perfect sense for our customers that want productivity solutions without the deployment headaches. Take a look at the blog post below and learn more about the service and the partners that are helping customer build solutions right now!
Walt Disney World Marathon Dopey Challenge 2015: Race Week!
PowerTip: Use PowerShell to Get All Computer Names
Summary: Use Windows PowerShell to easily retrieve a list of all computer names on the network.
How can I use Windows PowerShell to obtain a list of all the servers on the network so I can run a
script against them without typing a bunch of names?
Use the Get-ADComputer cmdlet from the Active Directory module
(available via the Remote Server Administration Tools), for example:
(Get-ADComputer -Filter *).name
Microsoft Ignite: The what’s-next-in-tech experience
May 4–8, 2015
Chicago, IL
The best and brightest minds will be all in one place to talk cloud infrastructure and management, productivity, big data and the internet of things, unified communications, mobility and more. So welcome, thinkers. And get ready for a glimpse at what’s possible today and in the future.
New year. New conference.
It’s finally here—the one conference that’s really every tech event. Hear from CEO Satya Nadella and other top visionaries. Attend incredible sessions and deep dives. Enjoy unprecedented access to hundreds of Microsoft technology and business leaders.
Guest blog by Helen Gooch, Microsoft Innovative Educator: Resolve to Take Time for Professional Learning with a Free Virtual Teacher Academy
Four free virtual training offerings are coming up in a professional learning webcast series for teachers. Join us as we explore more about teaching with 21st Century Learning Design, Windows 8, Office 365, and OneNote. Discover how technology in the classroom can save you time, and improve student success by registering to attend.
...(read more)Creating a Simple ConfigMgr 2012 R2 Dashboard Using SMSProv.log and SSRS
I recently saw a cool ConfigMgr dashboard by the guys over at CoreTech (http://coretech.dk/products/dashboard/) and I got the idea to try and mirror the look and feel of their dashboard.
Here are the things I wanted to capture in my dashboard:
- Software Update Deployment Compliance
- System Center Endpoint Definition Compliance
- Client Health
- Top 5 Threats Detected
- Overall Definition Status
- Count of OS Type
If a ConfigMgr administrator needed to, they could view each of those items, in difference places, in the ConfigMgr console. However, it becomes interesting if this data is needed by someone who doesn't have access to the console. With SSRS, and using the SMSProv.log we can easily build a simple dashboard! That dashboard could then be used with a subscription in SSRS and delivered on a schedule, etc.
When a node in the console is viewed, the underlying SQL that is running will be exposed in the SMSProv.log. For example, let's look at our Software Update Groups node in the console and view the SMSProv.log:
Here are the SQL queries grabbed from the SMSProv.log and used for my datasets in SSRS:
Dataset1:
select all
SMS_AuthorizationList.ApplicabilityCondition,SMS_AuthorizationList.AssociatedAutoRuleID,SMS_AuthorizationList.CI_ID,
SMS_AuthorizationList.CI_UniqueID,SMS_AuthorizationList.CIType_ID,SMS_AuthorizationList.CIVersion,SMS_AuthorizationList.ContainsExpiredUpdates,
SMS_AuthorizationList.ContainsSupersededUpdates,SMS_AuthorizationList.CreatedBy,SMS_AuthorizationList.DateCreated,SMS_AuthorizationList.DateLastModified,
SMS_AuthorizationList.EffectiveDate,SMS_AuthorizationList.EULAAccepted,SMS_AuthorizationList.EULAExists,SMS_AuthorizationList.EULASignoffDate,SMS_AuthorizationList.EULASignoffUser,
SMS_AuthorizationList.IsUserCI,SMS_AuthorizationList.InUse,SMS_AuthorizationList.IsBroken,SMS_AuthorizationList.IsBundle,SMS_AuthorizationList.IsChild,SMS_AuthorizationList.IsDeployed,
SMS_AuthorizationList.IsEnabled,SMS_AuthorizationList.IsExpired,SMS_AuthorizationList.IsHidden,SMS_AuthorizationList.IsLatest,SMS_AuthorizationList.IsProvisioned,SMS_AuthorizationList.IsQuarantined,
SMS_AuthorizationList.IsSuperseded,SMS_AuthorizationList.IsUserDefined,SMS_AuthorizationList.LastModifiedBy,SMS_AuthorizationList.LastStatusTime,SMS_AuthorizationList.Description,
SMS_AuthorizationList.DisplayName,SMS_AuthorizationList.CIInformativeURL,SMS_AuthorizationList.LocaleID,SMS_AuthorizationList.ModelID,SMS_AuthorizationList.ModelName,
SMS_AuthorizationList.NumberOfCollectionsDeployed,SMS_AuthorizationList.NumCompliant,SMS_AuthorizationList.NumNonCompliant ,
SMS_AuthorizationList.NumTotal,SMS_AuthorizationList.NumUnknown ,SMS_AuthorizationList.PercentCompliant,SMS_AuthorizationList.PermittedUses,
