本週為Microsoft Teams全球發布的一週年。這段期間，Teams在新功能以及客戶使用方面有明顯地增長。目前，在181個市場與39種語言中，有20萬個組織使用Teams，包括A.P. Moller–Maersk、ConocoPhillips、Macy’s、NASCAR、Navistar、RLH Corporation以及Technicolor。General Motors現在也在使用Teams；了解更多關於他們的故事。

關於Teams的智慧通訊與協同合作

在過去的一年裡，Teams已經發展為團隊合作的最終核心。建立在Office 365超過1.2億用戶的實力與規模，Teams可以提供以聊天為基礎的協同合作、會議、電話撥接以及即將推出的完整企業語音功能。這些都是透過Microsoft Graph的支援，從而實現豐富的AI功能。作為Office 365的一部分，Teams可以全面地提供這些功能，並具有企業級安全性與合規性標準，以滿足全球商務的需求。

為促進對於智慧通訊的展望，我們宣布今年將推出新的Teams功能，其中包括：

• 雲端錄影—提供一鍵會議錄影功能，內涵自動轉譯與時間碼功能，使得所有團隊成員都能夠閱讀字幕，在會話中搜尋並播放全部或部分的會議片段。在未來，它還將提供臉部辨識功能，了解是由哪一位特定的與會者發言。
• 內建訊息翻譯—使用不同語言的人可以透過翻譯頻道與聊天中的訊息來相互順暢地溝通。
• 適用於Teams裝置的Cortana語音互動—使您能夠輕鬆地撥打電話、加入會議或使用口頭的自然語言將其他人加入Teams會議。此功能將擴展到IP電話與會議室裝置中。
• 視訊背景模糊—在視訊通話過程中模糊背景，可以讓其他與會者將注意力聚焦在您身上，而不是身後的事物。
• 針對Teams會議的接近偵測—此功能可以讓您輕鬆發現並增添附近的Skype Room系統到任何會議中。
• 在會議中行動分享—與會者可以透過他們的行動裝置分享即時視訊串流、照片或螢幕畫面。

這些新功能將延伸去年Teams的各種新功能，包括來賓存取權、與應用程式互動的新方式，以及新的會議與通話功能。

今天，我們還在Teams宣布了新的企業級通話功能，包括商議轉接、通話委派與同盟。除此之外，我們正在導入Direct Routing，這將使客戶能夠使用他們現有的電話語音基礎結構與Teams進行通話。當您將Microsoft通話方案或Direct Routing與我們的Office 365電話系統結合使用時，Teams將成為完整的語音服務。這些新功能預計將於2018年第二季推出。

為您的裝置提供智慧通訊

硬體在提供一致的高品質視訊與語音體驗方面，發揮了至關重要的作用。我們宣布Teams現在可以使用各種通訊與會議室裝置，其中包括：

• Microsoft協同合作裝置—Microsoft Surface Hub是一款功能強大的萬用大螢幕團隊協同合作裝置。Microsoft Teams將原生支援Surface Hub，增強Teams在擠滿人的空間與會議室中配置Surface Hub的能力。
• 會議室系統—Lenovo與HP加入現有的合作夥伴Logitech、Crestron與Polycom當中，透過豐富的音訊、HD影片、中心控制以及一鍵加入來轉換辦公室體驗。所有Skype Room系統都將支援Teams會議。
• 與現有設備的連結—Teams將認證來自BlueJeans、Pexip以及Polycom的新解決方案，以支持與現有硬體投資的Teams會議互通性。
• 電話機與會議電話—來自AudioCodes與Yealink的全新電話機—以及來自Crestron、Polycom與Yealink的新會議電話—運行原生的Teams應用程式，實現一致且精簡的通話體驗。
• 行動電話亭—Plantronics的新行動電話亭將Teams體驗與行動使用者的電話機功能相互結合。

想要深入了解Teams所支援的裝置與藍圖規劃，請造訪Microsoft Tech Community部落格。

持續發展Teams應用程式的生態系統

少了應用程式的蓬勃發展，任何生態系統都不會完整。我們最近在Teams中發佈了新的市集，其中包括來自合作夥伴的各種工具與服務。在Teams客戶間最受歡迎的應用程式包括Adobe Creative Cloud、Hootsuite、InVision、Polly、SurveyMonkey、Trello、Wrike、Zoom.ai等。

聽聽來自客戶的聲音

當我們在慶祝我們的一週年發行日時，最激勵人心的是RLH企業、Technicolor與General Motors等企業的成功案例，Teams真正改變了人們聚在一起、創新與推動企業發展的方式。

• RLH企業—2014年，Greg Mount在RLH企業擔任執行長時，母公司為Red Lion Hotels、GuestHouse與America's Best Value Inn等飯店品牌。他將企業的策略從一個太平洋西北地區品牌轉變為全國性品牌。從那之後，RLH企業便收購了多家飯店品牌，利用三年的時間就從62家擴增到超過1100家飯店。為了解決變更管理並協助推動企業內部一致性的文化，RLH企業去年開始使用Teams。他們評估了其他以聊天為主的協作工具，不過由於他們已經在使用Office 365與Power BI了，所以選擇Teams是明智的選擇。現在，所有企業員工都在使用Teams。領導團隊已經從一個以面對面、信件流程為主的交流轉向為更即時性的互動與資料流程。

• Technicolor—媒體與娛樂領域的領航者，Technicolor已經使用Production Services技術長辦公室的Teams為員工提供一種全新的技術協作方式—從策略到採購的所有流程。Technicolor Production Services事業部門也開始將Teams用於需要在多個時區與全球辦公室，以實現更高透明度與協同合作的高標準專案，從而減少內部重複召開的會議與資訊流量，並受益於唯一可靠的雲端文件來源。Technicolor Production Services計畫擴大其在組織的其他部分使用。

• General Motors—General Motors技術執行長Fred Killeen，對於Teams不得不說：「我們改變運輸的使命仰賴於我們企業在多個面向的強大團隊合作。Teams使我們的員工能夠透過一個地方來跨地區與組織疆界進行連結，以存取所有的交談、文件與內容。Teams與其他Office 365、協力廠商的應用程式與服務進行整合，使我們員工能夠輕鬆地找到相關資訊，將自己和團隊的工作做到最好無論是。」

當我們慶祝我們上市一年時，我們非常感謝我們的客戶、合作夥伴，當然還有那些已經成為忠實Teams用戶的人，並與我們一同踏上了這次旅程。我們期待繼續為您提供讓您的團隊更加團結的體驗。

