過去 6 週間に渡り、オンロード/オフロードの車種を中心に紹介してきたが、最後の収録車種アップデートとなる今週は、「Forza」シリーズ初登場となる伝説のイギリスの三輪車 Reliant Supervan、贅沢な木目調ラインを使用した Ford Super Deluxe Station Wagon、あらゆる環境を走破する Alumi Craft Class 10 Race Car など「Forza」シリーズとしては正に歴史的なドライビングを楽しめる 65 車種を公開。公開車種はゲーム追加コンテンツを含む 371 車種。オーストラリアの大地で、魅惑のロード トリップを楽しもう。
 

Week 6 公開車種リスト

公開済み車種リスト一覧

『Forza Horizon 3』製品ページはこちら >

~ Ibrahim Aladwan

Hello everyone, my name is Ibrahim Aladwan and I’m a support engineer on the Configuration Manager team. Today I’d like to take a minute and go through the update process in System Center Configuration Manager current branch (ConfigMgr 1511, ConfigMgr 1602, etc.) and demonstrate how things work from the client side of things.

Overview

When a client computer in the target collection for a deployment receives machine policy, the Software Update Client Agent starts an evaluation scan. The client agent downloads the content for any required software updates from a distribution point to the local client cache soon after it receives the deployment, but waits until after the software available time setting for the deployment before the software updates are available for installation. This differs for software updates in optional deployments (deployments that do not have an installation deadline), as they are not downloaded until a user manually starts the installation. When the configured deadline passes, the Software Updates client agent performs a scan to verify that the software updates are still required, and assuming they are, it then checks the local cache on the client computer to verify that the software update source files are still available and installs the updates. If the content was deleted from the client cache to make room for another deployment, the client re-downloads the software updates from the distribution point to the client cache. Software updates are always downloaded to the client cache regardless of the configured maximum client cache size. When the installation is complete, the client agent verifies that the software updates are no longer required, then sends a state message to the management point to indicate that the software updates are now installed on the client.

Taking a Closer Look

To get a better understanding of this, let’s take a look at the client log files and track the progress as we deploy KB 3176493. The client and site server components record process information in individual log files, and by default, client and server component logging is enabled in Configuration Manager. You can use the information in these log files to help you troubleshoot issues that might occur in your Configuration Manager environment. For additional information on these log files please refer to the following:

Technical Reference for Log Files in Configuration Manager

So here’s what KB 3176493 looks like when we start:

Software Update Scanning and Evaluation

When the Evaluation cycle is requested (manual or on schedule), entries similar to the following will appear in ScanAgent.log:

Message received: ‘<?xml version=’1.0′ ?>              <UpdateSourceMessage MessageType=’ScanByUpdateSource’>
<ForceScan>TRUE</ForceScan>
<UpdateSourceIDs>
<ID>{39B24983-D827-4C7C-8782-029410E9C146}</ID>
</UpdateSourceIDs>
</UpdateSourceMessage>’
ScanAgent

On the SQL Server, SQL profiler will show that Configuration Manager is executing the stored procedure MP_GetWSUSServerLocations:

RPC:Completed        exec MP_GetWSUSServerLocations N'{39B24983-D827-4C7C-8782-029410E9C146}’,N’167′,N’FCH’,N’FCH’,N’0′,N’server.contoso.local’         System Center 2012 Configuration Manager            SYSTEM    NT AUTHORITYSYSTEM          16              131           0                  38              1816         72              8/10/2016 1:24:05 AM
0X000000000700000032004D0050005F0047006500740057005300550053005300650072007600650072004C006F0063006100740069006F006E007300720000

This value is then returned to LocationService.log:

Calling back with the following WSUS locations        LocationServices
8/10/2016 1:24:05 AM        7956 (0x1F14) WSUS Path=’http://server.contoso.local:8530′, Server=’server.contoso.local’, Version=’167′        LocationServices

ScanAgent.log also shows the following:

*****Policy Change notification received for ToolUniqueID={39B24983-D827-4C7C-8782-029410E9C146}        ScanAgent        8/10/2016 1:24:01 AM
*****ScanByUpdates request received with ForceReScan=0, ScanOptions=0x00000008,  WSUSLocationTimeout = 604800        ScanAgent

ScanAgent then checks the update source and Time-To-Live (TTL) settings for the last scan results and submits a request for WSUS server location, then LocationService retrieves the WSUS location from the Management Point and returns the URL and the server name, as seen here in ScanAgent.log:

ScanJob({DCB47C9A-3D45-4495-8116-5EE9E0F3B4D2}): – – – – – -Locations requested for ScanJobID={DCB47C9A-3D45-4495-8116-5EE9E0F3B4D2} (LocationRequestID={6CBEFDD4-7390-4A41-AA4D-4D3F8B72111F}), will process the scan request once locations are available.        ScanAgent        8/10/2016 1:24:03 AM

*****WSUSLocationUpdate received for location request guid={6CBEFDD4-7390-4A41-AA4D-4D3F8B72111F}        ScanAgent

Next, the Windows Update scan is initiated and we see the following in ScanAgent.log:

*****ScanByUpdates request received with ForceReScan=0, ScanOptions=0x00000008, WSUSLocationTimeout = 604800        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
– – -Evaluating Update Status…        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:4d52d21e-e4a1-4043-bcda-69a696b2b257        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:4d52d21e-e4a1-4043-bcda-69a696b2b257        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:a12fff7b-aefc-4815-ab2e-0048ada4ea9e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:a12fff7b-aefc-4815-ab2e-0048ada4ea9e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:c071152f-3697-44f4-b77c-bf07519dd63e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:c071152f-3697-44f4-b77c-bf07519dd63e        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Found CategoryID of :0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:e6561a3e-2ee6-48e4-8770-78068771cfcb        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
CScanAgent::ScanByUpdates – Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:e6561a3e-2ee6-48e4-8770-78068771cfcb        ScanAgent        8/10/2016 1:26:41 AM        5148 (0x141C)

State messages are created for each software update that changed in compliance state, then state messages are sent to the Management Point as seen in StateMessage.log:

Adding message with TopicType 500 and TopicId 4d52d21e-e4a1-4043-bcda-69a696b2b257 to WMI        StateMessage        8/10/2016 1:25:53 AM        5148 (0x141C)
State message(State ID : 2) with TopicType 500 and TopicId 4d52d21e-e4a1-4043-bcda-69a696b2b257 has been recorded for SYSTEM        StateMessage        8/10/2016 1:25:53 AM        5148 (0x141C)
Successfully forwarded State Messages to the MP        StateMessage        5148 (0x141C)

We also see entries similar to the following in WUAHandler.log:

Its a WSUS Update Source type ({39B24983-D827-4C7C-8782-029410E9C146}), adding it.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Existing WUA Managed server was already set (http://FC-CM01.fourthcoffee.local:8530), skipping Group Policy registration.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Added Update Source ({39B24983-D827-4C7C-8782-029410E9C146}) of content type: 2        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Scan results will include superseded updates only when they are superseded by service packs and definition updates.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Search Criteria is (DeploymentAction=* AND Type=’Software’) OR (DeploymentAction=* AND Type=’Driver’)        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Async searching of updates using WUAgent started.        WUAHandler        8/10/2016 1:24:42 AM        7544 (0x1D78)
Async searching completed.        WUAHandler        8/10/2016 1:25:52 AM        1308 (0x051C)
Successfully completed scan.        WUAHandler        8/10/2016 1:25:52 AM        5148 (0x141C)

Installation

When a client computer in the target collection for the deployment receives the machine policy, machine policy including new or changed deployment assignment policy is downloaded. UpdatesDeployment.log receives modification event and triggers evaluation and installation process, as shown here:

Assignment {b8cf0a9f-3b46-4ce7-9712-b281aa88b953} has total CI = 16        UpdatesDeploymentAgent        8/10/2016 1:24:02 AM        7956 (0x1F14)
OnPolicyModify for assignment ({b8cf0a9f-3b46-4ce7-9712-b281aa88b953})…         UpdatesDeploymentAgent        8/10/2016 1:24:02 AM        7956 (0x1F14)
Update (Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257) Name (Cumulative Update for Windows 10 Version 1511 (KB3176493)) ArticleID (3176493) added to the targeted list of deployment ({b8cf0a9f-3b46-4ce7-9712-b281aa88b953})        UpdatesDeploymentAgent        8/10/2016 1:26:41 AM        5148 (0x141C)
Raising client SDK event for class CCM_SoftwareUpdate, instance CCM_SoftwareUpdate.UpdateID=”Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257″, actionType 11l, value NULL, user NULL, session 4294967295l, level 0l, verbosity 30l        UpdatesDeploymentAgent        8/10/2016 1:26:41 AM        5148 (0x141C)

UpdatesStore will check the status of each update and look for the source, then CIDownloader determines applicability for each update. This is shown in UpdateStore.log:

Queried Update (4d52d21e-e4a1-4043-bcda-69a696b2b257): Status=Missing, Title=Cumulative Update for Windows 10 Version 1511 (KB3176493), BulletinID=MS16-095, QNumbers=3176493, LocaleID=, ProductID=0fa1201d-4330-4fa8-8ae9-b877473b6441, UpdateClassification = 0fa1201d-4330-4fa8-8ae9-b877473b6441, ExcludeForStateReporting=FALSE.        UpdatesStore        8/10/2016 1:25:53 AM        4316 (0x10DC)
Querying update status of 2 updates.        UpdatesStore        8/10/2016 3:10:47 AM        6232 (0x1858)
Queried Update (4d52d21e-e4a1-4043-bcda-69a696b2b257): Status=Missing, Title=Cumulative Update for Windows 10 Version 1511 (KB3176493), BulletinID=MS16-095, QNumbers=3176493, LocaleID=, ProductID=0fa1201d-4330-4fa8-8ae9-b877473b6441, UpdateClassification = 0fa1201d-4330-4fa8-8ae9-b877473b6441, ExcludeForStateReporting=FALSE.        UpdatesStore        8/10/2016 3:26:49 AM        6232 (0x1858)
Queried Update (4d52d21e-e4a1-4043-bcda-69a696b2b257): Status=Installed, Title=Cumulative Update for Windows 10 Version 1511 (KB3176493), BulletinID=MS16-095, QNumbers=3176493, LocaleID=, ProductID=0fa1201d-4330-4fa8-8ae9-b877473b6441, UpdateClassification = 0fa1201d-4330-4fa8-8ae9-b877473b6441, ExcludeForStateReporting=FALSE.        UpdatesStore        8/10/2016 5:08:07 AM        3628 (0x0E2C)

UpdatesHandler then retrieves download settings and software update relationships, then calls to download content.