SMS_AuthorizationList.PlatformType,SMS_AuthorizationList.SDMPackageVersion,SMS_AuthorizationList.SedoObjectVersion,
SMS_AuthorizationList.SourceSite from fn_ListAuthListCIs(1033) AS SMS_AuthorizationList where SMS_AuthorizationList.CI_ID = 16829449
Dataset2:
select all SMS_CH_SummaryCurrent.ClientsActive,SMS_CH_SummaryCurrent.ClientsHealthUnknown,SMS_CH_SummaryCurrent.ClientsHealthy,
SMS_CH_SummaryCurrent.ClientsHealthyActive,SMS_CH_SummaryCurrent.ClientsHealthyInactive,SMS_CH_SummaryCurrent.ClientsInactive,SMS_CH_SummaryCurrent.ClientsRemediationSuccess,
SMS_CH_SummaryCurrent.ClientsRemediationTotal,SMS_CH_SummaryCurrent.ClientsTotal,SMS_CH_SummaryCurrent.ClientsUnhealthy,SMS_CH_SummaryCurrent.ClientsUnhealthyActive,
SMS_CH_SummaryCurrent.ClientsUnhealthyInactive,SMS_CH_SummaryCurrent.CollectionID from v_CH_ClientSummaryCurrent AS SMS_CH_SummaryCurrent where SMS_CH_SummaryCurrent.CollectionID = N'SMSDM003'
Dataset3:
select top 5 SMS_TopThreatsDetected.CollectionID,SMS_TopThreatsDetected.MemberCount,SMS_TopThreatsDetected.Rank,SMS_TopThreatsDetected.ThreatCategoryID,SMS_TopThreatsDetected.ThreatID,
SMS_TopThreatsDetected.ThreatName,SMS_TopThreatsDetected.TotalMemberCount from vSMS_TopThreatsDetected AS SMS_TopThreatsDetected where SMS_TopThreatsDetected.CollectionID = N'SMS00001' order by SMS_TopThreatsDetected.Rank
Dataset4:
select all __ointProtectionHealthStatus0.ApplyPolicyFailedCount,__ointProtectionHealthStatus0.ApplyPolicySucceededCount,__ointProtectionHealthStatus0.CollectionID,__ointProtectionHealthStatus0.InstallFailedCount,__ointProtectionHealthStatus0.InstallRebootPendingCount,
__ointProtectionHealthStatus0.NoSignatureCount,__ointProtectionHealthStatus0.OverallNotClientCount,__ointProtectionHealthStatus0.OverallStatusAtRiskCount,__ointProtectionHealthStatus0.OverallStatusInactiveCount,__ointProtectionHealthStatus0.OverallStatusNotSupportedCount,
__ointProtectionHealthStatus0.OverallStatusNotYetInstalledCount,__ointProtectionHealthStatus0.OverallStatusProtectedCount,__ointProtectionHealthStatus0.OlderThan7DaysCount,__ointProtectionHealthStatus0.UpTo1DayOldCount,__ointProtectionHealthStatus0.UpTo3DaysOldCount,
__ointProtectionHealthStatus0.UpTo7DaysOldCount,__ointProtectionHealthStatus0.TimeLastUpdated,__ointProtectionHealthStatus0.TotalMemberCount,__ointProtectionHealthStatus0.TotalOperationalIssueCount,__ointProtectionHealthStatus0.UnhealthyCount from vSMS_EndpointProtectionHealthStatus AS __ointProtectionHealthStatus0 where __ointProtectionHealthStatus0.CollectionID = N'SMS00001'
Dataset5:
select all
SMS_AuthorizationList.ApplicabilityCondition,SMS_AuthorizationList.AssociatedAutoRuleID,SMS_AuthorizationList.CI_ID,SMS_AuthorizationList.CI_UniqueID,SMS_AuthorizationList.CIType_ID,SMS_AuthorizationList.CIVersion,
SMS_AuthorizationList.ContainsExpiredUpdates,SMS_AuthorizationList.ContainsSupersededUpdates,SMS_AuthorizationList.CreatedBy,SMS_AuthorizationList.DateCreated,SMS_AuthorizationList.DateLastModified,
SMS_AuthorizationList.EffectiveDate,SMS_AuthorizationList.EULAAccepted,SMS_AuthorizationList.EULAExists,SMS_AuthorizationList.EULASignoffDate,SMS_AuthorizationList.EULASignoffUser,
SMS_AuthorizationList.IsUserCI,SMS_AuthorizationList.InUse,SMS_AuthorizationList.IsBroken,SMS_AuthorizationList.IsBundle,SMS_AuthorizationList.IsChild,SMS_AuthorizationList.IsDeployed,
SMS_AuthorizationList.IsEnabled,SMS_AuthorizationList.IsExpired,SMS_AuthorizationList.IsHidden,SMS_AuthorizationList.IsLatest,SMS_AuthorizationList.IsProvisioned,SMS_AuthorizationList.IsQuarantined,
SMS_AuthorizationList.IsSuperseded,SMS_AuthorizationList.IsUserDefined,SMS_AuthorizationList.LastModifiedBy,SMS_AuthorizationList.LastStatusTime,SMS_AuthorizationList.Description,
SMS_AuthorizationList.DisplayName,SMS_AuthorizationList.CIInformativeURL,SMS_AuthorizationList.LocaleID,SMS_AuthorizationList.ModelID,SMS_AuthorizationList.ModelName,SMS_AuthorizationList.NumberOfCollectionsDeployed,
SMS_AuthorizationList.NumCompliant,SMS_AuthorizationList.NumNonCompliant ,SMS_AuthorizationList.NumTotal,SMS_AuthorizationList.NumUnknown ,SMS_AuthorizationList.PercentCompliant,SMS_AuthorizationList.PermittedUses,
SMS_AuthorizationList.PlatformType,SMS_AuthorizationList.SDMPackageVersion,SMS_AuthorizationList.SedoObjectVersion,SMS_AuthorizationList.SourceSite from fn_ListAuthListCIs(1033) AS SMS_AuthorizationList
where SMS_AuthorizationList.CI_ID = 16829448
Dataset6:
SELECT Caption0 as 'Operating System', COUNT(*) AS 'Total'
FROM v_GS_OPERATING_SYSTEM OS
GROUP BY Caption0
ORDER BY Caption0
(Dataset1 and Dataset5 will need the CI_ID to be modified if used in another environment, Dataset6 is a simple custom query. The data source for your environment will have to be defined.)