收聽本週在Enterprise Connect上Microsoft的主題演講，以了解我們對於智慧通訊的看法。在2018年3月14日星期三美國東部時間上午10點進行收看，或者透過以下網址進行觀看：Enterprise Connect主題演講。

—Microsoft Teams與Skype總經理，Lori Wright

Applies to:

Windows 10 1803 (tbd, codename RS4)

Windows 10 1709 (Fall Creators update, codename RS3)

Windows 10 1703 (Creators update, codename RS2)

Windows 10 1607 (Anniversary update, codename RS1) / Windows Server 2016 (codename RS1)

Windows 10 1511 (November update, codename TH2)

Windows 10 1507 (RTM, codename TH1)

Windows 8.1/Windows 2012 R2

Windows 8/Windows 2012

Windows 7 SP1/Windows 2008 R2 SP1

Windows Vista/Windows 2008

As a Premier Field Engineer (PFE), I get to go on-site and from time to time, I get to troubleshoot Windows and Windows Servers that are having reliability and performance problems.

Q: When should you update your driver(s) and firmware?

A:

• When a new piece of hardware you've installed doesn't work automatically

or

• When a hardware is generating an error, like a Device Manager error code

or

• if you're troubleshooting a problem with the device

or

• if a driver update enables new features you'd like to utilize.
  • Windows client: (e.g. video cards and sound cards.)
  • Windows Server: (e.g. NIC, Storage/HBA)

or

• maybe before/after upgrading to a new version of Windows.

or

• a security flaw in the driver(s)/firmware

The most common scenario is the following:

"We update the driver(s) and firmware when the image of Windows and/or Windows Server are built."

Q: How often do you guys update the driver(s) and firmware?

A: We never do once the machine is imaged.

Q: How long do you guys keep your hardware in production?

A: 3-6 years or longer.

Q: What if you are having a Bug Check (a.k.a. Stop Error, Blue Screen of Death (BSOD), and for you *nix IT admin's Kernel Panic), the easiest thing to do what?

1. Option 1: Update the driver(s)/firmware and/or
2. Option 2: Update the security products and/or
3. Option 3: Get a kernel memory dump and analyze it.

A: It's Option 1. Update the driver(s)/firmware.

If you want to get root cause, setup for a kernel and/or complete memory dump (or Active memory dump on Windows Server 2016):

Coming soon: How to generate a kernel or a complete memory dump file in Windows Server 2012 and Windows Server 2012 R2

https://blogs.technet.microsoft.com/yongrhee/2015/04/05/coming-soon-how-to-generate-a-kernel-or-a-complete-memory-dump-file-in-windows-server-2012-and-windows-server-2012-r2/

Scenario 1: An I.T. administrator was troubleshooting a Print Server related issue, where the Windows clients were having problems connecting to the \PrintServerPrinterShare.  The issue was with a 3rd party network .dll that hooked into the SMB (CIFS) components which was fixed via an update to their Virtualization drivers (equivalent to a Hyper-V Integration tools).

Scenario 2: An I.T. administrator had a Windows Server, for troubleshooting purposes he disabled the on-board NIC's. But when he went to re-enable the on-board NIC's, it wouldn't turn on. This specific Server hardware manufacturer had an issue with their firmware. The hardware manufacturer had to replace the motherboard. There was a firmware update that had been out for 6+ months that would have prevented this issue from occurring.

Scenario 3: A Windows Server was dropping network packets. The fix was to update the NIC driver where the problem would no longer occur.

Scenario 4: A Windows Server was dropping buffers (nonpaged pool kernel memory) when we were trying to collect a "Storport ETW trace" while using the "Windows Performance Recorder UI (WPRUI))" trace of their slow disk i/o on SAN attached volumes. We updated the SCSI controller and the buffer dropping went away.

Scenario 5:  An I.T. shop had replaced their Windows clients with all SSD drives. There was a caveat, it had shipped with an issue where if it had written/read x MB of data, it would 'brick' the SSD. The fix was in a firmware update.

Scenario 6: A SSD firmware update would let you go from 250 MB/sec reads to 500 MB/sec reads. Yes, just a firmware update on the SSD. Why wouldn't you take advantage of it?

Scenario 7: A Windows client was observing random erroneous behavior, once we updated the Storage Controller driver, the symptoms went away.

Etc…

Q: How often should we look for a driver(s)/firmware update?

A: At a minimum every (1) year (12 months).

Q: So how do we update the driver(s)/firmware on our environment?

A: There are many methods, please check with your hardware manufacturer.

Here are a few examples:

Friday Support: How to update your drivers and software

https://blogs.technet.microsoft.com/smallbusiness/2013/03/08/friday-support-how-to-update-your-drivers-and-software/

Updating Firmware for Disk Drives in Windows Server 2016 (TP4)

https://blogs.technet.microsoft.com/filecab/2016/01/25/updating-firmware-for-disk-drives-in-windows-server-2016-tp4/

Keeping Surface Firmware Updated with Configuration Manager

https://blogs.technet.microsoft.com/thejoncallahan/2016/06/20/keeping-surface-firmware-updated-with-configuration-manager/

Q: How do we roll it out?

A: In the same phased approach.

• First, test it on a Test/QA environment.
• Second, test it on the IT admin's (if they have the hardware)
• Third, test it 'non-mission critical' systems.
• Fourth, do a segment of the hardware at a time.

And by the way, for the folks that want a 'root cause', if it's a "Windows Client or Windows Server", and it's really 'mission critical', why wait until the problem 'reoccurs'.

• Usually the immediate task in hand is restoring service.
• The 2nd task is, a plan to collect data to determine why it happened and what can you do to prevent the issue from reoccurring in the future.