Entries similar to the following appear in UpdatesHanlder.log:

Bundle update (4d52d21e-e4a1-4043-bcda-69a696b2b257) is requesting download from child updates for action (INSTALL)        UpdatesHandler        8/10/2016 1:26:41 AM        7556 (0x1D84)
StateCore – bundle update (4d52d21e-e4a1-4043-bcda-69a696b2b257) state changed from (WAIT_CONTENTS) to (EXECUTE_READY) as child update state changed        UpdatesHandler        8/10/2016 3:10:43 AM        6548 (0x1994)
Bundle update (4d52d21e-e4a1-4043-bcda-69a696b2b257) is requesting download from child updates for action (INSTALL)        UpdatesHandler        8/10/2016 3:10:48 AM        4432 (0x1150)

Entries similar to the following appear in WUAHandler.log:

Going to search using WSUS update source.        WUAHandler        8/10/2016 3:10:49 AM        3688 (0x0E68)
Synchronous searching of all updates started…        WUAHandler        8/10/2016 3:10:49 AM        3688 (0x0E68)
Successfully completed synchronous searching of updates.        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
1. Update: 4d52d21e-e4a1-4043-bcda-69a696b2b257, 205 BundledUpdates: 1        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
Update: a12fff7b-aefc-4815-ab2e-0048ada4ea9e, 200 BundledUpdates: 0        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
1. Update (Missing): Cumulative Update for Windows 10 Version 1511 (KB3176493) (4d52d21e-e4a1-4043-bcda-69a696b2b257, 205)        WUAHandler        8/10/2016 3:11:00 AM        3688 (0x0E68)
Async installation of updates started.        WUAHandler        8/10/2016 3:12:58 AM        3688 (0x0E68)
Update 1 (4d52d21e-e4a1-4043-bcda-69a696b2b257) finished installing (0x00000000), Reboot Required? Yes        WUAHandler        8/10/2016 3:26:35 AM        4708 (0x1264)
Async install completed.        WUAHandler        8/10/2016 3:26:46 AM        5660 (0x161C)
Installation of updates completed.        WUAHandler        8/10/2016 3:26:46 AM        6232 (0x1858)

Then we get the content location and the following is logged in LocationService.log:

Calling back with the following distribution points        LocationServices        8/10/2016 3:09:02 AM        5648 (0x1610)
Distribution Point=’http://FC-CM01.fourthcoffee.local/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e’, Locality=’LOCAL’, DPType=’SERVER’, Version=’8325′, Capabilities='<Capabilities SchemaVersion=”1.0″><Property Name=”SSLState” Value=”0″/></Capabilities>’, Signature=’http://FC-CM01.fourthcoffee.local/SMS_DP_SMSSIG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e.1.tar’, ForestTrust=’TRUE’,        LocationServices        8/10/2016 3:09:02 AM        5648 (0x1610)
Filtering locations for request {E68DF60D-00D0-4330-9ECE-8742B48CB801}.        LocationServices        8/10/2016 3:09:02 AM        5648 (0x1610)

Then software update content is downloaded to the cache and the following is logged in DataTransferService.log:

UpdateURLWithTransportSettings(): OLD URL – http://FC-CM01.fourthcoffee.local/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e        DataTransferService        8/10/2016 3:09:02 AM        5648 (0x1610)
UpdateURLWithTransportSettings(): NEW URL – http://FC-CM01.fourthcoffee.local:80/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e        DataTransferService        8/10/2016 3:09:02 AM        5648 (0x1610)
DTSJob {252AF5CA-A261-49FA-82DB-50556214AEAC} created to download from ‘http://FC-CM01.fourthcoffee.local:80/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e’ to ‘C:Windowsccmcache1b’.        DataTransferService        8/10/2016 3:09:02 AM        5648 (0x1610)
DTSJob {252AF5CA-A261-49FA-82DB-50556214AEAC} in state ‘DownloadingManifest’.        DataTransferService        8/10/2016 3:09:02 AM        6548 (0x1994)
GET: Host=FC-CM01.fourthcoffee.local, Path=/SMS_DP_SMSPKG$/a12fff7b-aefc-4815-ab2e-0048ada4ea9e, Port=80, Protocol=http, Flags=133, Options=224        DataTransferService        8/10/2016 3:09:02 AM        4320 (0x10E0)

UpdatesDeploymentAgent then raises a state message (download complete) and calls WUAHandler to handle the software update installation via WUA. You can see this via the following entries in UpdatesDeployment.log:

ApplyCIs – JobId = {301925A8-283F-42AE-95F0-272A10359929}        UpdatesDeploymentAgent        8/10/2016 3:10:47 AM        4432 (0x1150)
……
Update (Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257) Progress: Status = ciStateInstalling, PercentComplete = 10, DownloadSize = 0, Result = 0x0        UpdatesDeploymentAgent        8/10/2016 3:19:31 AM        4432 (0x1150)
Update (Site_39B24983-D827-4C7C-8782-029410E9C146/SUM_4d52d21e-e4a1-4043-bcda-69a696b2b257) Progress: Status = ciStateInstalling, PercentComplete = 100, DownloadSize = 0, Result = 0x0        UpdatesDeploymentAgent        8/10/2016 3:24:54 AM        3688 (0x0E68)

CUpdatesJob({301925A8-283F-42AE-95F0-272A10359929}): Job completion received.        UpdatesDeploymentAgent        8/10/2016 3:26:50 AM        4320 (0x10E0)
CUpdatesJob({301925A8-283F-42AE-95F0-272A10359929}): Delete job from WMI        UpdatesDeploymentAgent        8/10/2016 3:26:50 AM        4320 (0x10E0)

WUA then installs the updates and we see the following in CBS.log:

2016-08-10 03:13:02, Info CBS Opened cabinet package, package directory: \?C:WINDOWSSoftwareDistributionDownloadb0e4281cd82e8b66165a25b8a4ae6648, sandbox location: \?C:WINDOWSSoftwareDistributionDownloadb0e4281cd82e8b66165a25b8a4ae6648inst, cabinet location: \?C:WINDOWSSoftwareDistributionDownloadb0e4281cd82e8b66165a25b8a4ae6648Windows10.0-KB3176493-x86.cab, manifest location: \?C:WINDOWSSoftwareDistributionDownloadb0e4281cd82e8b66165a25b8a4ae6648instupdate.mum

2016-08-10 03:14:36, Info CBS Extracting all files from cabinet \?C:WINDOWSSoftwareDistributionDownloadb0e4281cd82e8b66165a25b8a4ae6648instCab_1_for_KB3176493.cab

Next, state messages are created for each software update that changed in compliance state, and these state messages are sent to the management point as seen in StateMessage.log:

State message(State ID : 3) with TopicType 500 and TopicId 4d52d21e-e4a1-4043-bcda-69a696b2b257 has been recorded for SYSTEM        StateMessage        8/10/2016 5:08:07 AM        3784 (0x0EC8)

At this point the updates are installed and the hierarchy is updated.

More Information

For more information about state message and ID, please see the table below.

Ref: State Messages in Configuration Manager 2007

For more information on Software Updates, see Introduction to Software Updates in Configuration Manager

Ibrahim Aladwan, Support Engineer
Microsoft System Center Configuration Manager

Hi all,

The App-V event log holds lots of great information but the challenge you my face is you have to jump between logs to figure out what actually happened on the client if errors occur.

There are 3 default logs that you can use when troubleshooting, they are the Admin, Operational and Virtual Applications log.

The challenge with having three logs is that you have to look into them individually, you can’t see them all together unless you are using logman tracing.

https://blogs.technet.microsoft.com/virtualshell/2016/05/16/app-v-5-0-etw-tracing-automation-update/

Following on from a post I did about the Operational Log, there are times where when you collect event log information you don’t want to collect certain events that create “noise” in your trace, these were explaining in the following post.

https://blogs.technet.microsoft.com/virtualshell/2016/04/12/app-v-5-operational-log-usage/

The post above explains the filter to remove the streaming events, with the App-V 5.1 client there are some new event ids which are quite chatty so they have been included below:

So you know how to do a filter manually using the GUI but how about via script? With PowerShell there is a cmdlet which collects event log information which is called “Get-WinEvent” and it has a great parameter called “-FilterXml” and its explained below.

-FilterXml
Uses a structured XML query to select events from one or more event logs.

To generate a valid XML query, use the Create Custom View and Filter Current Log features in Event Viewer. Use the items in the dialog box to create a query, and then click the XML tab to view the query in XML format. You can copy the XML from the XML tab into the value of the FilterXml parameter. For more information about the Event Viewer features, see Event Viewer Help.

Typically, you use an XML query to create a complex query that contains several XPath statements. The XML format also allows you to use a "Suppress" XML element that excludes events from the query. For more information about the XML schema for event log queries, see the following topics in the MSDN (Microsoft Developer Network) library.

-- "Query Schema": http://go.microsoft.com/fwlink/?LinkId=143685
-- "XML Event Queries" in "Event Selection": http://go.microsoft.com/fwlink/?LinkID=143608

To use the filter using Get-WinEvent you need to get the XML you want to use, so if you create your filter in Event Viewer and then select the “XML” tab you can see the generated XML with the filtering out of Operational Log event IDs (14023,14024,14025,14026,101,102) and its filtering on the last 24 hours of logs.

So you have your filter you can now use Get-WinEvent to collect the Operational Log information with the filter set.

$FilterXML_Operational = @"
<QueryList>
  <Query Id="0" Path="Microsoft-AppV-Client/Operational">
    <Select Path="Microsoft-AppV-Client/Operational">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
    <Suppress Path="Microsoft-AppV-Client/Operational">*[System[(EventID=101 or EventID=102 or EventID=14023 or EventID=14024 or EventID=14025 or EventID=14026)]]</Suppress>
  </Query>
</QueryList>
"@

Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue

Note: I’ve used the -ErrorAction SilentlyContinue due to the fact that if there is no information it will display an error stating there are no events.

To expand this to the Admin Log and Virtual Applications log the following code can be used:

$FilterXML_Admin = @"
<QueryList>
  <Query Id="0" Path="Microsoft-AppV-Client/Admin">
    <Select Path="Microsoft-AppV-Client/Admin">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>
"@

Get-WinEvent -FilterXml $FilterXML_Admin -ErrorAction SilentlyContinue

$FilterXML_VirtApps = @"
<QueryList>
  <Query Id="0" Path="Microsoft-AppV-Client/Virtual Applications">
    <Select Path="Microsoft-AppV-Client/Virtual Applications">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>
"@

Get-WinEvent -FilterXml $FilterXML_VirtApps -ErrorAction SilentlyContinue

Now we have all three event you can join these together and sort them by “TimeCreated” so that it shows them in chronological order.

$GWE_All = Get-WinEvent -FilterXml $FilterXML_Admin -ErrorAction SilentlyContinue

$GWE_All += Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue

$GWE_All += Get-WinEvent -FilterXml $FilterXML_VirtApps -ErrorAction SilentlyContinue

$GWE_All | sort TimeCreated -Descending

This will output the following data:

It’s great to show this in PowerShell but did you notice that only four column properties have been specified in the output to screen? What if you want more data from the event log to be shown?

You can run the Get-WinEvent command with the Get-Member switch which will show all the properties available on the object:

Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue | get-member

This will show all the properties that you can use on the output.

To specify the properties that you want to output you need to select the objects that you require, for demo purposes I’ve used the following:

$GWE_All | select TimeCreated,Id,LogName,TaskDisplayName,LevelDisplayName,Message

Now we have all the properties available there are better ways of formatting the output, you may like Out-GridView or ConvertTo-Html so I’ve included them both in the script below.