After getting a little creative inside SSRS I came up with a color scheme that looked similar to the Core Tech Dashboard and here is what the finished result looks like:
I've included the RDL for download below.
UPDATE: Some of the above queries are cutoff. But you can find the complete query in the RDL, under the properties of each dataset:
Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified
in theTerms of Use.
SharePoint Saturday Mexico 2015
SharePoint Saturday Mexico 2015
Fecha: Sábado 31 de Enero de 2015
Lugar: TelmexHub – Calle Isabel La Catolica #51, Cuauhtemoc, Ciudad de México, México.
Horario: 9 am a 7:30 pm
Te invitamos al primer SharePoint Saturday en la Ciudad de México, un evento gratuito en el que podrás disfrutar de sesiones técnicas impartidas por influenciadores, MVPs, líderes técnicos y respetados profesionales en el ámbito; así como tener la oportunidad de hacer networking con gente relacionada en las tecnologías SharePoint. Tendremos sesiones para IT Pros y Developers.
Registro y más detalles en: http://www.spsevents.org/city/mexicocity/mexicocity2015
Invitan:
Emotet spam campaign targets banking credentials
A new variant in the Win32/Emotet family is targeting banking credentials with a new spam email campaign. The emails include fraudulent claims, such as fake phone bills, and invoices from banks or PayPal.
Since November 2014 we have been monitoring a new variant: Trojan:Win32/Emotet.C. This variant was part of a recent spam campaign that peaked in November. Our telemetry indicates this campaign primarily targeted German-language speakers and banking websites.
Figure 1: Emotet infections by country (last 30 days)
As the sample indicates, the spam email messages are written in German and contain a link to a compromised website.
Figure 2: A spam email message linking to a website that downloads Emotet (German)
The message, when translated into English, reads:
Your deposit
Good day,
Your statement has been cancelled before we recorded contact with the bank. More details are abailable here: your deposit.
With warm regards, the Volksbank team.
The linked website can download a .zip file that contains an executable file with a long file name to hide its .exe extension such as:
- de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
- E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
- Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
The file also uses a PDF document icon in an attempt to trick victims into opening the file and running the malware.
Figure 3: Long file name with PDF icon for deception
The spam emails are difficult for email servers to filter because the spamming component uses compromised email accounts to send malicious links. Emotet's spam module (detected as Spammer:Win32/Cetsiol.A) logs into email services using the stolen account name and passwords to send the spam. This means traditional anti-spam techniques, such as callback verification, won't be applicable because the email is sent from a vetted or legitimate email address.
Unlike Windows Explorer, most file archive software don’t warn users when they execute a file in an archive that’s been downloaded from the Internet. In this case the Emotet binaries are delivered in a .zip file so the installed default file archive software such as Windows Explorer, WinRar or WinZip will open the file.
Once run, Trojan:Win32/Emotet.C monitors network activity to steal online banking credentials when an infected user logs on to banking websites. It can log credentials from URLs with any of the following paths, and this list could be updated at any time:
- /ach//nubi/
- /wire/
- /wires/
- banking.bank1saar.de
- banking.berliner-bank.de
- banking.flessabank.de
- banking.gecapital.de
- banking.gecapital.de
- banking.sparda.de
- commerzbank.de
- commerzbank.de
- de/portal/portal
- finanzportal.fiducia.de
- kunde.comdirect.de
- meine.norisbank.de
- ptlweb/WebPortal
- raiffeisen.at
- telekom.de
- vodafone.de
- wellsfargo.com
On infected machines, the Win32/Emotet family can also steal email account user names and passwords from installed email or messaging software. We detect the download component as PWS:Win32/Emotet.E, and have seen it try to extract user names and passwords stored in the following software:
- Eudora
- Gmail Notifier
- Google Desktop
- Google Talk
- Group Mail
- IncrediMail
- Mozilla Thunderbird
- MSN or Windows Live Messenger
- Netscape 6 and Netscape 7
- Outlook 2000, Outlook 2002, and Outlook Express
- Windows Mail and Windows Live Mail
- Yahoo! Messenger
It sends the stolen information back to its command and control (C&C) server where it is used by other components to send spam emails to spread the threat. We detect the Emotet spamming component as Spammer:Win32/Cetsiol.A.
The emergence of this new variant demonstrates the importance of keeping your Microsoft security software up to date, as well as enabling Microsoft Active Protection Service Community (MAPS). Customers using MAPS can take advantage of Microsoft’s cloud protection and, therefore, a faster detection and removal.
We are closely monitoring this and related threats using the telemetry we receive from our customers, which allows us to respond faster and remediate more effectively.
HeungSoo (David) Kang
MMPC
[Script Of Jan. 07] How to identify which group a contact belongs to in EXO
Script Download:
The script is available for download from https://gallery.technet.microsoft.com//How-to-identify-which-4e545ba4. You can also use Microsoft Script Browser for Windows PowerShell ISE to download the sample with one button click from within your scripting environment.
This script sample is used to identify which group a contact belongs to in EXO.