Thanks,

Yong (In Dallas, TX. for a couple of days)

P.S. Other “Stop hurting yourself by” posts:

Stop hurting yourself by: Not applying the non-security updates for Windows and Windows Server.

https://blogs.technet.microsoft.com/yongrhee/2018/03/12/stop-hurting-yourself-by-not-applying-the-non-security-updates-for-windows-and-windows-server/

Stop hurting yourself by: Disabling IPv6, why do you really do it?

https://blogs.technet.microsoft.com/yongrhee/2018/02/28/stop-hurting-yourself-by-disabling-ipv6-why-do-you-really-do-it-2/

WMI: Stop hurting yourself by using “for /f %%s in (‘dir /s /b *.mof *.mfl’) do mofcomp %%s”

https://blogs.technet.microsoft.com/yongrhee/2016/06/23/wmi-stop-hurting-yourself-by-using-for-f-s-in-dir-s-b-mof-mfl-do-mofcomp-s/

More information:

Windows 10 – Audio Troubleshooting Tips

https://blogs.technet.microsoft.com/mediaq/2015/07/30/windows-10-audio-troubleshooting-tips/

When deploying Windows 7 the Apply Driver Package task fails when the ADK is upgraded to the ADK 10 1607 or newer

https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2016/12/28/apply-driver-package-task-fails-when-the-adk-is-upgrade-to-adk-10-1607/

Surface Pro with LTE Advanced Drivers and Firmware (Initial Release)

https://blogs.technet.microsoft.com/surface/2017/12/02/surface-pro-with-lte-advanced-drivers-and-firmware-initial-release/

August Driver updates for Windows 10 help you get more from your Surface devices

https://blogs.technet.microsoft.com/surface/2015/08/24/august-driver-updates-for-windows-10-help-you-get-more-from-your-surface-devices/

November Firmware and Driver updates for your Surface devices

https://blogs.technet.microsoft.com/surface/2015/11/04/november-firmware-and-driver-updates-for-your-surface-devices/

June Firmware and Driver updates help you get more from your Surface devices

https://blogs.technet.microsoft.com/surface/2015/06/26/june-firmware-and-driver-updates-help-you-get-more-from-your-surface-devices/

Tip of the Day: Updating Surface Pro Firmware Offline

https://blogs.technet.microsoft.com/tip_of_the_day/2015/06/18/tip-of-the-day-updating-surface-pro-firmware-offline/

Firmware and Driver updates to get more from your Surface devices

https://blogs.technet.microsoft.com/surface/2015/01/16/firmware-and-driver-updates-to-get-more-from-your-surface-devices/

15048 Update a driver for hardware that isn't working properly

https://support.microsoft.com/?id=15048

15054 Automatically get recommended drivers and updates for your hardware

https://support.microsoft.com/?id=15054

Last November I linked to the free OneNote Online training that was being co-ordinated by Jared DeCamp and I had very positive feedback about these sessions from the educators that tuned in for them.

I see Jared's now organising a new event that will run from April 3rd to 7th 2018 focusing on how to get the best out of Microsoft Teams For Education.

Click here to see the event page

I've blogged a lot about Teams including:

• True Guest Access Comes To Microsoft Teams (at last!)
• Use PowerShell To Manage Microsoft Teams
• Measuring & Driving Usage Of Teams For Education
• Using e-Discovery In Microsoft Teams
• Microsoft Teams For Education Is Here – And It Is Awesome
• Using AzureAD Groups To Quickly Populate Microsoft Teams

This five day event looks like it is going to walk users through Teams in a guided approach, starting with the basics and then developing more advanced concepts:

1. Day One: Getting started with Teams
2. Day Two: Working with Teams
3. Day Three: Innovate with Teams
4. Teams and beyond!
5. Real-world case studies of using Teams

There is going to be live Q&A and a hashtag running for the event on #LTC18 so encourage you to tune in. You can see the full agenda here.

In my experience, these 'on demand' events can prove very valuable for educators as they can pick and choose the most relevant sessions and then watch them at a time that best suits their schedules. If you're responsible for driving the uptake of Microsoft Teams For Education in your school, then it could be a good idea to get this in your calendar and encourage your staff to identify relevant sessions for them.

Introduction

Intune integrates with network access control partners to help organizations secure corporate data when devices try to access on-premises resources.

Example

If the device is enrolled and compliant with Intune, the NAC solution should allow the device access to corporate resources. For example, users can be allowed or denied access when trying to access corporate Wi-Fi or VPN resources.

Feature behaviors

Devices that are actively syncing to Intune cannot move from Compliant / Noncompliant to Not Synched (or Unknown). The Unknown state is reserved for newly enrolled devices that have not yet been evaluated for compliance.

How the NAC integration works

Here’s an overview on how the NAC integration works when integrated with Intune. The first three steps, 1-3, explain the onboarding process. Once the NAC solution is integrated with Intune, steps 4-9 describe the on-going operation.

1. Register the NAC partner solution with Azure Active Directory (AAD) and grant delegated permissions to the Intune NAC API.
2. Configure the NAC partner solution with the appropriate settings including the Intune discovery URL.
3. Configure the NAC partner solution for certificate authentication.
4. User connects to corporate Wi-Fi access point or makes a VPN connection request.
5. NAC partner solution forwards the device information to Intune and asks Intune about the device enrollment and compliance state.
6. If the device is not compliant or not enrolled, the NAC partner solution instructs the user to enroll or fix the device compliance.
7. The device attempts to re verify its compliance and/or the enrollment state.
8. Once the device is enrolled and compliant, NAC partner solution gets the state from Intune.
9. Connection is successfully established which allows the device access to corporate resources.

Microsoft Intune Integration with Cisco ISE

Cisco ISE (NAC) integration with Microsoft Intune MDM Services leverages AAD’s (Azure AD) token-based authentication to access Intune services and leverage the information to grant/deny network access to mobile devices

Step 1: Configuring Microsoft Intune as an MDM server for ISE

Use the following steps to configure ISE's connection to Azure and Azure's connection to ISE.

1. Get the public certificate from the Intune/Azure Active Directory tenant and import it into ISE to support SSL handshake.
   1. Log on to the Intune Admin Console or Azure Admin console, whichever site has your tenant.
   2. Use the browser to get the certificate details. For, example, with Internet Explorer:
      1. Click on the lock symbol in the browser toolbar, then click View Certificates.

2. In the Certificate window, select the tab Certification Path.

3. Find Baltimore Cyber Trust root on local machine certificate store, and export the root cert.

On Cisco ISE, choose Administration > System > Certificates > Trusted Certificates, and import the root certificate that you just saved. Give the certificate a meaningful name, such as Azure MDM.