<#
.DISCLAIMER The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
#>

# Adding threading culture change so that get-winevent picks up the messages, if PS culture is set to none en-US then the script will fail
[System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"

$FilterXML_Admin = @"
<QueryList>
  <Query Id="0" Path="Microsoft-AppV-Client/Admin">
    <Select Path="Microsoft-AppV-Client/Admin">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>
"@

$GWE_All = Get-WinEvent -FilterXml $FilterXML_Admin -ErrorAction SilentlyContinue

$FilterXML_Operational = @"
<QueryList>
  <Query Id="0" Path="Microsoft-AppV-Client/Operational">
    <Select Path="Microsoft-AppV-Client/Operational">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
    <Suppress Path="Microsoft-AppV-Client/Operational">*[System[(EventID=101 or EventID=102 or EventID=14023 or EventID=14024 or EventID=14025 or EventID=14026)]]</Suppress>
  </Query>
</QueryList>
"@

$GWE_All += Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue

$FilterXML_VirtApps = @"
<QueryList>
  <Query Id="0" Path="Microsoft-AppV-Client/Virtual Applications">
    <Select Path="Microsoft-AppV-Client/Virtual Applications">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>
"@

$GWE_All += Get-WinEvent -FilterXml $FilterXML_VirtApps -ErrorAction SilentlyContinue

$GWE_All = $GWE_All | sort TimeCreated -Descending

#################
# Out-GridView
#################

$GWE_All | select TimeCreated,Id,LogName,TaskDisplayName,LevelDisplayName,Message | Out-GridView

#################
# Convertto-Html
#################

# HTML output path and name
$HTML_Output =  "c:tempallEL.html"

# Style Sheet for HTML Report
$CSS = "<style>"
$CSS = $CSS + "BODY{background-color:white;font-family:Arial;}"
$CSS = $CSS + "TABLE{border-width: 1px;border-style: solid;border-color: #00668a;border-collapse: collapse; font-family:Arial; font-size:12px;}"
$CSS = $CSS + "TH{height: 20px;border-width: 1px;padding: 0px;border-style: solid;border-color: #00668a;background-color:#00668A; color:white; font-size:12px;}"
$CSS = $CSS + "TD{border-width: 1px;padding: 4px;border-style: solid;border-color: #00668a;background-color:PaleBlue; vertical-align:top;}"
$CSS = $CSS + "</style>"

$GWE_All | select TimeCreated,Id,LogName,TaskDisplayName,LevelDisplayName,Message | ConvertTo-Html -head $CSS -body "<H3>All App-V 5 Event Logs</H3>" | Out-File "$HTML_Output"

invoke-item $HTML_Output

Out-GridView will be displayed like this:

ConvertTo-Html will show something like this:

SCRIPT DISCLAIMER
The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.

This helps us internally troubleshoot the App-V 5 client as it allows us to see everything in a single view, so I hope it helps you as well.

David Falkus | Senior Premier Field Engineer | Application Virtualization, PowerShell, Windows Shell

In Exchange 2010 and older (legacy exchange), when you migrate a public folder to O365, it makes a change that causes message tracking to only show the initial receive event when running message tracking against the legacy namespace.

Scenario

A Public Folder with a Primary SMTP email address of PF1@contoso.com gets migrated to O365. You are testing mail flow from an application that sends through your On-Premises environment. When you kick off message tracking and list PF1@contoso.com as the recipient, the logs will return the first receive event, but you do not see any sends or any other events.

Why is this happening?

First of all, when you send a message to a migrated public folder from on-premise Exchange, the first thing it does when received by the Exchange server is to kick off a process called the PFResolver. This process locates the O365 address, something like PF1@contoso.mail.onmicrosoft.com, and then reroutes the message to that address, stamping it as the recipient. It then adds an ORCPT attribute to the RCPT TO: entry and populates that with the legacy address. So in the protocol logs it would look as such:

2016-08-07T23:59:55.790Z,Outbound to Office 365,08D14E32D1DC272C,42,10.0.0.1:57888,207.46.163.138:25,>RCPT TO:<PF1@contoso.mail.onmicrosoft.com> ORCPT=rfc822;PF1@contoso.com

Message tracking only uses the RCPT TO: address. It does not look for the ORCPT address. So when you search on the Legacy address, the only message that has that is the initially sent message when it is first received by Exchange before the PFResolver is run.

So what do I do to see the whole message trace?

In a nutshell, you have to run two separate message traces. First, one with the Legacy email address, and second, on with the O365 address.

I.E.:

Get-MessageTrackingLog -Recipients “PF1@contoso.com”

Get-MessageTrackingLog -Recipients “PF1@contoso.mail.onmicrosoft.com”

This will give you the initial receive and then all other events where the message had been resolved to the O365 address.

VM Scale Sets enable you to deploy and manage multiple VMs as a set. Instead of provisioning multiple individual VMs, you provision a Scale Set based on an image, just like a regular VM. The Azure platform then provisions and de-provisions VMs based on that image as needed. High availability, load balancing, and scaling are managed by the Azure platform by integrating with Azure Autoscale and the Azure Load Balancer. This makes VM Scale Sets ideal for server clusters or farms that need to scale automatically, such as a farm of web servers, rendering capacity for animations, etc.

Since this was previewed last March, we are seeing VM Scale Sets (VMSS) being used in lots of places not only within Microsoft, but also among many of our largest consumers of Cloud services. As you all know the stories are constantly evolving and changing based on what our customers tell us they need. To help us decide if VM Scale Sets are appropriate to use for VMs, I made this comparison list for myself and my customers to look at the Pros and Cons (for now) that should be considered.  As to when the “cons” will become “pros”; that is a closely guarded secret.  I will just say this much: Stay tuned and watch MS Ignite this September and someone may tell you something that may happen

WHY VM Scale Sets versus Virtual Machines?

Now, let’s take a look at the Pros and Cons of using VM Scale Sets.

PROS

• VM Scale Sets utilizes Horizontal Scaling aka Scale In and Scale Out
  • Where the number of VMs is altered depending on the workload
    • You can also scale based on other criteria like date/time
  • A scale out event will only take place when the average CPU across all the VMs in a scale set exceeds the threshold value, over the time internal defined in the Autoscale rules.
    • If CPU is the performance metric you choose. You can scale on a range of metrics.
• You can do Vertical Scaling which is…
  • increasing or decreasing virtual machine (VM) sizes in response to a workload
  • Read more at Vertical autoscale with Virtual Machine Scale sets
• Best for Stateless applications
  • Stateful PaaS services like Service Fabric run on scale sets. Stateful applications run on scale sets, though the application has to take on some state management.
• VM scale set is created inside a VNET and individual VMs in the scale set are not allocated public IP addresses.
  • This is a good thing because
    • you don’t generally want the expense and management overhead of allocating separate public IP addresses to all the stateless resources in your compute grid
    • and you can easily connect to these VMs from other resources in your VNET
    • including ones which have public IP addresses like load balancers or standalone virtual machines.
• Implicitly set for 5 Fault and Update Domains
• Anywhere you can run a VM, you can run
• Integrate with Webhooks

CONS

• No current support to attach Data Disks, but in preview now, so coming soon!
• Vertical Scaling takes a little bit of messaging and is not automatic
• Autoscale currently limited to CPU% performance within x minutes
  • this is only a portal limitation.
• Limited to 20 disks per Storage Accounts, versus 40 – but can be overridden
  • If you turn off overprovisioning, you can go up to 40
  • To turn overprovisioning off, ensure you have the following string in your template: “overprovision”: “false”
• Currently no Public IP per VM, only at the Load Balancer
• Currently no disk encryption
• VM Extension sequencing can be a problem with Autoscale
  • particularly with Apt-Get, since it can only run one process at a time and Autoscale would try to run in parallel
  • Read about this and workarounds at Extension sequencing in Azure VM Scale Sets
    • Extension sequencing support is planned this year.

RELATED TOOLS & TEMPLATES

• Azure Virtual Machine Scale Set Editor
• ASCii VM Scale Set DashBoard
• VM Scale Set Sample Templates at Azure QuickStart Templates

What is a GalSync Solution?

GalSync is a Global Address List Synchronization Solution.  It is a way for Microsoft Exchange Organizations to share their Global Address Lists (GAL).  Additionally, once a GalSync Solution is setup, it provides the ability to share Free/Busy information.

NEW GALSYNC SOLUTION – Contacts are not provisioning

Contacts not provisioning is a very common issue that is seen within a GalSync Solution.  We normally see this in new GalSync Solutions because something has been missed in the configuration.  The following information provides guidance on things to check to get GalSync working.

1. Validate that “Enable Provisioning Rules Extension” is checked in the Tools > Options Dialog.
2. Ensure that you have a Target Container selected on the Configure GAL properties page of the GalSync Management Agent.

1. Here is a TechNet Wiki that discusses the issue: http://social.technet.microsoft.com/wiki/contents/articles/15915.troubleshooting-fim-galsync-no-contacts-to-provision.aspx

1. Here is a TechNet Wiki that discusses the issue: http://social.technet.microsoft.com/wiki/contents/articles/15401.troubleshooting-galsync-contacts-are-not-being-created-for-new-users.aspx

GALSYNC RELATED SYNCHRONIZATION ERRORS

1. EXTENSION-UNEXPECTED-ATTRIBUTE-VALUE

1. mv-deletion: msExchDynamicDistributionList: http://social.technet.microsoft.com/wiki/contents/articles/19034.troubleshooting-fim-extension-unexpected-attribute-value-mv-deletion-msexchdynamicdistributionl.aspx

GALSYNC RELATED EXPORT ERRORS

In many cases, GalSync Export Errors are related to the Exchange PowerShell CMDLET called Update-Recipient.  In Exchange 2010, FIM utilizes WinRM to remotely execute the Exchange PowerShell CMDLET remotely on the Exchange 2010/2013 Client Access Server.  The following will assist in troubleshooting WinRM.

WinRM Troubleshooting: https://blogs.technet.microsoft.com/jonjor/2009/01/09/winrm-windows-remote-management-troubleshooting/

1. STOPPED-DLL-EXCEPTION: For stopped-dll-exception errors, you will want to review the Application Event Log to get more details about the error that is actually occurring. 

1. The property value you specified, “-1073740026”, isn’t defined in the Enum type “Nullable`1”. Property Name:  RecipientDisplayType: http://social.technet.microsoft.com/wiki/contents/articles/17909.troubleshooting-fim-the-property-value-you-specified-1073740026-isn-t-defined-in-the-enum-type-nullable1.aspx
2. WINRM client received HTTP status code of 403 from the remote WS-Management service: http://social.technet.microsoft.com/wiki/contents/articles/11231.troubleshooting-stopped-dll-exception-the-winrm-client-received-an-http-status-code-of-403-from-the-remote-ws-management-service.aspx
3. WINRM cannot process the request: Access Denied: http://social.technet.microsoft.com/wiki/contents/articles/15091.troubleshooting-fim-stopped-dll-exception-winrm-cannot-process-the-request-access-denied.aspx
4. WINRM: cannot process the request.  The following error occurred while using Kerberos Authentication.  The network path was not found.  : http://social.technet.microsoft.com/wiki/contents/articles/12463.troubleshooting-fim-sync-stopped-dll-exception-the-following-error-occurred-while-using-kerberos-authentication.aspx
5. STOPPED-DLL-EXCEPTION TROUBLESHOOTER: http://social.technet.microsoft.com/wiki/contents/articles/8759.fim-troubleshooting-stopped-dll-exception-troubleshooter-document.aspx

1. Extension-Dll-Timeout: https://blogs.msdn.microsoft.com/ms-identity-support/2014/02/04/troubleshooting-galsync-ma-exchange-2010-provisioning-extension-dll-timeout-error-on-export/

1. Active Directory response: 00002098: SecErr (INSUFF_ACCESS_RIGHTS): http://social.technet.microsoft.com/wiki/contents/articles/12703.troubleshooting-fimgalsync-active-directory-response-00002098-secerr-dsid-03150bb9-problem-4003-insuff-access-rights-data-0.aspx
2. Event ID 6500 – name is not valid for Alias: http://social.technet.microsoft.com/wiki/contents/articles/11427.fim-troubleshooting-ma-extension-error-event-id-6500-name-is-not-valid-for-alias.aspx

1. mv-constraint-violation (msExchSafeSenderHash) during GalSync: 10733.troubleshooting-mv-constraint-violation-msexchsafesenderhash-during-galsync.aspx