You can find more All-In-One Script Framework script samples at http://aka.ms/onescriptingallery
Lync Server 2013, Lync Web App & Google Chrome Support Updated
In this post, I discussed the new behavior when using Google Chrome to join a Lync meeting. An update has been released that changes the behavior back. This cumulative update enables users to use a native Lync client instead of Lync Web App to join meetings in Windows when Google Chrome is the default browser. Additionally, this cumulative update enables users to join meetings through the Lync Web App by using a 32-bit version of Google Chrome until the browser plug-in becomes fully obsolete.
You can download the latest cumulative updates here and you can find additional information here.
Test to check the draft options
Test to check the draft options
when I"m in draft mode
I'm not able to see the options
Pravalika reddy
Device Management Strategy Planning: More Questions Than Answers
Setkání Windows User Group – leden 2015
Use PowerShell Desired State Configuration to Set Time Zone
Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell Desired State Configuration to set the time zone.
Microsoft Scripting Guy, Ed Wilson, is here. The weather is cold today in Charlotte. Not exactly freezing, but cold enough to merit a nice cup of English Breakfast tea with bits of strawberry leaf, blueberry leaf, orange peel, hibiscus flower, and a cinnamon stick. The tea is robust, and it goes well with homemade blueberry scones. It is a good morning for reflection.
Believe it or not, time zone configuration is still an issue at times. Especially, when it comes to correlating logging, or running scheduled tasks or other such activities. What normally happens is that the person configuring the server simply forgets to change the time zone from the default setting (-8 GMT). Everything continues to hum along swimmingly until...boom!—it does not. Luckily, the Wave 9 release of the Desired State Configuration Resource Kit contains a TimeZone resource.
But before I get into that, I want to first do a little checking up on the time zone settings.
Working with time zones in Windows PowerShell
In my life as a computer professional, dates and times have been a continuous issue for me. I can reach all the way back to the days when a date was stored in three fields in a database, and a time was stored in three more fields. Creating a report mandated munging together these six fields.
Sure, the creation of a DateTime object has been great. Sure, using the Get-Date cmdlet is easy and wonderful. However, there are still issues and challenges. Time zones, for one, are a major pain— well, not a major pain, but they are not as simple as they could be.
Let's start with checking the date. It would appear that all I need to do is to run the Get-Date cmdlet in a remote session, and everything is groovy. So first I query Active Directory and return a list of computers. Next, I use the Invoke-Command cmdlet to run the Get-Date cmdlet inside a script block. Everything is easy, everything is good. Here is the command and the results:
PS C:\> $cn = (Get-ADComputer -Filter *).name
PS C:\> icm -cn $cn {get-date}
Monday, January 5, 2015 1:52:02 PM
Monday, January 5, 2015 1:52:02 PM
Monday, January 5, 2015 1:52:02 PM
Monday, January 5, 2015 1:52:02 PM
Hmmm…I know that at least one of the remote servers is set to the wrong time zone, but using Get-Date does not tell me that. Why? Well, Windows PowerShell is smart. In this case, it is too smart because it automatically displays a remote date and time by using the local time zone information. Most of the time, this is great. Just not today.
The next thing I do is use Windows PowerShell remoting to figure out what time zones the remote servers are configured with. I call use the TimeZoneInfo .NET Framework class. Following is the command I use. (Note that I collected my server names in the previous command, and I stored the names in the $cn variable. This permits me to reuse it easily.)
PS C:\> icm -cn $cn -ScriptBlock {[timezoneinfo]::Local.DisplayName}
(UTC-08:00) Pacific Time (US & Canada)
(UTC-05:00) Eastern Time (US & Canada)
(UTC-05:00) Eastern Time (US & Canada)
(UTC-05:00) Eastern Time (US & Canada)
Ah! I see that one of my servers is in fact set to Pacific Time. If I want to get the actual display time from the remote servers, I need to use an old-fashioned command. To run this command, I am going to use the Invoke-Expression cmdlet. Invoke-Expression is not recommended because it can have unintended consequences if one is not careful.
Invoke-Expression executes a string as if it were a command. This is actually great for what I am about to do (which is a real left handed way of doing things such as creating a cmd prompt, and then running the time command). There is almost never a good reason for doing this.
Note The Windows PowerShell team has a blog post titled Invoke-Expression considered harmful.
PS C:\> icm -cn $cn -ScriptBlock {Invoke-Expression "cmd.exe /c time /t"}
11:01 AM
02:01 PM
02:01 PM
02:01 PM
The DSC TimeZone resource
Enter the world of Windows PowerShell Desired State Configuration (DSC). By using the TimeZone resource, I can create a simple script to set the time zone configuration on my local and remote servers easily.
Note Today’s script follows the same pattern as the SetPowerShellExecutionPolicy.ps1 script I wrote for yesterday’s post,
Use DSC Resource to Configure PowerShell Execution Policy. Refer to that post for more details.