Step 2: Export the ISE system certificate and prepare it for Intune/Azure

1. In the ISE console, go to Administration > System > Certificates > System Certificates, select the Default self-signed server certificate, and click Export.
2. Select Export Certificate Only (default) and select a place to save it.
3. Choose Add an application my organization is developing
4. Run the following PowerShell script on the exported certificate file:
   

   $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $cer.Import(“mycer.cer”) $bin = $cer.GetRawCertData() $base64Value = [System.Convert]::ToBase64String($bin) $bin = $cer.GetCertHash() $base64Thumbprint = [System.Convert]::ToBase64String($bin)   $keyid = [System.Guid]::NewGuid().ToString()

   Once script runs, it stores the value in variables. Type the variable name on PowerShell prompt and retrieve the values (please see the below demo screen)

   $base64Value

   $base64Thumbprint

   $keyidDemo:

1. Keep the values for $base64Thumbprint, $base64Value and $keyid, which will be used in the next step.
   

   Step 3: Create an ISE App in Intune/Azure Tenant

   1. Choose 'Add an application my organization is developing' from Azure Active Directory | Enterprise Application - All Applications | Categories | Add an Application

2. Select New application registration

3.   Fill the App properties information

Enter Name: CiscoISE (It can be any name, i have used CiscoISE)

Application type: Web app/API

Sign-on URL: <CiscoISE<MicrosoftTenant>.onmicrosoft.com

NOTE:

1. SIGN-ON URL. The URL where users can sign in and use your app. You can change this later as needed.
2. APP ID URI. The URI used as a unique logical identifier for your app. The URI must be in a verified custom domain for an external user to grant your app access to their data in Windows Azure AD. For example, if your Microsoft tenant is contoso.onmicrosoft.com, the APP ID URI could be https://app.contoso.onmicrosoft.com

4. Click Create to create new CiscoISE Application

5. Select ‘All Applications’ and ‘All Apps’ to list the new Web API created.

 Step 4: Get the manifest file from Azure, add the ISE certificate information, and Upload the updated manifest    into Azure

1. Download the manifest file from Azure (for ISE App created in Step 3)
   1. Click on manifest
   2. click download to download the manifest file.

3. Download and save the file locally ad 'CiscoISE.jason' . NOTE: Please don't change the file name.

4. Once file is open (need to have json editor),

5. Update the keyCredentials field in manifest json file as below:

Replace Base64 Encoded String of ISE PAN Cert with the exported, edited, certificate file from ISE, which is he $base64Value from the PowerShell Script (Refer Step 2)

Replace “Keyid” with Keyid value from PowerShell Script (Refer Step 2)

Replace “CustomeKeyIdentifier” value from the PowerShell script (Refer Step 2)

Sample:

NOTE: Do NOT CHANGE THE NAME OF THE MANIFEST File

Extra Reference: https://msdn.microsoft.com/library/azure/ad/graph/api/entity-and-complex-type-reference#keycredential-type

6. Save the file – Do Not change manifest name

7. Upload the modified Json file to Azure App manifest

Step 5: Getting Values of endpoints attributes from Azure Portal

1. Navigate to App registrations > Endpoints

2. Make Note of below values:

• MICROSOFT AZURE AD GRAPH API ENDPOINT
• OAUTH 2.0 TOKEN ENDPOINT
• APPLICATION ID or CLIENT ID

These 3 values will be used in next step.

Step 6: Add Graph API and Intune API to application with permissions and delegations

Settings for Application permissions and Delegated Permissions:

To configure above settings, Select CiscoISE Registered App again

Go to Settings | Required Permissions | Add

From the Listed APIs, Select ‘Microsoft Graph’

Click on Select permissions and select ‘APPLICATION PERMISSIONS’ and ‘DELEGATED PERMISSIONS’ as below:

APPLICATIONS PERMISSIONS:

• Read Directory data

DELEGATED PERMISSIONS:

• Read and write Microsoft Intune Device Configuration and Policies
• Read Microsoft Intune Configuration
• Sign users in
• Access users’s data anytime

Again Click on Add | Select an API as ‘Microsoft Intune API’ from the listed APIs

Click on Select permissions and select ‘APPLICATION PERMISSIONS’ and ‘DELEGATED PERMISSIONS’ as below:

APPLICATION PERMISSIONS:

• Get device state and compliance information from Microsoft Intune

Again Click on Add | Select an API as ‘Windows Azure Active Directory’ from the listed APIs

Click on Select permissions and select ‘APPLICATION PERMISSIONS’ and ‘DELEGATED PERMISSIONS’ as below:

APPLICATION PERMISSIONS:

• Read directory data

DELEGATED PERMISSIONS:

• Read directory data
• Sign in and read user profile

Final Required Permissions:

Once permissions are selected, click on ‘Grant Permissions’ and Click 'Yes'

7.  In ISE, configure the Intune server in ISE

For more information about configuring and external MDM server, see Define Mobile Device Management Servers in ISE. The fields that are important for Intune are described below:

• Auto Discovery URL - Enter the value of Microsoft Azure AD Graph API Endpoint from the Microsoft Azure management portal. This the endpoint at which an application can access directory data in your Microsoft Azure AD directory using the Graph API. The URL is of the form: https://<hostname>/<tenant id>, for example, https://graph.ppe.windows.net/47f09275-5bc0-4807-8aae-f35cb0341329. An expanded version of this URL is also in the property file, which is of the form:

• Client ID - The unique identifier for your application. Use this if your application accesses data in another application, such as the Microsoft Azure AD Graph API, Microsoft Intune API, and so on.

• Token Issuing URL - Enter the value of the Oauth2.0 Authorization Endpoint from the previous step. This is the endpoint at which your app can obtain an access token using OAuth2.0. After your app is authenticated, Microsoft Azure AD issues your app (ISE) an access token, which allows your app to call the Graph API/ Intune API.

• Token Audience* - The recipient resource that the token is intended for, which is a public, well-known APP ID URL to the Microsoft Intune API.

Value Mapping between Intune and in ISE settings:

This week sees the kick off of the Synnex Microsoft 365 Business Webinar Series. I'll be delivering these over the next three weeks, and then on the final webinar I'll be joined by Nicholas Charritton, Sr Product Marketing Manager - Microsoft 365 Business for Australia for the Ask The Experts Q&A Session.

To register, click here.

By Theo van Kraay, Data and AI Solution Architect at Microsoft

There are a lot of good reasons to use Azure Cosmos DB, as it offers a uniquely ‘single pane of glass’ over the increasingly ‘polyglot persistence’ world of enterprise data. One of the innovative ways in which it does this is with the tunable consistency feature for persisting data (see here for the documented 5 levels of consistency):

It is important to consider the level of consistency in any distributed database, because of the way in which data replication is implemented. With data being spread out across many nodes in the underlying data store, high availability is made possible since the system can tolerate hardware failures and software updates. Cosmos DB can also replicate data to different geographical regions across the world with its unique turn-key global distribution capability, which allows applications to exploit data locality and reduce latency. However, when replication happens, there is obviously a period of time that elapses between data being “written” and all replicas being “consistent”.