1. Insufficient access rights to perform operation: http://social.technet.microsoft.com/wiki/contents/articles/7612.galsnc-permission-issue-insufficient-access-rights-to-perform-the-operation.aspx
2. Permissions for GalSync User: http://social.technet.microsoft.com/wiki/contents/articles/4868.permissions-for-galsync-user-ma-user-account.aspx

1. GalSync creates mail-enabled contacts that are not seen in GAL: http://social.technet.microsoft.com/wiki/contents/articles/4232.galsync-creates-contacts-that-are-not-seen-in-the-gal.aspx

1. LegacyExchangeDN is not populated:
   We see this issue happen when the Exchange PowerShell CMDLET fails.  In most cases, you can find additional information about the issue in the Application Event Log.  Here is a Microsoft TechNet Wiki that describes more of the information. http://social.technet.microsoft.com/wiki/contents/articles/7773.galsync-troubleshooting-legacyexchangedn-is-not-populated.aspx

GALSYNC CUSTOMIZATION

1. How to customize TargetAddress on Export Attribute Flow: http://social.technet.microsoft.com/wiki/contents/articles/4418.how-to-customize-targetaddress-on-export-attribute-flow-in-galsync.aspx
2. How to flow msExchHideFromAddressList but filter if the value is true:
3. Sharing GALs and Free/Busy Information between Exchange Orgs: http://social.technet.microsoft.com/wiki/contents/articles/7377.fim-2010-sharing-gals-and-freebusy-info-between-exchange-orgs.aspx 

IAMSUPPORT RESOURCES

• Identity and Access Management Support Team Blog:
• Global Address List  (GalSync) Resources:
• On-Premises Identity and Access Management: https://www.microsoft.com/en-us/cloud-platform/microsoft-identity-manager#fbid=2VvP26FRhhI
• Resource Page Wiki Page Index: http://social.technet.microsoft.com/wiki/contents/articles/11405.fim-reference-fim-resource-wiki-page-index.aspx

GALSYNC PROVISIONING TO EXCHANGE 2007 and/or ECHANGE 2010

So, in support we deal with a lot of issues pertaining to Exchange 2007 and Exchange 2010 provisioning.  These can be educational calls as well as troubleshooting calls, to help understand the changes that happended with Exchange 2007 and Exchange 2010.  The following wiki articles will assist in better understanding how to provision to Exchange 2007 and Exchange 2010.

FIM-GALSYNC: Exchange 2007 Provisioning

FIM-GALSYNC: Exchange 2010 Provisioning

In addition to that, I have posted information dealing with one of the most common errors when provisioning to Exchange 2007 and/or Exchange 2010 and that is the infamous “ma-extension-error”.

FIM-GALSYNC: ma-extension-error

Please let me know if these are helpful.

Aug

26

Script Download:
The script is available for download from https://gallery.technet.microsoft.com/How-to-save-from-word-file-46b72800.

The sample code demonstrates how to save images from word file into a certain folder.

You can find more All-In-One Script Framework script samples at http://aka.ms/onescriptingallery

Aug

26

Script Download:
The script is available for download from https://gallery.technet.microsoft.com/Recyle-the-application-4a9a3baa.

The sample code demonstrates How to recyle the application pool if the response time of website is high.

You can find more All-In-One Script Framework script samples at http://aka.ms/onescriptingallery

執筆者: Mikkel Riis (Sr. Product Marketing Manager, Cloud Platform Marketing)

このポストは、8 月 10 日に投稿された Engineering the move to cloud-based services の翻訳です。

移行するネットワークのサポート: David Lef への Q&A ブログ シリーズ

今回が第 2 回目となる本ブログ シリーズでは、マイクロソフトの IT 部門でプリンシパル ネットワーク アーキテクトを務める David Lef が、従来のインフラストラクチャから完全にワイヤレスなクラウド コンピューティング プラットフォームへと移行するネットワークのサポートについてご説明します。マイクロソフトの IT 部門は、世界各地の 900 か所の拠点と 220,000 人のユーザーのサポートを担当しています。David Lef は、変化するお客様のニーズや最新のアプリケーション デザインをサポートする Azure のクラウド ベース モデルへのネットワーク トポロジの進化について、ユーザーが理解を深める手助けをしています。

今回の記事では、IT 部門がサポートするサービスや環境のクラウド ベース サービスへの移行に影響する主な要因について、ネットワーク関連のベスト プラクティスやプロセスに重点を置いてご説明します。

Q: ご自身の現在の役割とサポートしている環境について教えてください。

A: 私はマイクロソフトの IT 部門でプリンシパル ネットワーク アーキテクトを務めています。IT 部門は世界各地の約 900 か所のサイトとそのサイト間を接続するネットワーク コンポーネントをサポートしており、マイクロソフトの従業員と委託先のベンダーの合計 220,000 名以上がこれらのサイトを利用しています。また、マイクロソフトのネットワークでは 2,500 以上のアプリケーションやビジネス プロセスをサポートしています。IT 部門はマイクロソフトに有線、無線、リモート ネットワーク アクセスを提供し、(ネットワーク境界を含む) ネットワーク全体にネットワーク セキュリティを実装しているほか、クラウドの Microsoft Azure への接続を提供しています。また、社内の Windows Server Active Directory フォレストと同期する単一の Azure Active Directory テナントを使用した大規模な Azure テナントをサポートしています。オンプレミスのデータセンターから Azure への複数の接続には ExpressRoute を使用しています。Azure テナントでは非常に広範な Azure リソースをサポートしており、その中には一般向けに公開されているリソースも、マイクロソフト社内のアプリやサービスとして Azure プラットフォーム上でホストされているリソースもあります。

Q: オンプレミスのサービスを Azure のクラウド ベース サービスに移行するにあたってのネットワーク関連の最大の課題は何でしょうか。

A: 第一に、トラフィック パターンが根本的に変化しました。従来は、ネットワーク トラフィックの大半を自社ネットワークとデータセンターでホストし、従業員が自社ネットワークに接続していないときに必要なアプリやサービスを利用できるように、インターネットから自社ネットワークへのアクセスを選択的に許可していました。自社ネットワークで送受信するトラフィックの観点から言えば、従来のインターネット コンテンツにアクセスするユーザーもいれば、仮想プライベート ネットワーク (VPN) を使用して自社ネットワークにアクセスするユーザーもいました。しかし、現在はオンプレミスのデータセンター インフラストラクチャの大部分を Azure でホストし、ユーザーにアクセスを許可する方法を選択するという手法に移行しています。

第二に、ネットワーク境界のトラフィックが大幅に増加したことが挙げられます。境界の帯域幅は数年前の 5 倍以上になりました。オンプレミスのデータセンターはトラフィックのハブではなくなり、マイクロソフトの新規プロジェクトでは、クラウドがアプリやインフラストラクチャの既定の場所になっています。現在のトラフィック パターンは、主に Azure データセンターへのトラフィックを中心に展開しています。そのため、当然のことながら、境界では堅牢で広帯域幅の接続が必要とされるようになりました。従来ユーザーが自社ネットワークからアクセスしていたリソースが Azure でホストされるようになった現在でも、アプリやサービスの応答性はこれまでと変わらないレベルを維持しています。

マイクロソフトでは、アプリやサービスを順次オンプレミスのデータセンターから Azure に移行しており、その移行が続く中で Azure とオンプレミスのデータセンターとの接続に関する要件も変化しています。さらに、Azure に移行するインフラストラクチャが増加するにつれて、Azure とデータセンターのパイプラインは縮小しています。移行チームでは、可能な限り多くのリソースをサービスとしてのソフトウェア (SaaS) やサービスとしてのプラットフォーム (PaaS) に移行しており、SaaS や PaaS が即座にメリットをもたらさない場合には、単純にオンプレミスのインフラストラクチャ コンポーネントを Azure のサービスとしてのインフラストラクチャ (IaaS) である Virtual Machines や Virtual Network に移行しています。

これらのアプリやサービスを移行するうえで重要になるのがクラウドでの再設計について分析することです。エンジニアリング チームは可能な限りクラウド向けに設計やアーキテクチャを見直しています。インターネット ベースのトラフィックは自社ネットワーク インフラストラクチャの場合よりも高レイテンシとなる可能性があるため、その点を考慮して設計を行い、想定される変更点についてユーザーに説明することが重要です。

Q: Azure ベースのクラウド提供モデルでは、どのようにして十分なサービス レベルを確保していますか。

A: ネットワーク コンポーネントはサービス レベルに大きく影響しますが、本当の出発点となるのは Azure ベースのリソース向けのサービス設計です。Azure への接続は事実上はインターネット接続であるため、Azure でホストされているサービスは可能な限りすべてインターネット ベースのソリューションとして設計されています。前述した高レイテンシへの対応に加えて、再設計のプロセスには、接続に何らかの障害が発生した場合の再試行ロジック、データのキャッシュとプリフェッチ、クライアント接続全体のデータ圧縮が含まれます。

サービス設計が完了したら、ネットワーク側で堅牢な接続を確保するために尽力します。マイクロソフトでは、多数の拠点に ExpressRoute を広範に使用しており、その接続を使用するリソース (サーバーまたはユーザー) と物理的に可能な限り近い場所に ExpressRoute へのホップを設置しています。そのためには、マイクロソフトの拠点の近くにコロケーション施設があるネットワーク サービス プロバイダーを利用します。マイクロソフトの拠点には従来のハブ アンド スポーク型のネットワーク アーキテクチャを採用せず、ネットワーク バックボーン間では不要なトラフィックの移動を回避するようにしています。プロバイダーのインフラストラクチャが限定されている場合や成熟度が非常に低い場合を除き、少ないホップ数でインターネットに迅速に接続できるほうが得策であることが明らかになっています。

マイクロソフトは自社環境を徹底的に監視しています。Azure SaaS および PaaS で実行する最新のアプリがそれらのプラットフォームで提供される組み込みのインストルメンテーションを使用するように設計し、それらのサービスに組み込まれている代理トランザクションを活用したり、System Center 製品や Azure の Operations Management Suite を利用して独自の代理トランザクションを構築したりしています。これにより、集約型および非集約型のインフラストラクチャを包括的に把握することができます。マイクロソフトでは、Azure でホストされているクラウド サービスについて、マイクロソフトがプロバイダーであり、一般ユーザーとマイクロソフトのすべての従業員が顧客であると考えています。

Q: 地域によって課題はどのように異なりますか。その違いは、クラウド ベースのサービスに移行してから変化しましたか。

A: 地域による課題では、サービスの配置が非常に重要な考慮事項です。マイクロソフトでは、特定のサービスのクライアントがいる場所やアプリ間の依存関係を考慮して計画を行います。たいていの場合、クライアントから 1,000 km 以内に最低でも 1 つの Azure データセンターが存在するため、ビジネス継続性と災害復旧の計画にはそれを利用します。その点においては、Azure に組み込まれている地理冗長性および回復性のコンポーネントも役立ちます。

純粋なネットワークの観点から言えば、Azure データセンターに可能な限り近い場所にレイヤー 3 の管理機能を配置するようにしています。これにより、Azure へのトラフィックを最大限に制御し、そのトラフィックの問題を適切に把握することができます。