The first thing I do is use the Configurationkeyword and specify a name for my configuration. I next define a couple of parameters—one for the computers (target nodes) and one for the specific time-zone name. I then specifically import the DSC resource. This is required because the xTimeZone DSC resource is not a standard resource, and therefore, it is not automatically loaded. Here is that portion of the script:
#Requires -version 4.0
Configuration SetTimeZone
{
Param
(
#Target nodes to apply the configuration
[String[]]$NodeName = ((Get-ADComputer -Filter *).name),
[Parameter(Mandatory = $true)]
[ValidateNotNullorEmpty()]
[String]$SystemTimeZone
)
Import-DSCResource -ModuleName xTimeZone
Now I define my action for each node. To do this, I use the Nodekeyword, and I specify the computer names stored in the $NodeName variable that I populated with my Get-ADComputer command. I call the xTimeZone resource, and I specify my time zone. Here is that portion of the code:
Node $NodeName
{
xTimeZone TimeZoneExample
{
TimeZone = $SystemTimeZone
}
}
I call the configuration and specify an output path for the creation of the MOF files. I also specify my time zone via the SystemTimeparameter. This value takes the ID property that is available from the following command:
[timezoneinfo]::Local.id
If I want an enumeration of all of the available time zones, I can use GetSystemTimeZonesstatic method as shown here:
[timezoneinfo]::GetSystemTimeZones().id
The last thing I need to do is to start the actual DSC configuration. To do this, I use the Start-DSCConfiguration cmdlet while specifying the path that I used earlier in addition to a few parameters:
SetTimeZone -output C:\serverConfig -SystemTime "Eastern Standard Time"
Start-DscConfiguration -Path C:\serverConfig -Wait -Force -Verbose
The complete configuration script is shown here:
#Requires -version 4.0
Configuration SetTimeZone
{
Param
(
#Target nodes to apply the configuration
[String[]]$NodeName = ((Get-ADComputer -Filter *).name),
[Parameter(Mandatory = $true)]
[ValidateNotNullorEmpty()]
[String]$SystemTimeZone
)
Import-DSCResource -ModuleName xTimeZone
Node $NodeName
{
xTimeZone TimeZoneExample
{
TimeZone = $SystemTimeZone
}
}
}
SetTimeZone -output C:\serverConfig -SystemTime "Eastern Standard Time"
Start-DscConfiguration -Path C:\serverConfig -Wait -Force -Verbose
As shown here, when I run the script for the first time, a series of progress bars appear that state it is initializing the resource:
As the script runs, the verbose output lets me know what is going on with the script. This is shown here:
The last thing I do is press the UP arrow to see if my times are now correct. Here are the results:
That is all there is to using Windows PowerShell DSC to set the time zone. DSC Week will continue tomorrow when I will talk about more way cool stuff.
I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.
Ed Wilson, Microsoft Scripting Guy
Recupération de partitions IV : Identification d’une partition NTFS
Pour pouvoir récupérer une partition NTFS, il faut savoir l'identifier. Une partition NTFS contient essentiellement:
- Un secteur d'amorçage NTFS (NTFS BootSector) en début de partition
- Une MFT (la database de NTFS)
- Une copie alternative des 3 premiers enregistrements de cette MFT
- Un secteur de backup du NTFS Boot Sector en fin de partition
Pour une description complète de chacun des champs : http://technet.microsoft.com/fr-fr/library/cc781134(WS.10).aspx
Pour rappel, la table de partition 0 nous montrait une partition démarrant au secteur 2048 et occupant 122972160 :
Examinons en détails le NTFS Boot Sector
Si on dresse un tableau de ces données on obtient ça:
Byte Offset | Field Length | Sample Value | Field Name |
0x00 | 3 bytes | EB 52 90 | Jump Instruction |
0x03 | 8 bytes | NTFS | OEM ID |
0x0B | 2 bytes | 00 02 (512) | Bytes per sector |
0x0D | 1 byte | 08 | Sectors per Cluster |
0x0E | 2 bytes | 00 00 | Reserved Sectors |
0x10 | 3 bytes | 00 00 00 | Must be 0 |
0x13 | 2 bytes | 00 00 | Must be 0 |
0x15 | 1 byte | F8 | Media Descriptor |
0x16 | 2 bytes | 00 00 | Must be 0 |
0x18 | 2 bytes | 3F 00 | Not used |
0x1A | 2 bytes | FF 00 | Not used |
0x1C | 4 bytes | 00 08 00 00 (0x800 = 2048) | Not used |
0x20 | 4 bytes | 00 00 00 00 | Must be 0 |
0x24 | 4 bytes | 80 00 80 00 | Not used |
0x28 | 8 bytes | FF 67 54 07 00 00 00 00 (122972159)* | Total Sectors |
0x30 | 8 bytes | 00 00 0C 00 00 00 00 00 (786432) | Clusters to $MFT |
0x38 | 8 bytes | 02 00 00 00 00 00 00 00 (2) | Clusters to $MFTMirr |
0x40 | 1 byte | F6 (246) ** | Clusters Per MFT Record |
0x41 | 3 bytes | 00 00 00 | Not used |
0x44 | 1 byte | 01 | Clusters Per Index Buffer |
0x45 | 3 bytes | 00 00 00 | Not used |
0x48 | 8 bytes | 31 DD 45 AE 2B 46 AE FE | Volume Serial Number |
0x50 | 4 bytes | 00 00 00 00 | Not used |
*La table de partition présente au secteur 0 nous avait indiqué une partition occupant 122972160 secteurs. Ca fait un secteur de plus, car dans cette table, on compte le 1er secteur de la partition ainsi que le dernier. Dans le secteur d’amorçage NTFS on compte un secteur de moins. Il faudra s’en rappeler quand nous ferons des réparations.
**La taille de chaque enregistrement. NTFS fera un enregistrement pour chaque fichier et répertoire de son volume. Ceux dont la taille est inférieur à la taille d’un enregistrement sont résident dans la MFT. Si ce nombre est positif (entre 00 et 7F) alors il represente le nombre de cluster par enregistrement. Si le nombre est négatif (de 80 à FF), alors la taille d’un enregistrement est 2 à la puissance la valeur absolue de la valeur de ce champ.