So, why is “tunable consistency” important, and what is missing from databases that don’t have such a feature? To answer the question, it might help to look at the driver behind this very useful capability.

CAP theorem is an increasingly well-known theory in computer science, which states that it is impossible for a distributed data store to simultaneously provide more than two out of the following three guarantees:

CAP Theorem is further extended by PACELC Theorem, which goes further in stating that a certain level of trade-off exists between availability and consistency, even without partitions, in a distributed system.

Bottom line: in any distributed system, there is choice between consistency and availability. You can’t have both, and that’s just physics. So, what does this mean in real terms? Let’s look at a couple of extreme examples:

An e-Commerce Website

Let’s say I have an e-commerce system with orders coming in as transactions, and I have a component application that is looking at transactions periodically, and wants to update orders from “pending payment” to “processed payment”. If I were to get a “stale read” (because my written data isn’t “consistent” across all partitions), then I could end up accidentally charging the order twice or more. I absolutely cannot afford to wait for transactions to be eventually consistent across partitions in that scenario. In this situation, I really need “strong consistency”.

Here is another scenario at the opposite end of the spectrum:

A Social Media Website

Let’s say I’m on Facebook and I’m looking at wall posts. What’s actually important here is that I see pages really quickly. If reads are stale, it doesn’t matter all that much. What I’m more interested in here is for my application to not worry about locking reads until data is consistent (and thus slowing down read performance) but rather serving up my pages quickly, whether the data is absolutely up-to-date or not... as long as it’s “eventually” up-to-date. So in this scenario, I am much happier to go with “eventual consistency”.

So, in each scenario, as CAP Theorem mandates, we need to choose one or the other type of consistency. We can’t have both. The problem is that most databases (in fact all, apart from Cosmos DB) typically only offer one of these two types of consistency model: strong or eventual (and nothing in between). So, if you are not using Cosmos DB, not only do you have to manage the two types of scenarios in separate databases, but in the real world it turns out there is actually a “spectrum of consistency” for real business scenarios, rather than a hard binary choice between “strong” or “eventual”, and having only two options turns out to be a little restrictive. This is where Cosmos DB’s 5 consistency levels start to become very useful. Let’s go back to our Facebook example...

I’m looking at my wall posts, and I’m not seeing everyone’s posts straight away, but that’s ok... I’m really none the wiser. However, there is a problem: sometimes my own posts aren’t showing up straight away when the page refreshes, so what do I do? I re-post... and what happens? I see my own post twice! Ok, no big deal, but it’s kind of annoying, isn’t it? Wouldn’t it be nice if I didn’t have to compromise the overall added read performance efficiency of eventual consistency for other people’s posts, but I am always guaranteed to see my own posts?

Enter “session” level consistency (or “read your own writes”):

With this level of consistency, the database guarantees that clients will be able to read their own writes, by ensuring that the replica being read is consistent with the writes within that session (regardless of whether all replicas in the partition are consistent). In this way, throughput and latency savings are achieved while still providing strong “session level” consistency. A further way to simplify this concept in the social media scenario is as follows:

• I am guaranteed to see my own wall posts, which avoids accidental re-posting.
• I do not need to pay for the performance penalty of observing other users (e.g. Bob and Carol) – it’s possible to get stale reads from Bob and Carol’s data.
• I don’t have to suffer slow page loading times because Bob liked Carol’s post. I can see Bob and Carol’s posts pop up in the newsfeed later.
• Likewise, Bob and Carol do not need to pay the performance penalty of observing my writes straight away – they may see a stale copy of my data.
• Bob and Carol also don’t need to suffer slow page loading times because of me - they can see my posts pop up in the newsfeed later.

So ultimately reads are still fast, but there's no more duplicating my own posts… and the same goes for my friends! It is also worth noting that this setting, which is neither completely ‘strong’ or ‘eventual’ in the accepted sense, is actually the most popular consistency setting selected by Cosmos DB users:

The potential benefits don’t stop there. Let’s go back to my e-Commerce site. Let’s say my order transactions aren’t just being polled by an internal application anymore, but are also being read by an array of external 3^rd party order tracking services. Let’s also imagine that my application has increased significantly in scale and the critical business focus has shifted to monitoring of order status rather than updating order status quickly. My application might now be willing to accept a certain level of staleness for writes when updating payment status, but only within a certain metric of, let’s say, amount of time that a replica is allowed to lag behind, in favour of quicker read performance for the external parties so that everyone is able to see the overall status of a transaction at a point in time very quickly, accepting that data could be stale.

Enter bounded staleness in Cosmos DB! Here you can specify maximum lag times on replication:

Let’s look at one more scenario. Let’s say I have a really high throughput chat (messaging) application, and I want to take advantage of eventual consistency for reads because I want to make sure the messages are always available. Imagine we’re chatting about when to meet for dinner and the chat goes something like this:

Me: Let’s meet for dinner
You: Ok
Me: How about 7?
Me: Oh wait, I'm not sure
Me: How about 8?
You: Ok, see you then?
Me: Fine...

The problem here is that it’s possible, with eventual consistency, for those messages to come in out of order from the perspective of any given user. So you might end up meeting me at 7pm instead of 8pm! What’s the solution?

Enter “consistent prefix” consistency in Cosmos DB!

Here, Cosmos DB guarantees that replication always happens in order, regardless of lag.

Not only can you find compromises in scenarios at different levels, but with this ground breaking feature, you can do it in the same database, for the same set of business transactions, tuning as your business case changes.

---

If you’d like to learn more about Azure Cosmos DB, please visit the official website. You can also read up on other Cosmos DB use cases.

For latest news and announcements, please follow us @AzureCosmosDB and #CosmosDB

As a Microsoft Partner Network member, are you looking to build your technical capabilities for Cloud Voice, Collaboration, Modern Desktop and Security & Compliance? Learn first-hand from a Microsoft Partner Technical Consultant during a live, interactive technical webinar where you can ask questions as you learn! Best part? There is no cost to MPN members! Be sure to check out the five new technical webinars added this month, focused on security and compliance scenarios.

There’s more… while technical webinars are the foundation to building your technical skillset, engage with a Partner Technical Consultant through a one-to-one technical consultation to receive technical guidance through virtual white-boarding, architecture reviews and shadowing of real-world scenarios by leveraging your MPN technical presales and deployment benefits.