Q: クラウド ベースのサービスへの移行時に、ユーザーへの普及や支持の獲得はどのように促進していますか。

A: Azure チームは、Azure 全体のエクスペリエンスに関してさまざまなガイダンスを提供しています。ユーザー エクスペリエンスについては、Azure に移行したアプリやサービスに関する正確な目標をユーザーに伝えるように最善を尽くします。多くの場合、Azure に移行したアプリの全般的なユーザー エクスペリエンスは向上するため、移行による悪影響というよりは、Azure でホストされるアプリへのアクセス方法やエクスペリエンスがどのように変化するかを説明することになります。クラウドでアプリを利用できるようにすることで、新しい機能やアプリの使用方法が生まれることをユーザーが理解できるようにします。マイクロソフトは、複数のデバイス プラットフォームからのモバイル アクセスを可能にするユーザー エクスペリエンスの提供に取り組んでいます。ここでカギとなるのは、場所や時間を問わずにあらゆるものにアクセスできるようにするという考え方です。その格好の例として、クラウド サービスのライセンス プラットフォームの再設計が挙げられます。詳細については、こちらのケース スタディ (英語) をご覧ください。

Azure への移行全般に関して、マイクロソフトの IT 部門は十分な人員とコストを割き、毎回の移行をスムーズに進められるようにしています。これらのリソースは、技術的な移行作業やトレーニングのほか、アプリやサービスをオンプレミスでホストしていたときと同様、またはそれ以上に適切にビジネス プロセスを実行するための取り組みに利用されています。

Q: この新しい提供モデルをサポートするために、IT チームはどのように変化しましたか。

A: 最大の変化は従来の IT 機能を大々的に廃止または選別することだと考える人は多いものの、マイクロソフトの実情は少々異なります。現在でも拠点全体をサポートするネットワーク インフラストラクチャを利用しており、データセンターも一晩でなくなるわけではありません。データセンターのサーバー数が 10 台でも 10,000 台でも、引き続き災害復旧およびビジネス継続性のプロセスを実行する必要があり、そのためには IT サポートが必要です。とはいえ、オンプレミスのインフラストラクチャのサポートに関するニーズは確かに変化しました。高度なサポートを担当するチームの多くは別のプロジェクトに移行しており、その中には Azure 関連のプロジェクトも含まれます。多くのマイクロソフトの従業員はスキルを向上するチャンスを与えられ、保守管理から開発やイノベーションへと焦点を移しています。

Azure では、IT 部門の責任は細分化されました。IT スタッフは各自の専門分野でトップ レベルのサポートを提供するべく取り組んでおり、すべてのスタッフが環境やソリューションについて包括的な知識を備えている必要はなくなりました。Azure ネットワークのエキスパートは担当する製品や環境の知識を活用してサービスを提供し、Azure アプリのエキスパートはネットワークの状況を具体的に把握していなくてもアプリの分野で同様にサービスを提供することができます。もちろん、チーム全体で高度な知識を共有していますが、リソースやソリューションはプラグ アンド プレイ ソリューションのように簡単に利用できるようになったため、チームの敏捷性が向上し、より効率的にニーズに対応したり、新規プロジェクトを開始したりできるようになりました。IT チームは物理サーバーの構築やネットワーク用ハードウェアのインストールを待つ必要はありません。必要なものを要求するだけで、Azure によってリソースが生成されるからです。

関連情報

以下はこのブログ シリーズの他の記事です。

• 最先端のワーク スタイルを実現するネットワーク アーキテクチャのサポート (英語)

マイクロソフトの IT 部門がどのようにネットワーク アーキテクチャを進化させているかについてはこちら (英語) をご覧ください。

待望の Windows 10 日本語試験 (70-697) が配信開始となりました。この 70-697 試験に合格するだけで、マイクロソフト認定スペシャリスト資格を取得できます。

また、MCSA: Windows 8 認定資格を既にお持ちの方がこの 70-697 試験に合格すると、最新の MCSA: Windows 10 認定資格を取得できます。

※ MCSA: Windows 8 資格および要件となる試験は、2016 年 12 月 31 日で終了します。

前提資格をお持ちでない方が MCSA: Windows 10 資格を取得するには、697 試験と 698 試験の両方に合格する必要があります。

70-697 試験に対応する認定トレーニングコースの日本語版 (23687-1, 23697-2) も出ていますので、開講予定については Windows テクノロジを扱う、お近くの認定ラーニング パートナー各スクールまでお問い合わせください。本件についてはこちらのファイル (PDF ファイル / 644 KB) からもご確認いただけます。

For those of you in Sydney, head on over to register for Innovation Days to hear expert present based on their real world experience in short action packed sessions. Content will focus on the following topics:  

Among other great new features in the OOB HTML Portal mentioned here, https://blogs.technet.microsoft.com/antoni/2016/04/06/the-new-html5-based-self-service-portal-ssp-in-system-center-2012-r2-service-manager-ur8/ one of those is the fact that query results are not loaded initially with the page:

Note, this uses the ‘Raise Incident on Behalf of’ Request Offering example that I documented here a little while ago: http://aka.ms/behalf

Required Refresh in new HTML SSP:

Whenever you use a ‘query results’ field which allows you to pick a given object from the CMDB (a user you are raising an incident for in the example below), the available objects are not loaded until you hit the blue refresh button:

In the old portal, all objects would be loaded along with the initial page loading, causing delays when a large number of objects were being returned.

In this situation, You would sometimes become a little more well acquainted with this dialog than desired:

Now the fundamental behavior has changed in that no objects are loaded in the portal, until you hit the refresh button.

However, OOB, the biggest number you will see above is 2000.  In the above example where we’re querying Active Directory Users, if your Service Manager CMDB contains more than 2000 users brought in from Active Directory (the AD Connector may have been scoped down to certain OUs etc. to help circumvent this), you’re going need to get very lucky to see your record available for selection.

There are 3 ways to manipulate this behavior, or you can can use a combination of the three

1) Change the maxqueryresults value in the web.config file from 2000 to the desired value.

2) Add criteria in the Query Results Configuration

3) Add an extra prompt for searching

Here are the steps on how to implement each of these:

1) Change the maxqueryresults value from 2000 to the desired value.

Click Explore in IIS to find the web.config file location:

Create a backup of the Web.config file:

Open up Notepad and drag web.config into it:

Customize the MaxQueryResults value and then save the modified web.config file:

Save the edited web.config file and Restart IIS.

Details on other settings that can be configured in the web.config file can be found here:

Deploy the new self-service portal > ‘Customize the self-service portal’ Section

NOTE: if your search is going to be slow after upping it, you may want to read on and use one or both of the following techniques also

2) Add criteria in the Query Results Configuration

Add a piece of criteria such as business phone / employee ID is not empty in the query results configuration:

In the Request Offering, add an extra user prompt field:

In the configuration of the query results prompt (2 – Select the user in my case) add the property you want to search for the value entered in the first prompt (display name in my case).  I use the Contains operator.  Then click the arrow to the right of ‘Set Token’ and choose the prompt you added:

Or to go all out, use a combination of all 3 methods as shown here  

The end result looks a little something like this:

Happy HTML SSP-ing    I would greatly appreciate it if you could rate my article and / or leave feedback if this helped you!  

Cheers, Antoni

System Center Data Protection Manager (SCDPM) is well recognized in the industry for protection of Microsoft workloads and environments. It protects key Microsoft workloads such as SQL, SharePoint and Exchange as well as virtual machines running on Hyper-V.  Today, we are announcing support for protection of VMware virtual machines. This will allow enterprise customers to have a single backup solution across their heterogeneous IT environment.

Here are the four simple steps to configure VMware server and DPM to protect VMware VMs.

1. Enable a secure SSL communication between DPM and VMware server

2.Add a new user with certain minimum privileges

3.Add VMware Server to DPM

4.Protect VMware VMs with DPM

If you are new to Azure Backup and want to enable Azure Backup for longterm retention, refer to Preparing to backup workloads to Azure with DPM.  Click for a free Azure trial subscription

Here are some additional resources:

• Browse documentation or reach out to DPM forum for support
• Tell us how we can improve DPM and Azure Backup: Contribute new ideas and vote on existing ones
• Follow us on Twitter and Channel9

Key words: Announcement, VMware VM Backup, DPM, DPM 2012 R2, SC DPM, Microsoft Azure Backup Server, MABS, Azure Backup, Backup & Recovery, OMS, Cloud Backup, Virtual Machines, VMware, vCenter, ESXi

System Center Data Protection Manager (SCDPM) is well recognized in the Industry for protection of Microsoft workloads and environments. It protects key Microsoft workloads such as SQL, SharePoint and Exchange as well as virtual machines running on Hyper-V.  Today, we are announcing support for protection of virtual machines running on VMware platform. This will allow enterprise customers to have a single backup solution across their heterogeneous IT environment.

Value Prop

• Agentless Backup – DPM uses VMware’s VADP API to protect VMware VMs remotely without installing agents on vCenter or ESXi servers. This frees admins from the hassle of managing agents for VMware VM backup.
• Integrated Hybrid Backup helps customers in backing up to disk for operational recovery and to cloud using Azure Backup for offsite copy or longterm retention
• First class integration with VMware allows customers to backup VMs stored in different storage targets like NFS and cluster storage seamlessly without any extra manual steps. vCenter’s capability to organize VMs in folders helps customers in managing large environments with ease.  DPM can discover and protect at folder level.  This enables protection of VMs that are present currently and also any new VMs that gets added into this folder in future.

Here is a short video that provides value prop and overview of VMware VM backup.

Be sure to go through 4 simple steps to protect VMware VMs using DPM.  Please reach out to VMwareVMBkp@microsoft.com for any questions or clarifications.

If you already have DPM 2012 R2 installed, please download and install UR11 to get started with VMware VM Backup.

If you are new to Azure Backup and want to enable Azure Backup for longterm retention, refer to Preparing to backup workloads to Azure with DPM.  Click for a free Azure trial subscription

Here are some additional resources:

• Browse documentation or reach out to DPM forum for support
• Tell us how we can improve DPM and Azure Backup: Contribute new ideas and vote on existing ones
• Follow us on Twitter and Channel9

Key words: Announcement, VMware VM Backup, DPM, DPM 2012 R2, SC DPM, Microsoft Azure Backup Server, MABS, Azure Backup, Backup & Recovery, OMS, Cloud Backup, Virtual Machines, VMware, vCenter, ESXi

C’est la rentrée, et avec Stanislas on vous a préparé un petit récapitulatif de ce qui s’est passé cet été. Evidemment, on vous parle de Windows 10, de containers, de PowerShell, d’Azure et de plein d’autres choses !