- Dans notre exemple, nous pouvons lire la valeur 0xF6. C’est une valeur négative, et sa valeur absolue est 0x0A (10 en décimal). Donc la taille d’un enregistrement sera de 2^10 = 1024 Bytes (1K)
- Si nous avions formaté la partition avec le paramètre /L, nous aurions lu la valeur 0x01 dans le champ clusters per MFT Record. Dans ces condition, la taille d’un record aurait été 1 cluster. Comme 1 cluster occupe 8 secteurs, ça nous aurait donné 4K par enregistrement (ce qui est bien le but du paramètre /L)
Clusters to MFT est de 786432, et nous avons 8 secteurs par cluster. Donc, la MFT est localisée au secteur 6293504 ( = 2048 + 786432 * 8 )
Nous pouvons voir à cet emplacement, le premier fichier de la MFT : $MFT
Sachant que chaque enregistrement occupe 1K, il est possible de parcourir tous les enregistrements de la MFT jusqu’à, par exemple, l’enregistrement $Volume qui fournit le nom du volume. Puisqu’il s’agit du 4ième, nous le trouverons au secteur 6293510.
Si nous ne trouvons rien de ce genre à cet emplacement, c’est que soit la donnée a été écrasée, soit qu’on n’est pas au bon endroit : Le secteur d’amorçage n’est peut-être pas le bon, ou contient de mauvaises informations
Dans l’article suivant nous récupérons une partition.
Serge Gourraud
55 AA
The Top 5 Training Videos of 2014 for IT Pros
Ed Jones works for Firebrand Training, a Microsoft Gold Learning Partner. He has worked in the IT training and certification industry for the past 3 years. He is a tech enthusiast with experience working with SharePoint, Windows Server and Windows desktop.
The New Year period is a time for reflection. An opportunity to evaluate all that has happened in the past 12 months, whilst planning for what lies ahead.
The technology sector is constantly evolving and with it so must IT professionals. New skills are always in demand, so whether it’s cloud, big data or IoT skills, those willing to train and develop are at an advantage.
As this year draws to a close we’ve compiled the top training videos of 2014 to help align your skills for a successful 2015.
1. Migrating Server Workloads to Windows Server 2012 R2 and Microsoft Azure
End of Support is looming for Windows Server 2003, time is running out for IT Professionals to begin the migration process away. So if you’re considering migrating from on-premises, to cloud or a combination of both, this video is a fantastic resource.
Understand what end of support for Windows Server 2003 means, whilst learning how to get started migrating server workloads to Windows Server 2012 R2 and Microsoft Azure. This video is part 6 of what is now a 32 part series on Modernizing Your Infrastructure with Hybrid Cloud found on the IT Pro Blog.
2. Next Roles, Next Skills, and Staying Relevant in an Evolving IT World
Navigating the IT job market can be a tricky business. Demand for new skills and job roles can emerge overnight, and disappear just as quickly. Building a future proof and relevant skill set is a valuable asset for any IT professional looking for gainful employment.
Learn the current lie of the land in the IT job market by watching this excellent video from Technical Evangelists Ed Baker, Susan Smith and Andrew Fryer.
3. Navigating the Azure Management Portal
Demand for IT professionals with cloud-related skills is at an all-time high. With more than 1000 new businesses signing up to Microsoft Azure on a daily basis, hack into this demand by familiarizing yourself with Microsoft’s public cloud offering.
This video will get you to grips with Azure’s Management Portal and forms part of a new training series called Microsoft Azure Fundamentals. Bob Tabor is the host of this Herculean task which is rumoured to be a 100+ video series. Follow this journey and you will truly be a cloud professional.
4. Windows 10 Technical Overview
With Windows 10 planned for launch in 2015, discover all the important updates in this introduction to the new OS with Microsoft’s Technical Evangelist Simon May and Group Marketing Manager Bard McCabe.
This is the first in a new Jump Start series on Windows 10, get the inside track and learn all about the new UI enhancements, management and deployment processes as well as understanding all the hot new security features. So, when Windows 10 finally arrives, you’ll have the required skill set to transition your business to the latest Microsoft operating system.
5. Making the Internet of Things – An Intro to Microprocessors
The Internet of Things (IoT) is set to be huge, Gartner predicts nearly 26 billion devices will be connected by 2020. Developing IoT related skills could fast track you to the next stage of your career.
This video by Microsoft Technical Evangelist, Stacy Mulcahy, provides a great introduction to hardware and microprocessors for IT Pros who have a software background. You’ll then begin to learn about all of the cool and interesting things you can build for the IoT. This is the first in a series by Stacey on the Internet of Things.
What is your top video of 2014? Let us know in the comments section or via @TechNetUK.