Learn more about the technical journeys available for the Modern Workplace practice areas to help you as you get started, grow your practice or optimize your practice: Cloud Voice | Collaboration | Modern Desktop | Security & Compliance.

Register today for an upcoming remote technical webinar! Various dates and times are available to suit your morning, afternoon or evening schedule.

As a Microsoft Partner Network member, are you looking to build your technical capabilities for Business Applications, including Customer Engagement and Finance & Operations? Learn first-hand from a Microsoft Partner Technical Consultant during a live, interactive technical webinar where you can ask questions as you learn! Best part? There is no cost to MPN members!

There’s more… while technical webinars are the foundation to building your technical skillset, engage with a Partner Technical Consultant through a one-to-one technical consultation to receive technical guidance through virtual white-boarding, architecture reviews and shadowing of real-world scenarios by leveraging your MPN technical presales and deployment benefits.

Learn more about the technical journeys available for the Business Applications practice areas to help you as you get started, grow your practice or optimize your practice: Customer Engagement | Operations.

Register today for an upcoming remote technical webinar! Various dates and times are available to suit your morning, afternoon or evening schedule.

As a Microsoft Partner Network member, are you looking to build your technical capabilities for Data & AI? Learn first-hand from a Microsoft Partner Technical Consultant during a live, interactive technical webinar where you can ask questions as you learn! Best part? There is no cost to MPN members!

There’s more… while technical webinars are the foundation to building your technical skillset, engage with a Partner Technical Consultant through a one-to-one technical consultation to receive technical guidance through virtual white-boarding, architecture reviews and shadowing of real-world scenarios by leveraging your MPN technical presales and deployment benefits.

Learn more about the technical journey available for Data & AI to help you as you get started, grow your practice or optimize your practice – get started!

Register today for an upcoming remote technical webinar! Various dates and times are available to suit your morning, afternoon or evening schedule.

As a Microsoft Partner Network member, are you looking to build your technical capabilities for Cloud Infrastructure & Management? Learn first-hand from a Microsoft Partner Technical Consultant during a live, interactive technical webinar where you can ask questions as you learn! Best part? There is no cost to MPN members!

There’s more… while technical webinars are the foundation to building your technical skillset, engage with a Partner Technical Consultant through a one-to-one technical consultation to receive technical guidance through virtual white-boarding, architecture reviews and shadowing of real-world scenarios by leveraging your MPN technical presales and deployment benefits.

Learn more about the technical journey available for Cloud Infrastructure & Management to help you as you get started, grow your practice or optimize your practice – get started!

Register today for an upcoming remote technical webinar! Various dates and times are available to suit your morning, afternoon or evening schedule.

As a Microsoft Partner Network member, are you looking to build your technical capabilities for Application Innovation? Learn first-hand from a Microsoft Partner Technical Consultant during a live, interactive technical webinar where you can ask questions as you learn! Best part? There is no cost to MPN members!

There’s more… while technical webinars are the foundation to building your technical skillset, you have a few other options to engage with Microsoft technical experts:

1. Dev Chat – chat live to get the technical tips you need to get started and successfully build Office 365 or Azure apps and get answers to quickly resolve programming questions regarding the capability and services (available in English and Mandarin only) – available at no cost to Network, Action Pack, Silver and Gold MPN partners
2. Technical consultations – receive deeper one-to-one technical guidance through virtual white-boarding, architecture reviews and shadowing of real-world scenarios – available to Action Pack, Silver and Gold MPN partners by leveraging your partner advisory hours; some consultations are at no cost

Learn how to access Dev Chat and request deeper technical consultations to help you plan, build and deploy your apps on Microsoft Azure and for Microsoft Office 365.

Register today for an upcoming remote technical webinar! Various dates and times are available to suit your morning, afternoon or evening schedule.

Juan Cruz, Partner Technical Strategist - System Integrators

We are going to be reviewing the Microsoft Azure Security and Management capabilities of the hybrid cloud. This is part one of our security and management blog series covering Azure Security Center.

Securing Azure resources

If we start by looking at what’s happening within cloud technology as it relates to digital transformation, security is what has become a driving factor in the way businesses operate. The rise of more sophisticated threats is presenting our customers and partners with a new set of challenges. This increase in threats affects everyone, regardless of location, public cloud or on-premise.

As cloud adoption grows, many customers will be moving to cloud through a hybrid approach. The journey to the cloud is a shared responsibility between the customer and Microsoft with regards to securing Azure resources.

Microsoft’s commitment is to secure and manage the cloud foundation through:

• Security and management of physical assets: layers of physical protection, state-of-the-art controls, etc.
• Datacenter operations security and management: security operations center, incident assessments, continuous monitoring by security experts
• Cloud infrastructure security and management: secure multi-tenancy, DDoS defense system, etc.

From a customer perspective, they are responsible for securing and managing cloud resources such as virtual machines, applications, and data.

When you look at the traditional way of deploying cloud applications (IaaS), the customer was ultimately responsible for the entire stack (short of the hardware) meaning they must patch servers and applications and secure data. As customers move towards a hosted and integrated solution, the amount of responsibility starts to shift towards the cloud provider.

The cloud provider is responsible for securing the platform, while you are responsible for securing your application and data. Service providers now have more choices for developer entry points along the control-speed continuum. The question is “Where do I start?” not “Which do I choose?” Partners that are traditionally focused on IaaS can now offer multiple entry points to customers.

Microsoft Azure Security Center

Azure Security Center covers three foundational scenarios – unified visibility and control, adaptive threat prevention, and intelligent detection and response.

With Azure Security Center you can manage the security posture of all your hybrid cloud workloads in a single pane of glass, meaning you can see all the events, and recommendations for all your servers and applications, regardless of where they reside.

Security Center provides features such as central policy management, which allows you to apply policies to existing workloads, as well as helping on-board and discover new workloads (as they are provisioned).

Azure Security Center provides the ability for our customers to ingest data from existing security investments. Microsoft offers extensive integration with our partners, Microsoft’s first party solutions, and many third-party solutions.

With a built-in security assessment, you can continuously identify vulnerabilities within your environment. You can look at items like system updates status or check for an unconfigured NSG.

Within Security Center you can look at the top security recommendations for your environment. Many of these recommendations can be remediated from these alerts within the console.