Comme toujours, vous pouvez retrouver cet épisode dans le flux RSS du podcast, sur iTunes, ou directement sur le site :

http://aka.ms/itcast

Notes de l’épisode :

Windows 10

• What’s new in Windows 10
  https://technet.microsoft.com/itpro/windows/whats-new/index
• Further simplifying servicing models for Windows 7 and Windows 8.1
  https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/
• Mes aventures avec les conteneurs Hyper-V dans Windows 10
  https://blogs.technet.microsoft.com/pascals/2016/08/17/hyper-v-containers-dans-windows-10/
• Faire cohabiter des conteneurs Windows et Linux sur Windows 10
  https://blogs.technet.microsoft.com/pascals/2016/08/22/faire-cohabiter-des-conteneurs-windows-et-linux-sur-windows-10/
• Azure CLI sur Windows 10
  https://blogs.technet.microsoft.com/pascals/2016/08/18/installer-azure-cli-sur-windows-10-1607/

Azure

• Microsoft: a Gartner cloud computing leader across IaaS, PaaS, and SaaS
  https://azure.microsoft.com/en-us/blog/microsoft-a-gartner-cloud-computing-leader-across-iaas-paas-saas/
• The new design for #AzureAD MyApps is now in preview!
  https://blogs.technet.microsoft.com/enterprisemobility/2016/07/12/the-new-design-for-azuread-myapps-is-now-in-preview/
• GA for Azure AD authentication in SQL Database and SQL Data Warehouse
  https://azure.microsoft.com/en-us/blog/ga-for-azure-ad-authentication-in-sql-database-and-sql-data-warehouse/
• Azure N-Series preview availability
  https://azure.microsoft.com/en-us/blog/azure-n-series-preview-availability/
• Application remoting and the Cloud
  https://blogs.technet.microsoft.com/enterprisemobility/2016/08/12/application-remoting-and-the-cloud/
• Microsoft Azure Stack: Upcoming Technical Preview and other updates
  https://azure.microsoft.com/en-us/blog/microsoft-azure-stack-upcoming-technical-preview-and-other-updates-3/
• Déployer un Docker Swarm dans Azure avec Docker for Azure
  https://blogs.technet.microsoft.com/pascals/2016/08/22/docker-for-azure/
• Add your Cisco ASA logs to OMS Security
  https://blogs.technet.microsoft.com/msoms/2016/08/25/add-your-cisco-asa-logs-to-oms-security/

PowerShell

• PowerShell is open sourced and is available on Linux
  https://azure.microsoft.com/en-us/blog/powershell-is-open-sourced-and-is-available-on-linux/
• Vidéo avec des démos :
  https://channel9.msdn.com/Shows/msftazure/Run-PowerShell-Natively-on-Linux-with-Docker
• Windows PowerShell is now “PowerShell”: An Open Source Project with Linux support – How did we do it?
  https://blogs.msdn.microsoft.com/powershell/2016/08/17/windows-powershell-is-now-powershell-an-open-source-project-with-linux-support-how-did-we-do-it/
• Mon article :
  https://blogs.technet.microsoft.com/pascals/2016/08/19/installer-powershell-sur-linux/
• Mon Dockerfile si vous voulez tester dans un conteneur :
  https://github.com/pascals-msft/docker-ps
• Article technique :
  http://www.powershellmagazine.com/2016/08/18/open-source-powershell-on-windows-linux-and-osx/
• Podcast avec Jeffrey Snover :
  https://powershell.org/2016/08/19/episode-316-powerscripting-podcast-jeffrey-snover-from-microsoft-on-open-sourced-powershell-v6/
• Extension pou Visual Studio Code :
  https://github.com/PowerShell/vscode-powershell/blob/master/CHANGELOG.md#071

LinuxCon

• Live from LinuxCon – Sharing the latest news and learnings on Microsoft’s open journey
  https://azure.microsoft.com/en-us/blog/live-from-linuxcon-sharing-the-latest-news-and-learnings-on-microsoft-s-open-journey/

• Now generally available: Linux management with Operations Management Suite (OMS)
  https://blogs.technet.microsoft.com/msoms/2016/08/26/now-generally-available-linux-management-with-operations-management-suite-oms/

• Announcing Public Preview – OMS Container Solution for Linux
  https://blogs.technet.microsoft.com/msoms/2016/08/24/announcing-public-preview-oms-container-solution-for-linux/

Windows Server

• Offre pour la migration de VMware vers Hyper-V
  https://blogs.technet.microsoft.com/windowsserver/2016/08/24/announcing-the-new-vmware-migration-offer-for-windows-server-2016/
• Windows Server scalability and more!
  https://blogs.technet.microsoft.com/windowsserver/2016/08/25/windows-server-scalability-and-more/

During last month I’ve received a lot of requests regarding traditional Azure subscription migration to CSP model. I see that CSP becomes more and more popular, and a lot of customers prefer CSP against EA/Pay-as-you-go because of its great benefits. It is easy to start using Azure in CSP if you haven’t used Azure before – you deploy the solution from scratch, using latest and greatest Azure services. But what should you do, if you already have a production environment in Azure, purchased via Pay-as-you-go or Open License, but you want to have more payment flexibility and local partner support? In this case you’ll definitely want to migrate your existing Azure subscription to CSP with a minimal service downtime. In this post I’ll show you how you can do that.

Current types of Azure Subscriptions

There are several types of Azure subscriptions, that customers can use:

1. Traditional Azure subscriptions
   • Azure Direct – when customer creates an account on Azure.com and adds his credit/debit card to Azure account. He can be charged in the next month based on the amount of Azure consumed services (Pay-as-you-go), or he can pre-pay for 12 months (12-month prepay offer). Also it is possible to receive an invoice from Microsoft and pay it directly. It is called “Azure Direct” because customer pays directly to Microsoft, partner is not involved in payment process.
   • Free Trial on Azure.com
   • BizSpark – Microsoft 2-year or 3-year grant for startups
   • Open License – customer purchases Azure credits from a Microsoft reseller and activates them on Azure portal.
   • Azure benefits for MPN members and Visual Studio subscribers (aka “MSDN subscriptions”)
2. Azure EA Subscriptions – addition of 3-year Azure monetary commitment to existing Enterprise Agreement or a separate Enterprise Agreement for Azure only (“SCE”)
3. Azure CSP subscriptions.

Traditional Azure subscriptions and Azure EA subscriptions are pretty similar:

• There are 2 management portals available – old and new.
• Both ASM and ARM services are available (if you don’t know what is ASM and ARM – read here). ARM services are available on new Azure Portal only, while ASM services are available on both portals, they are called “Classic” on new Azure Portal. ASM-based IaaS is usually called “IaaSv1”, and ARM-based IaaS is called “IaaSv2“.
  
• Customer has Owner rights in subscriptions (aka “Service administrator” in ASM)
• Technical support is provided by Microsoft
• Billing and pricing details are provided by Microsoft
• Customers can deploy 3rd party solutions from Azure Marketplace – without 3rd party license (Bring-your-own-license model aka “BYOL”) or with 3rd party license included (Pay-as-you-go model aka “PAYG”). But anyway – 3rd party license will be charged separately, customers can use Azure Monetary Commitment in EA or Open License Azure Credits to cover 3rd party license.

But there are several differences between Traditional Azure subscriptions and Azure EA subscriptions:

1. Billing and payment information for Traditional Azure subscriptions is available on Azure Account Center. Azure EA customers use Azure EA Portal instead.
2. Traditional Azure subscription is tied to Microsoft Account (aka “LiveID”). It means that customer uses his/her Microsoft Account credentials to login to Azure management portal, his personal credit card is used for billing etc. Azure EA subscription is tied to Azure Active Directory. It means that a designated EA manager creates an Azure subscription on Azure EA Portal and assigns owner rights to the specified user account in Azure AD.

And 2nd thing is very important. There is a term called Azure Tenant (also called “Directory” on the new Azure portal). Every Azure subscription exists inside Azure tenant. Azure tenant is a domain like *.onmicrosoft.com, to which Azure subscription belongs:

• For Traditional Azure subscriptions, which are tied to Microsoft Accounts, Azure tenant is generated automatically. For example, if your Microsoft Account (LiveID) is johnsmith@outlook.com, then your Azure Tenant will probably be johnsmithoutlook.onmicrosoft.com. If you use your personal domain name for Microsoft Account, then it will also work – if your Microsoft Account is kotlyarenko1111@gmail.com, then Azure Tenant kotlyarenko1111gmail.onmicrosoft.com will be generated.
• For Azure EA Subscriptions, Azure Tenant name is equal to company’s Azure Active Directory. E.g. my organization is called Kotlyarenko LLC and it is tied to kotlyarenko.onmicrosoft.com Azure AD (which can be connected to On-Premise AD as I’ve shown here). In this case Azure EA subscriptions will be created inside kotlyarenko.onmicrosoft.com Azure Tenant. It looks similar to Office 365, where Office 365 Tenant name is equal to the name of Azure AD.

Here is the example – a user, signed with his Microsoft Account, has Owner rights granted for 2 different subscriptions in 2 different tenants – kotlyarenko1111gmail.onmicrosoft.com (Microsoft Account-based Azure Tenant) and kotlyarenko.onmicrosoft.com (Azure AD-based Azure Tenant). But to work with these 2 subscriptions, he needs to switch between “Directories” on the Azure Portal.

Traditional Azure Subscriptions can be moved between tenants, now it became pretty easy and you don’t even need to create a support request anymore. So the customer can move his/her Azure Direct subscription from Azure Tenant, tied to Microsoft Account, to corporate Azure Active Directory. In this case Traditional Azure Subscription and Azure EA Subscription will live inside the same Azure Tenant. I’ll show you why it is so important later in this post.

Difference of Azure CSP Subscriptions

To understand the nuances of Azure subscription migration to CSP, you need to understand what is the difference of Azure CSP Subscriptions comparing to Traditional Azure subscriptions and Azure EA subscriptions:

• Only ARM services available – latest and greatest. No legacy ASM or “Classic” services, no “IaaSv1”.
• Not all ARM services, available in Traditional/EA Azure subscriptions are available in CSP. But almost all of them.
• Since there are no ASM services, there is no need in old Azure Portal
  
• Since CSP partner is responsible for billing and pricing, customer doesn’t have access to Azure Account Center or Billing menu on new Azure Portal. Customer should use billing tools, that CSP partner provides.
• CSP Partner is always an Owner of Azure CSP Subscription. Partner administrators can assign Owner rights to customer IT admins, but customer is not able to revoke Owner rights from Partner. I’ve described how it works here.
• Technical support is provided by CSP Partner. So if a customer will create an incident request for Azure CSP Subscription though Microsoft support channel, then he/she will receive an answer that “Microsoft doesn’t support CSP subscriptions, go to your CSP Partner and create an incident request there”.
• CSP Subscription lives inside Azure Tenant, tied to Azure AD. It can be new Customer, created on Partner Center portal (new Azure AD will be created) or it can be existing Customer (with existing Azure AD), connected to Partner Center account.
• Currently there are only BYOL 3rd party solutions in Azure Marketplace. If customer wishes to buy a 3rd party solution license with Azure services, purchased through CSP, then CSP partner can sell this license separately or include it in the service cost. E.g. partner can add a license subscription to BYOL Barracuda Firewall or Citrix NetScaler, which will be separate from Azure CSP bill.
• MySQL-as-a-Service is not available in Azure CSP. It’s available in Traditional Azure Subscriptions as a 3rd party service, provided by ClearDB. But with a recent announcement of MySQL in-app, I hope it will be fixed soon.

Azure CSP Migration Scenarios

OK, now you know what are the differences of Traditional Azure subscriptions, Azure EA subscriptions and Azure CSP subscriptions. These nuances are very important when you plan a migration from a Traditional Azure Subscription or Azure EA to Azure in CSP. Keep in mind that:

1. It’s impossible to just convert Traditional Azure Subscription or Azure EA Subscription to CSP, because these types of subscriptions are different. There is no simple “switch”. You need to move resources from source subscription (Traditional or EA) to destination subscription (CSP). This is a manual process. This post will help you to do that.
2. Since IaaSv1 (ASM-based) is not available in CSP, it is a good opportunity (but also a challenge) to migrate customer from IaaSv1 to IaaSv2. It can cause some service downtime.
3. Cloud Services and Mobile Services are not available in CSP, because they are not available in ARM. So customer should think about switching to IaaSv2 and Azure App Service first.
4. Azure Mobile Engagement and Azure Cognitive Services are not available in CSP yet. Very few customers use those services in production, so it won’t be a big issue.
5. If a customer uses PAYG 3rd party Azure Marketplace solutions, then he/she needs to switch to BYOL model and purchase a license for 3rd party solution outside Azure.
6. Partner should make a migration to CSP by himself, or at least support a customer during this process. Don’t leave a customer alone here.