[Hyper-V マネージャー] のトレース (Hyper-V UI トレース) について
2015/01/07 追記。
こんにちは。
Windows プラットフォーム サポートの横山です。
本日は、[Hyper-V マネージャー] を利用した操作に関するログを取得する方法についてお伝えいたします。
[Hyper-V マネージャー] の処理詳細を確認するためのトレースとして Hyper-V UI トレースが実装されております。本トレースでは、[Hyper-V マネージャー] からの仮想マシンの作成 / 起動失敗や仮想マシンの一覧が表示されない現象に関するログを確認することができます。更には、仮想マシン接続 (vmconnect.exe) に関するログも取得できるため、仮想マシン接続が行えない場合にも有効なトレースです。本トレースは既定では有効化されておらず、VMClientTrace.config というファイルを作成する必要がございます。有効化の手順は以下の通りです。
1. "%appdata%\Microsoft\Windows\Hyper-V\Client\1.0\" のパス配下に"VMClientTrace.config" という名前の空ファイルを配置します。
※ 拡張子を表示した状態でファイル名を設定してください。
2. 作成した VMClientTrace.config ファイルをテキスト エディタで開き、以下の内容を記述して保存します。
※ Windows Server 2008 / 2008 R2 と Windows Server 2012 / 2012 R2 (Windows 8 / 8.1) で異なるため、それぞれを記載いたします。
// Windows Server 2008 / 2008 R2
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<Microsoft.Virtualization.Client.TraceConfigurationOptions>
<setting name="TraceTagFormat" type="System.Int32">
<value>3</value>
</setting>
<setting name="BrowserTraceLevel" type="System.Int32">
<value>6</value>
</setting>
<setting name="VMConnectTraceLevel" type="System.Int32">
<value>6</value>
</setting>
<setting name="InspectVhdTraceLevel" type="System.Int32">
<value>6</value>
</setting>
</Microsoft.Virtualization.Client.TraceConfigurationOptions>
</configuration>
// Windows Server 2012 / 2012 R2
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<Microsoft.Virtualization.Client.TraceConfigurationOptions>
<setting name="TraceTagFormat" type="System.Int32">
<value>3</value>
</setting>
<setting name="BrowserTraceLevel" type="System.Int32">
<value>127</value>
</setting>
<setting name="VMConnectTraceLevel" type="System.Int32">
<value>127</value>
</setting>
<setting name="InspectVhdTraceLevel" type="System.Int32">
<value>6</value>
</setting>
</Microsoft.Virtualization.Client.TraceConfigurationOptions>
</configuration>
3. [Hyper-V マネージャー] の再起動後、トレースが開始されますので、調査対象の現象を再現させます。
※ 仮想マシン接続の場合は、仮想マシン接続 (vmconnect.ext) を再起動します。
4. [Hyper-V マネージャー] を終了し、ログの書き込みを完了させます。
※ 仮想マシン接続の場合は、仮想マシン接続 (vmconnect.ext) を終了します。
5. ログ ファイルは %temp% もしくは %userprofile%\AppData\Local\Temp\ に保存されます。
※ [Hyper-V マネージャー] の操作に関するログは"VMBrowser_Trace_日時.log" として保存され、仮想マシン接続に関するログは"VMConnect_Trace_日時.log" として保存されます。
ログの出力を停止する場合は作成した VMClientTrace.config のリネームを行うか、削除してください。
- 補足
VMClientTrace.config 内の以下の 3 つの設定について補足します。
BrowserTraceLevel
VMConnectTraceLevel
InspectVhdTraceLevel
BrowserTraceLevel は、[Hyper-V マネージャー] の操作に関するログです。
VMConnectTraceLevel は、仮想マシン接続 (vmconnect.exe) に関するログです。
InspectVhdTraceLevel は、ディスクの検査 (InspectVhdDialog.exe) に関するログです。
仮想マシン接続のログのみが必要で、その他のログの出力を抑えたい場合は BrowserTraceLevel と InspectVhdTraceLevel の <value> を 0 に変更してください。
なお、<value> で設定する値に依って取得されるログが異なります。設定可能な値は Windows Server 2008 / 2008 R2 と Windows Server 2012 / 2012 R2 (Windows 8 / 8.1) とで異なります。
// Windows Server 2008 / 2008 R2
0 | None |
1 | Exception (全ての例外をログします) |
2 | WMI call (1 の内容に加え、UI より呼び出された WMI の情報をログします) |
3 | UserAction (2 の内容に加え、ウィザードの起動などのユーザー アクションをログします) |
4 | Events (3 の内容に加え、WMI イベントをログします) |
5 | All (4 の内容に加え、関数やスレッドの開始や終了をログします) |
6 | Verbose (5 の内容を更に詳細にログします) |
// Windows Server 2012 / 2012 R2
Windows Server 2012 / 2012 R2 では、任意のログのみを出力できる様にビットでフラグを管理する様、実装が変更されました。
例えば 5 と設定することで、Error と UserAction のみをログすることが可能です。
1 | Error (エラー) |
2 | Warning (警告) |
4 | User Action (ユーザー アクション) |
8 | Information (汎用情報) |
16 | WMI Call (WMI コール) |
32 | WMI Event (WMI イベント) |
64 | Verbose (詳細情報) |
128 | Verbose WMI Get Properties (WMI で取得されたオブジェクトのプロパティ情報) |
256 | Verbose WMI Event Properties (受信した WMI イベントに関するオブジェクトのプロパティ情報) |
全てのログを取得するためには、511 を設定しますが、128 と 256 を設定するとログ量が極端に増えるため、必要な状況以外で設定することは推奨していません。
※ 64, 128, 256 はそれぞれ詳細な情報を表示するためのフラグであり、単体ではログが出力されません。
64 は 1, 2, 4, 8 と組み合わせて利用します。
128 は 16 と組み合わせて利用します。
256 は 32 と組み合わせて利用します。
Upcoming Events
Microsoft official and Community tech events coming your way this January and beyond.
Which event are you going to? Let us know via @TechNetUK.
Featured Event
Microsoft TechDays Online is back. This is the 4th implementation of our three-day online technical conference for IT Pros and Developers who are keen to know the latest information on developments in Microsoft products and development platforms for cloud, mobility, apps, IT infrastructure and much more. Our virtual technology event provides a unique opportunity for IT Pros and software developers to hear about and experience the latest developments across the wide range of Microsoft products and platforms from our latest devices to our hyper-scale cloud.
The conference programme will be delivered by Microsoft specialists, technical professionals from the IT Pro and developer communities, customers and partners. All sessions will be fully interactive providing delegates with the opportunity to engage directly with the presenters and the other participants in the conference.