Azure Security Center also has built in cyber defenses to help block malicious access and applications. Two concepts, such as just-in-time access and prescriptive application whitelisting, can help better secure environments from unknown threats.

As important as it is to understand how to defend ourselves from an attack, it’s equally as important to understand what happened during an attack and how you can prevent that from happening again. With Windows Defender ATP, we’re able to detect threats across the kill chain. You can analyze the target of the attack, review items like install and exploit attacks, and provide post breach information.

As we all start to move towards a more automated world, the automation of detection and prevention provides greater ability to protect and secure an environment, without the need of user intervention.

Our customers can gain visibility into the health, performance, and utilization of their platform, apps, and workloads, no matter where they reside. This allows them to get time back to focus on the initiatives that matter most.

Azure provides monitoring and analytics as a SaaS offering, so you can get started quickly without any infrastructure overhead. It is designed to manage your development and IT operations workflows through a unified experience. It can connect to any data source and you can leverage your existing management tools, both on-premise and in the cloud. You can query at cloud scale and gain immediate insight by correlating and analyzing petabytes of machine data. With built-in solutions and machine learning algorithms baked into the service, you can detect and fix issues before it impacts users… no matter what type of platform you use.

In part two, we will look at some of these features in action and how to better secure your environments. Stay tuned in the coming weeks.

Applications and Infrastructure Technical Community

• Community call schedule
• Yammer group
• Blog series
• Watch community calls on demand 

Exchange 2013 CU20 has been released to the Microsoft download centre!  Exchange 2013 has a different servicing strategy than Exchange 2007/2010 and utilises Cumulative Updates (CUs) rather than the Rollup Updates (RU/UR) which were used previously.    CUs are a complete installation of Exchange 2013 and can be used to install a fresh server or to update a previously installed one.  Exchange 2013 SP1 was in effect CU4, and CU20 is the sixteenth post SP1 release.

This is build 15.00.1367.003 of Exchange 2013 and the update is helpfully named Exchange2013-x64-cu20.exe.  Which is a great improvement over the initial CUs that all had the same file name!  Details for the release are contained in KB 4055221.

Whether or not your AD Schema needs to be updated depends upon your initial Exchange 2013 version.  This will dictate if the AD Schema needs to be modified.  Check the values as noted in this post.  There may be additional RBAC definitions, so PrepareAD should be executed prior to installing CU20.  If setup detects that PrepareAD is required it should be automatically executed if the account running setup has the necessary permissions.  This was an issue first discussed in the MessageCopyForSentAsEnabled  post and in Unexpected Exchange AD Object Values.

Exchange 2007 is no longer supported, updates are not provided once a product has exited out of extended support.

Updates Of Particular Note

.NET framework 4.7.1 is fully supported.    Currently this is an optional item, but will be required with the June 2018 CU.  Plan accordingly!   Customers should test, verify and install CU20 then move to update to .NET 4.7.1 which will be required for the June 2018 CU install.

.NET Framework 4.7 is not supported.

TLS 1.2 is now supported on all supported Exchange versions.  Expect to see additional guidance on this subject.  The first post in this series is already available.   This is a work stream that will require attention as Office 365 will enforce TLS 1.2 on October 31st 2018.  This is an extension to the previous announcement, and details are available here.

4073392 Description of the security update for Microsoft Exchange: March 13, 2018

4073096 Emails sent from a shared mailbox aren't saved in Sent Items when MessageCopyForSentAsEnabled is True

4073097 Monitoring probes of ECP.Proxy health checks fail on all CAS roles in Exchange Server 2013 and 2016

4057216 Health mailbox's password is exposed in logs for a failed probe in Exchange Server 2016 and 2013

CU20 includes the security fixes released to address the issues in the March 2018 security bulletin.

CU20 also includes the latest DST updates.

Issues Resolved

4073392 Description of the security update for Microsoft Exchange: March 13, 2018

4073094 Emails outside a UID range are returned when you request for emails by using IMAP

4073097 Monitoring probes of ECP.Proxy health checks fail on all CAS roles in Exchange Server 2013 and 2016

4057216 Health mailbox's password is exposed in logs for a failed probe in Exchange Server 2016 and 2013

4058384 Get-CalendarDiagnosticAnalysis shows DateTime in 12-hour clock in Exchange Server 2016 and 2013

4057290 Incorrect user is returned in the ECP when one user's display name matches another user's alias

4055433 User is added to an entire series when accepting a single instance through Exchange ActiveSync

4058401 Administrator audit logging does not record Set-ServerComponentState cmdlet details in Exchange Server 2013 or 2016 environment

4073095 "550 5.6.0 CAT.InvalidContent.Exception" and email isn't delivered in Exchange Server 2016 and 2013

4058379 All cross-forest meeting updates have to be accepted again in Exchange Server 2016 and 2013

4073093 Save issues occur when you use the plain Text Editor in OWA of Exchange Server 2013

4073096 Emails sent from a shared mailbox aren't saved in Sent Items when MessageCopyForSentAsEnabled is True

Some Items For Consideration

As with previous CUs, this one also follows the new servicing paradigm which was previously discussed on the blog.  The CU package can be used to perform a new installation, or to upgrade an existing Exchange Server 2013 installation.  You do not need to install Cumulative Update 4 or 5 for Exchange Server 2013 when you are installing the latest CU.  Cumulative Updates are well, cumulative.  What else can I say…

For customers with a hybrid Exchange deployment, must keep their on-premises Exchange servers updated to the latest update or the one immediately prior ( N or N-1).

After you install this cumulative update package, you cannot uninstall the cumulative update package to revert to an earlier version of Exchange 2013. If you uninstall this cumulative update package, Exchange 2013 is removed from the server.

• Test the CU in a lab which is representative of your environment

• Review this post to also factor in AD preparation which is to be done ahead of installing the CU onto the first Exchange server

• Follow your organisation’s change management process, and factor the approval time into your change request

• Provide appropriate notifications as per your process.  This may be to IT teams, or to end users.

• After you install this cumulative update package, you cannot uninstall the cumulative update package to revert to an earlier version of Exchange. If you uninstall this cumulative update package, Exchange is removed from the server.