To test the migration process before moving the customer’s production workload, I recommend to try it first in a sandbox environment. Partner Center Integration Sandbox is great for that, because it allows every CSP Direct partner (or CSP Indirect distributor) to create up to 25 sandbox customer accounts with up to 25 Azure CSP subscriptions in each. Each Azure CSP subscription in sandbox is limited to $200/month, which means 200*25*25 = $125k of free Azure every month. But be aware – it is impossible to move from Azure CSP sandbox subscription to production subscription, so you will need a regular Azure CSP Subscription on final migration stage.

I will cover 3 most popular migration scenarios from Traditional Azure Subscriptions or Azure EA to Azure CSP Subscription:

1. IaaSv1 -> IaaSv2 in Azure CSP
2. IaaSv2 -> IaaSv2 in Azure CSP
3. PaaS -> PaaS in Azure CSP

Migration from IaaSv1 to IaaSv2 in Azure CSP

This is the most frequent migration request from partners. A lot of customers still use old Azure portal to create VMs. Also there are some customers, that already switched to a new portal, but they use “Classic” deployment model for the purpose of integration with VMs, created on the old portal previously. It means that they still use ASM-based IaaSv1, which is not available in CSP.

Typical situation – customer’s EA ends in 3 months, and customer wants to switch to CSP for better flexibility and to get local technical support. Similar story with startups, that joined BizSpark 3 years ago. Now they need to switch to commercial Azure subscription and they select CSP as a preferable option for them. Such companies started to use Azure 2-3 years ago, and IaaSv2 was not available those days (IaaSv2 was launched in 2014 and became a default deployment option in 2015).

To migrate from IaaSv1 to IaaSv2, I recommend you to use an open source tool, developed by Paulo Ramos (Microsoft Azure guru) – MigAz. What this tool does:

1. Connects to source environment (IaaSv1)
2. Get the information about VMs, Networks and Storage and creates ARM Service Template (JSON file)
3. This ARM Service Template is used to create the copy of the environment in IaaSv2.
4. After the destination environment (IaaSv2 in CSP) is created, the tool migrates Virtual Disks using snapshots and boots the VMs.

It supports migration from IaaSv1 in one tenant to IaaSv2 in another tenant. Minimal downtime is 30 seconds, maximum downtime depends on the source environment architecture. Keep in mind that:

1. Understand where the data is written. Depending on the data size, migration can take from 5 minutes to several days, and it is not always possible to sync the data after such long migration. Stateless systems migrate easily. If you use Azure SQL Database or other Azure PaaS to store the data – then it is also OK, because it can be switched to CSP on the next step of the migration, when IaaS will run on ARM.
2. But if you use SQL Server or MySQL or any other DBMS inside the VM to store the data, and application servers write data frequently to database, then it will be much harder. In this case you can use a different subnet in destination environment (IaaSv2) and configure VNet peering. Now VMs in your source environment and destination environment can reach each other. Copy the stateless VMs, copy the secondary SQL Server to the new environment, wait until the data is synchronized, make this secondary SQL Server primary and then move the remaining SQL Server.
3. MigAz doesn’t require you to shut down the VMs, because it uses snapshots to copy blob data. But if you use multiple data disks to create one big striped volume inside a VM (e.g. Storage Spaces inside Windows Server VMs or LVM in Linux), then it is required to shut down this VM and copy the data to a new environment while the VM is not running.
4. External IP addresses will change. Consider using Traffic Manager to minimize the downtime because of the external IP address change.
5. Storage Account name is limited to 24 symbols. These days if you’ll create a new storage account on the old portal and don’t specify a name, it will be generated with a 24-symbol name. MigAz adds a suffix to that name, and it can appear that the final name of the destination Storage Account is longer then 24 symbols. So you may need to change the destination storage account name in JSON files before launching the deployment.
6. ASM supports a space symbol in Load Balancer name. ARM doesn’t support that. MigAz will throw an error, so you may need to change the LB name in JSON file and remove that space symbol.
7. If you need to migrate Block Blob data from ASM-based storage account to new ARM-based storage account, you can use PowerShell cmdlets.
8. Plan everything, do a test migration to sandbox environment, and only then do a production migration.

OK, let’s start the show. My environment runs in Traditional Azure Subscription, and I want to switch it to CSP. This is a 2-tier web portal, that has 2 IIS-based frontends and 2 SQL Server based backends.

1. 2x D1 VMs with Windows Server 2012 R2 with IIS – WEB01 and WEB02. Stateless frontend servers, availability set “WEB”. There is a load-balanced HTTPS endpoint – https://cspmigration.kotlyarenko.com. Azure Load Balancer distributes the traffic across these 2 web-servers.
2. 2x A5 VMs with Windows Server 2012 R2 and SQL Server 2016 Standard with AlwaysOn Availability Groups configured – SQL01 and SQL02. All the data from front-ends is written here.
3. There are 2 Storage Accounts – one for WEB01 and WEB02, another for SQL01 and SQL02.
4. There is one vNet, all 4 VMs are connected to this vNet.
5. Web portal is published to the internal using a public URL – https://cspmigration.kotlyarenko.com. This FQDN is a CNAME for Cloud Service name – myapp2408.cloudapp.net, which is resolved to IP 52.178.215.175.
6. kotlyarenko.com domain is managed via Infobox DNS management panel, SSL certificate for HTTPS is issued by DigiCert.
7. All VM use 127Gb virtual disks (default size).
8. Everything runs in North Europe region.

OK, let’s start.

First of all, create a new Azure CSP subscription on Partner Center portal and save its Subscription ID. I will use my old tenant – kotlyarenko.onmicrosoft.com.As I use Traditional Azure subscription as a source, I use my Microsoft Account to access it. Open Azure administration portal as CSP Partner admin and invite Microsoft Account as an owner of that new CSP subscription. This will allow customer to use the same Microsoft Account to logon to new environment and to old environment.

Now if a customer logins to the new Azure Management portal, he’ll see 2 Azure Tenants (directories) – old, generated when we signed up for Traditional Azure subscription, and new – AzureAD-based tenant, created in Partner Center.

I’ll switch an old Azure portal to show you how the source environment looks like:

One of the biggest problems during such migration is an external IP address change. If you point the DNS record to a new external IP, it can take hours to replicate the changes. During all this time some end-users will be forwarded to old environment, and some will be forwarded to new environment. To minimize this issue, I’ll use Traffic Manager. Go no new Azure CSP Subscription and create a new Traffic Manager profile with Priority routing method:

Go to Configuration and change TTL to 30 seconds. This is a minimal available value. It means that in 30 seconds a client will try to resolve the public DNS name again from Traffic Manager. When we’ll complete the migration and switch settings to a new environment on Traffic Manager, in 30 seconds clients will be forwarded there instead of old environment. 30 seconds is much better then many hours. Also don’t forget to change Endpoint Monitoring Port, which is HTTPS 443 in my case.

Create a new Endpoint with #1 priority and point it to Cloud Service DNS name in the old environment. In my case it is myapp2408.cloudapp.net. IP address is not supported here.

Then change the external DNS Record, that points end-users to your web portal. In my example end-users use URL https://cspmigration.kotlyarenko.com to get to the web portal. I will change the cspmigration DNS record in kotlyarenko.com domain and specify the traffic manager FQDN (asm2armtest.trafficmanager.net) as CNAME instead of old A-record. Traffic manager will resolve Cloud Service DNS-name (myapp2408.cloudapp.net), which will be resolved by client machine to external IP address of HTTPSWEB endpoint (52.178.215.175). Wait several hours until these DNS changes will be replicated. When we’ll create a new environment, we’ll add a second endpoint to Traffic Manager profile, that points clients to IaaSv2 environment instead of old one.

Check that external DNS record is resolved to Traffic Manager FQDN:

Then download MigAz and launch it. Sign in to source Azure subscription. You will see IaaSv1 resources, that exist in that subscription. Choose which elements you wish to migrate.

2 files are generated by MigAz – export.json (ARM Service Template) and copyblobdetails.json (configuration file for BlobCopy.ps1 script, that is located in MigAz folder).

Start new Azure PorerShell session, import Azure Resource Manager if you haven’t done it yet (run Install-Module AzureRM with elevated rights) and connect to the Azure CSP subscription. Create a new Resource Group.

Login-AzureRmAccount
$TenantID=”kotlyarenko.onmicrosoft.com”
$SubscriptionID=”07bb8a2b-bb31-6d1f-a49e-5daa0f086ebf“
Select-AzureRmSubscription -SubscriptionID $SubscriptionID -TenantId $TenantID
$ResourceGroupName=”CSPRG1“
$Location = “North Europe“
New-AzureRmResourceGroup -Name $ResourceGroupName -Location $Location

Start the Resource Manager service deployment. It should fail with an error – that’s OK. That’s because VM disks were not copied yet from the source environment. But the script will create the whole environment in ARM, similar to old ASM environment.

New-AzureRmResourceGroupDeployment -Name “DeploymentCSP” -ResourceGroupName $ResourceGroupName -TemplateFile “C:CSPexport.json” -Verbose

To avoid losing the data in SQL Database during the migration, I will switch the database to Read-only mode. It means that until I will finish the migration, my solution will be available to end-users in Read-only mode.

Initiate a copy of Virtual Machine disks from the source Storage Account to the destination Storage Account. Wait until it finishes. In my case 4 127Gb VM disks were copied in 3 minutes.

.BlobCopy.ps1 -ResourcegroupName $ResourceGroupName -DetailsFilePath “C:CSPcopyblobdetails.json” -StartType StartBlobCopy
.BlobCopy.ps1 -ResourcegroupName $ResourceGroupName -DetailsFilePath “C:CSPcopyblobdetails.json” -StartType MonitorBlobCopy

Then re-initiate Resource Manager deployment from a JSON template. Now it should complete without any errors.

New-AzureRmResourceGroupDeployment -Name “DeploymentCSP” -ResourceGroupName $ResourceGroupName -TemplateFile “C:CSPexport.json” -Verbose

Go to new Azure portal. Miracle – you’ll see the environment, similar to the old one, but in ARM model. All the VMs should already be online and running.

But as you see – the external IP address is new – 52.169.226.32.

Go back to Traffic Manager Endpoints page and create a new endpoint, that will point end-users to the Load Balancer external IP, tied to WEB availability set:

When you will disable Old endpoint, all end-users will be pointed to the new one during next 30 seconds:

Switch SQL Server in the new environment to Read-Write mode. Check that everything works fine. If there are no issues in the new Azure CSP environment, then change the external DNS record. Point it using a CNAME to a FrontEnd Load Balancer FQDN in the environment instead of Traffic Manager FQDN. Done!

In this case, customer still will use his/her Microsoft Account to access Azure CSP Subscription. But if it is a large organization, switching to Azure AD accounts, integrated with On-Premise AD, is more suitable. Migration from Azure EA Subscription will look exactly the same, except that you will need to use Azure AD account instead of Microsoft Account to access the old subscription.

As you saw, the web portal was available to end-users all the time, but during several minutes it was available Read-Only. If it is not acceptable for the customer, you can use a migration method with 2 different subnets, vNet Peering and data replication on SQL Server (MySQL, PostgreSQL etc) database level, as I’ve already described earlier.

Migration from IaaSv2 to IaaSv2 in Azure CSP

Migration from IaaSv2 in Traditional Azure Subscription or Azure EA to IaaSv2 in Azure CSP Subscription is much easier. Generally you only need to move ARM resources from one subscription to another. Main limitation here – subscriptions must exist inside the same tenant.

This is not a problem for Azure EA -> Azure CSP scenario, because I assume that Azure CSP subscription was created inside the already existed tenant, that was used for Azure EA. If you use Request a Reseller Relationship button in Partner Center, you as a CSP Partner will associate Customer tenant (*.onmicrosoft.com) with your partner account, and Azure subscriptions will be created inside the same tenant.