In addition, the conference programme will include highlights from the Microsoft Future Decoded conference (November 2014) with fresh updates and insights into the latest developments in key Microsoft technologies.
Day 1 (Tuesday February 3rd) – Client, Devices & Mobility
Day 2 (Wednesday February 4th) – Server & Cloud
Day 3 (Thursday February 5th) – Developer & Tools
2. Get Started With Azure Weekly Webinar Series
Our weekly webinars offer you a quick start to the cloud with demos and practical tips that cover the basics of Azure and features a new special topic each week.
Our technical experts will show you how to build a developer workstation in the cloud in minutes with Visual Studio. Learn about the new version of Visual Studio Community Edition and how you can get started quickly without upfront costs.
Upcoming Events
![]() | 6th January, Leeds: SharePoint User Group UK (Yorkshire) - We are starting the new year with a bang by having two great sessions on cutting edge SharePoint. We believe this is the first UK SharePoint user group to hold sessions on the latest Office 365 features of Delve and the Video portal features. Who better to take us through this than Microsoft's James Akrigg who will be discussing/demoing the evolution of the Office 365 services. | Register here |
![]() | 15th January, London: SQL Server User Group - PASS London Chapter Event 15th January 2015. | Register here |
![]() | 15th January, Birmingham: SQL Server User Group - We'll be at the Midlands Art Centre. Sessions to be announced closer to the time! | Register here |
![]() | 27th January, Cardiff: SQL Cardiff - We'll be at the Midlands Art Centre. Sessions to be announced closer to the time! | Register here |
![]() | 3rd – 5th February, Online (GMT time): TechDays Online 2015 - Our virtual technology event provides a unique opportunity for IT Pros and software developers to hear about and experience the latest developments across the wide range of Microsoft products and platforms from our latest devices to our hyper-scale cloud. The conference programme will be delivered by Microsoft specialists, technical professionals from the IT Pro and developer communities, customers and partners. | Register here |
![]() | 3rd February, Manchester: SharePoint User Group UK (North West) - We'll be at SpacePortX in Manchester from 18:00 - 21:00 (GMT). | Register here |
![]() | 11th February, York: Windows User Group - The Windows User Group is pleased to invite you to join us for another evening of TechBites with MVP's Chris Rhodes and Andrew Bettany and guest speaker Anthony Eason as they talk about hot topics including Windows 10, Windows Intune and hopefully Office 365. | Register here |
![]() | 11th February, Manchester: UK SQL Server User Group - With sessions from Kimberly L. Tripp - on Stored Procedure Optimization Techniques - and Rainer Unwin. | Register here |
![]() | 12th February, Leeds: UK SQL Server User Group - Thursday night meeting with sessions from Steve Powell and another TBC. | Register here |
![]() | 12th February, Birmingham: UK SQL Server User Group - Featuring Erin Stellato from SQLSkills | Register here |
![]() | 4th - 5th March, London: System Center and Azure designing it to work from the Cloud - Learn how System Center/Windows Azure Pack can work wherever you want it. We have a great line-up of World expert speakers both MVPs and Microsoft staff including a few non MVP experts. | Register here |
Be sure to keep up to date on TechNet social for more regular event updates. Why not tweet us and let us know which event you’re going to!
回顧 2014 年微軟所開發最受歡迎的手機 app
隨著新的一年到來,讓我們先來回顧一下 2014 年推薦給各位的 app 吧!
2014/7/30 Uber for Windows Phone 版本來囉!
2014/8/28 Windows Phone 使用者可以免費使用 Spotify 聽音樂
2014/10/16 Skype 推出全新的免費視訊傳訊 App - Skype Qik
2014/12/29 新版本 Microsoft Xim 1.3 同步至大螢幕共享照片!
2014/12/30 跨年派對怎麼辦?讓 Allrecipes 助你一臂之力吧!
今天要分享的是由將近 2000 位 Windows Phone使用者所投票得到的前三名 app!
第三名:檔案管理員 (得票率15%)
如果您習慣將資料分類整理,請試試看檔案管理員。
檔案管理員將會幫助您追蹤您所有的文件,並且允許您建立文件、瀏覽、更快速且方便地搜尋到您想找的文件資料。
一位投票者 Tilda Arnell 說道,他會投給檔案管理員是因為它讓我的生活變得簡單很多。
第二名:Office Lens (得票率31%)
Office Lens 這個 app 對於學生族群、辦公室工作者、或其他需要將黑板上或任何文件上的資訊快速存在自己筆記中的人來說非常重要及實用。
換句話說,這個 app 就像是您口袋中的一台掃描機,它可以將資料數位化並建立搜尋功能、同時也可以輕鬆將您的資料存取在 OneNote 中。
一位投給 Office Lens 的 Akash 分享心得說道:Office Lens 讓他在使用 Windows Phone 時相當自豪。
榮獲第一名的是:MovieCreator Beta (得票率40%)
誰不想成為一個電影製片人?我們內心的渴望可以透過 Moive Creator 得到滿足。
因為 Moive Creator 可以讓您把影片、照片、音樂或者其他你所喜歡的電影圖片整合在一起分享給你的朋友們觀看。
此外,Moive Creator 使用起來真的是超級方便也非常容易上手,讓製作影片的過程分成簡單的四步驟。
Elliott CL 分享她對於 MovieCreator 的看法認為:就算這款 app 還是處於 Beta 版本,但是她將會一直等待下去,等一個跟這款 app 一樣可以做出超棒成果的 app。