But if you migrate from Traditional Azure Subscription, which exists inside Microsoft Account based Azure tenant, then you will need to migrate that subscription to Azure AD-based tenant first. Now it became much easier – just go to Azure Account Center, choose the old subscription and click Transfer Subscription. You will need to provide new Azure AD user credentials, and subscription will be moved to Azure AD tenant, which specified Azure AD user belongs to.

I will use similar environment, that I’ve used in a previous example. The only difference – it already runs on ARM-based IaaSv2. I’ve created 2 VMs in Azure MSDN Subscription and then transferred that subscription to kotlyarenko.onmicrosoft.com tenant. VMs are called VM01 and VM02, they sit in the same storage account and in the same vNet (I want to show you that network communication between 2 VMs won’t drop during the migration). Everything is stored in MyVMs Resource Group in North Europe region.

OK, grant a user account that you will use for migration Owner rights for both subscriptions. Since they sit in the same tenant, you can use both – Microsoft Account or Azure AD Account. Go to the VM that you want to migrate from Traditional Azure Subscription to Azure CSP Subscription. Click Properties and click Change subscription. Select all the resources in the list, then choose Azure CSP subscription from the list and an empty Resource Group in that subscription.

In my case the whole migration to a different Azure subscription took ~5 minutes.

There was no any downtime – VMs were able to communicate with each other for all the time, public IP also was available. Again – 0 downtime.

Clean Resource Group in the old Azure Subscription:

And all IaaSv2 resources live inside new Azure CSP Subscription now, public IP stayed the same:

Currently not all IaaSv2 resources can be moved to another subscription, but this situation changes quickly. Application Gateway and VPN Gateway can’t be moved, so you will need to recreate them in the new subscription. Virtual Machine Scale Sets also can’t be moved, so you will need to redeploy the scale set definition in the Azure CSP subscription. The easiest way is to export the current resourses as JSON file and deploy them in the new subscription. Choose Resource Group, where this resource lives, click on Last Deployment to get the list of deployment, open the most recent deployment, click View Template and click Deploy.

Migration from PaaS to PaaS in Azure CSP

This scenario is very frequent – customer want to migrate PaaS services from Traditional Azure Subscription or Azure EA Subscription to CSP. We’ve already covered IaaS part, so you should know how to migrate Storage Accounts, Virtual Networks and VMs (which can be used by other PaaS services). The most frequent request is to move Azure App Service (Web Apps) or Azure SQL Database to Azure CSP.

The high-level view of the procedure:

1. For Traditional Azure Subscriptions: transfer Azure Subscription to Azure AD-based tenant, created in Partner Center
   For Azure EA Subscriptions: request a reseller relationship in Partner Center to add an existing customer tenant to CSP partner account
2. Create a new Azure CSP Subscription in Partner Center
3. Register the corresponding Resource Providers for the resources that will be moved in this subscription.
4. Move resources from old subscription to new subscription using the credentials of Azure AD user or Microsoft Account, that has Owner rights in both Azure subscriptions.

There is no resource downtime during such migration. And there is no difference if that Azure service was created in old Azure Portal or in new Azure portal – almost all PaaS services these days use ARM inside. If you create Azure SQL Database or Azure Web App on the old portal, it will be placed inside Resource Group as a resource and will be available on the new portal too.

Here are some limitations:

1. Remember, that Mobile Engagement and Cognitive Services are not available in CSP yet.
2. MySQL-as-a-Service, which is 3rd party service, provided by ClearDB, is not available in CSP. Native MySQL in-app is our hope, but it’s not available yet too.
3. Application Insights doesn’t support resource move. Export a resource template (JSON file) and re-deploy it in a new Azure subscription.
4. Cross-subscription migration for some resources (e.g. Web Apps) is available only through PowerShell and not through Azure Portal.
5. Migration of the whole Resource Group from one subscription to another is not available – you need to move separate resources.

Example #1 – Azure App Service

I’ve created Web App on the old portal in the Traditional Azure Subscription (Azure MSDN Subscription). This is how I see it on old portal and on new portal:

I need to transfer this subscription to kotlyarenko.onmicrosoft.com tenant first. Then I will create a new Azure CSP subscription and run this PowerShell script:

$OldSubscriptionID = “82fcfabd-df0c-4ea6-9d27-2dfe5879778a“
$OldRGName = “Default-Web-NorthEurope”  //this is the default RG name if you create Web App on the old portal.
$NewSubscriptionID = “0d8f7263-62cf-49f3-8578-ddde56305e77“
$NewRGName = “CSPResourceGroup“
Select-AzureRmSubscription -SubscriptionID $NewSubscriptionID
Register-AzureRmResourceProvider -ProviderNamespace Microsoft.Web  //you need to register Microsoft.Web resource provider in the new subscription before moving Web App resources.
Select-AzureRmSubscription -SubscriptionID $OldSubscriptionID
$webapp = Get-AzureRmResource -ResourceGroupName $OldRGName -ResourceName “App2408“
$plan = Get-AzureRmResource -ResourceGroupName $OldRGName -ResourceName “Default1“
Move-AzureRmResource -DestinationSubscriptionId $NewSubscriptionID -DestinationResourceGroupName $NewRGName -ResourceId $webapp.ResourceId, $plan.ResourceId

In less then a minute Azure App service was moved to Azure CSP Subscription without any downtime. External URL and IP stayed the same.

Example #2 – Azure SQL Database

I’ve created Azure SQL server and Azure SQL Database on the old portal in the Traditional Azure Subscription (Azure MSDN Subscription). This is how I see it on old portal and on new portal:

I need to transfer this subscription to kotlyarenko.onmicrosoft.com tenant first. Then I will create a new Azure CSP subscription and run this PowerShell script:

$OldSubscriptionID = “82fcfabd-df0c-4ea6-9d27-2dfe5879778a“
$OldRGName = “Default-SQL-NorthEurope”  //this is the default RG name if you create SQL Database on the old portal.
$NewSubscriptionID = “0d8f7263-62cf-49f3-8578-ddde56305e77“
$NewRGName = “CSPResourceGroup“
Select-AzureRmSubscription -SubscriptionID $NewSubscriptionID
Register-AzureRmResourceProvider -ProviderNamespace Microsoft.SQL  //you need to register Microsoft.SQL resource provider in the new subscription before moving SQL Database resources.
Select-AzureRmSubscription -SubscriptionID $OldSubscriptionID
$sqlserver = Get-AzureRmResource -ResourceGroupName $OldRGName -ResourceName “xzc647tfiy”
Move-AzureRmResource -DestinationSubscriptionId $NewSubscriptionID -DestinationResourceGroupName $NewRGName -ResourceId $sqlserver.ResourceId

In less then a minute Azure SQL Database was moved to Azure CSP Subscription without any downtime.

OK, now you know how to migrate Azure IaaS to CSP (no matter is it IaaSv1 or IaaSv2) and how to migrate PaaS services. I hope this information will help you with your customers. And I will appreciate if you will write some examples of the customer solutions, that you’ve successfully migrated to CSP. Subscribe to my blog and stay tuned!

During a recent customer visit, I was asked how they could create a report that showed their monitored systems ping status. Since the customer already had OpsLogix installed, the easiest solution looked to be creating a report based on data points that were already being gathered.

If you’re looking to create your own ping report, or just learn a little more about how reporting in SCOM 2012 R2 works, I hope the information below proves useful.

Requirement: Before beginning, ensure that the OpsLogix Ping Mgmt. Pack is installed and configured for Host(s) and Target(s)

• Download and install the OpsLogix ping Mgmt. Pack: http://www.opslogix.com/download-ping-management-pack/
• Additional information for customizing the OpsLogix Ping Mgmt. Pack: http://www.systemcentercentral.com/customizing-the-opslogix-ping-management-pack-scom-sysctr/

Ready, set, go!

Open the SCOM 2012 R2 – Operations Manager Console

Go to: Reports wunderbar > Microsoft Generic Report Library > Performance

Double-click to open the Performance report template

Select the Change button

Select the New Chart button

Add a Chart Title (for this example “Ping Response Time“)

Select the New Series button

Modify the appearance, if desired

Under the objects section, select the Add Object button

Select the Options button

Select the Add button

Under Class Name: Contains type (type) Target Host

Select the Search button

Under the Available items cell, select Target Host and Add button

Click OK and OK again to go back to the Add Object dialog box

Note that it now shows “Filter Options have been applied”

Enter an object search work, or simply leave blank and select the Search button

Select one target from the list and add to Selected objects

*If you do not see target hosts available, go back to the Monitoring wunderbar and confirm that they have been added per the OpsLogix documentation

Click OK

Go to Rule and click Browse

Under Search By Rule Name, type: ping

Select Name=Ping Response Time

Object=Target Host

Click OK

Select Specific instances radio button and chose the associated object check box

Click OK

Back on the main Performance – Operations Manager – Report – Mgmt. Group dialog box…

Update the From date to Yesterday and click Run

Example Performance and Performance Detail Reports:

If desired, add additional Targets to the report by repeating the above for each target

Show the Parameter Area

Select Change

Select New Series

Adjust the appearance, if desired

Add the Target Host class filter, per above

Add the Target Object, per above

Add the Rule, per above

Click OK

Now there are 2 target systems in the report

If desired, add additional Targets to the report by repeating the above for each

Re-run the Report

The report can be modified to show a Histogram and/or 3D Chart

Once completed with building the report save it in a custom Mgmt. Pack

Note: It’s recommended to adopt a standard naming convention to any custom reports to allow for quick view into default and custom reporting

Once saved to a custom Mgmt. Pack, the report can be opened from there and also found on the SQL Server Reporting Services link (SCOM default = htt://%reportservername%/reports)

Happy Ping Reporting!

The end.

To norske forskere fra Norges Teknisk-Naturvitenskapelige Universitet har udført et forskningsprojekt om, hvordan studerende bearbejder viden når de henholdsvis bruger et traditionelt tastatur eller bruger pen og papir. Projektet viser, at de studerende aktiverer helt andre dele af hjernen når de har mulighed for at bruge deres håndskrift til at tage noter med. Det skriver Ingenøren.

Dermed åbnes en helt ny verden af indlæring, hvis elever og studerende kombinerer den klassiske maskinskrift med den måske endnu mere traditionelle penneskrift. Det smarte er dog, at man ikke behøver vælge hverken pen eller tastatur fra eller til – der findes teknologi som fx Surface-serien som kombinerer pen-input med tastaturinput.

Forskningsprojektet er sket i samarbejde med Microsoft, og vi har før beskrevet fordelene for elevernes kreativitet og indlæring ved at kombinere pennen med tastaturet.

Læs artiklen fra Ingenøren her: https://ing.dk/artikel/forskere-pen-papir-tilbage-undervisning-186225

Hola!,

Desde el equipo de soporte de Microsoft Exchange, tenemos el placer de informarte que disponemos de nueva área en Channel 9 donde iremos publicando nuevo contenido que se vaya grabando totalmente en Español,  para empezar ya tenéis disponibles los 5 webcasts que se hicieron durante el mes de Junio con sus correspondientes diapositivas.

Puedes acceder a dicha área y encontrar las grabaciones en https://channel9.msdn.com/Blogs/Exchange-Online-Tech-Talk

Esperamos que lo disfrutes tanto como nosotros haciendolo.

Un saludo,

El equipo de soporte de Microsoft Exchange

営業活動にご利用いただける、現在実施中のパートナー様向けキャンペーンをご紹介します。