• Place the server into SCOM maintenance mode prior to installing, confirm the install then take the server out of maintenance mode

• Place the server into Exchange maintenance mode prior to installing, confirm the install then take the server out of maintenance mode

• I personally like to restart prior to installing CUs.  This helps identifies if an issue was due to the CU or happened in this prior restart, and also completes any pending file rename operations.  3rd party AV products are often guilty of this

• Restart the server after installing the CU

• Ensure that all the relevant services are running

• Ensure that event logs are clean, with no errors

• Ensure that you consult with all 3rd party vendors which exist as part of your messaging environment.  This includes archive, backup, mobility and management services

• Ensure that you do not forget to install this update on management servers, jump servers/workstations and application servers where the management tools were installed for an application.  FIM and 3rd party user provisioning solutions are examples of the latter

• Ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed.  See KB981474

• Disable file system antivirus prior to installing.  Do this through the appropriate console.  Typically this will be a central admin console, not the local machine

• Verify file system antivirus is actually disabled

• Once server has been restarted, re-enable file system antivirus

• Note that customised configuration files are overwritten on installation.  Make sure you have any changes fully documented!

• While CU20 does not add any new AD Schema changes.  If you are on an out-dated CU currently, then deploying CU20 may contain AD Schema updates for your organisation – please test and plan accordingly!  Whether or not your AD Schema needs to be updated depends upon your initial Exchange 2013 version.  This will dictate if the AD Schema needs to be modified.  Check the values as noted in this post.  Additional RBAC definitions may also be required.

Please enjoy the update responsibly!

What do I mean by that?  Well, you need to ensure that you are fully informed about the caveats with the CU  and are aware of all of the changes that it will make within your environment.  Additionally you will need to test the CU your lab which is representative of your production environment.

Cheers,

Rhoderick

(This post is part of my review of the Microsoft Professional Program: Cloud Administration)

Course 2 of 11: - Provision and Manage Virtual Machines

Overview:  The "Azure Virtual Machines" course is comprised of 5 modules covering what is Infrastructure as a Service (IaaS), creating virtual machines, configuring virtual machines, virtual machine disks, and how to manage virtual machines. There is two additional modules which cover a practical assessment and final exam which aims to test your recently gained knowledge to the test. Don't skip the introductory module since it covers setting up a free Microsoft Azure trial account which lands you $200 of Azure credit for 30 days. I love free stuff!

Time Spent / Level of Effort: This course is the first real deep dive into what Azure is all about. Compared to the first course where it took me under 3 hours to complete, this course took me between 8-10 hours. As before, I watched all the videos at double speed then completed each quiz after each module. The module quizzes were easy to pass since the answers are explained in the videos or the self-paced reading material. Maybe I missed a few answers in the videos, but I had to search a few answer on the web to complete a few quizzes. The final exam and lab were pretty straight-forward and I passed the overall course with a 82%.

Course Highlight: The terms SaaS, PaaS, and IaaS are not new. However, the course did a really thorough job on explaining the differences between them all in a very simple and easy to understand manner. I have a fair amount of experience with Azure, but never with a true production environment. Module 3 introduced an important Azure feature for production environments called Availability Sets. As an Azure administrator, you must be prepared for planned (updates) and unplanned (hardware) failures. One way to prepare is with Availability Set, which is a logical grouping of two or more virtual machines. For all Virtual Machines that have two or more instances deployed in the same Availability Set, Microsoft guarantees you will have Virtual Machine Connectivity to at least one instance at least 99.95% of the time.

Suggestions: While navigating through the course, take notes on the numerous resources, tools, and tips that are generously provided in each module. Also, since the labs walk through step-by-step to provide the answers for the quizzes, it is easy to set up the environment and then instantly delete it from your Azure account after answering the questions. Here are two interesting resources that I took note of:

Azure Tools for Visual Studio: Where developers can setup a VM for testing quickly using built in templates in Visual Studio.

Azure Resource Explorer:  is a great tool to view and modify resources you have created in your subscription. The tool is web-based and uses your Azure portal logon credentials. The source for the Resource Explorer tool is available on GitHub, which provides a valuable reference if you need to implement similar behavior in your own applications. This tool is particularly useful in viewing Azure scale sets. With the tool you can see the individual virtual machines and their properties.

If you have taken this course in the past or are going through it now, please leave a comment and share your experience.

Thanks,

Adam Lichtenberg [MSFT]

Harvard Business Review Onlineの特設サイト「AI SHIFT」を公開しました。

AIエリアの有識者を取材した特集記事を掲載していますので、ぜひご覧ください。

日本マイクロソフト 執行役員　最高技術責任者（CTO）兼　マイクロソフト ディベロップメント 代表取締役 社長 榊原彰 のインタビュー

「AIを自社のビジネスに生かすために経営者は何をすべきか」

日本マイクロソフト 執行役員 常務　パートナー事業本部長 高橋 美波のインタビュー

「みんなのAI」は企業のビジネスをどう支援するのか

Exchange 2016 CU9 has been released to the Microsoft download centre!  Exchange 2016 has a different servicing strategy than Exchange 2007/2010 and utilises Cumulative Updates (CUs) rather than the Rollup Updates (RU/UR) which were used previously.    CUs are a complete installation of Exchange 2016 and can be used to install a fresh server or to update a previously installed one. Exchange 2013 has the same servicing methodology.

This is build 15.01.1466.003 of Exchange 2016 and the update is helpfully named ExchangeServer2016-x64-CU9.iso which allows us to easily identify the update.  Details for the release are contained in KB 4055222.

Exchange 2007 is no longer supported, updates are not provided once a product has exited out of extended support.

Updates Of Particular Note

.NET framework 4.7.1 is fully supported.    Currently this is an optional item, but will be required with the June 2018 CU.  Plan accordingly!   Customers should test, verify and install CU9 then move to update to .NET 4.7.1 which will be required for the June 2018 CU install.

.NET Framework 4.7 is not supported.

TLS 1.2 is now supported on all supported Exchange versions.  Expect to see additional guidance on this subject.  The first post in this series is already available.   This is a work stream that will require attention as Office 365 will enforce TLS 1.2 on October 31st 2018.  This is an extension to the previous announcement, and details are available here.

As per Active Directory Forest Functional Levels for Exchange Server 2016, it was announced that Exchange Server 2016 would enforce a minimum 2008R2 Forest Functional Level requirement for Active Directory.  Cumulative Update 7 for Exchange Server 2016 started enforcing this AD DS requirement.

4057216 Health mailbox's password is exposed in logs for a failed probe in Exchange Server 2016 and 2013

4073110 You can't access OWA or ECP after you install Exchange Server 2016 CU8

4073392 Description of the security update for Microsoft Exchange: March 13, 2018

4058401 Administrator audit logging does not record Set-ServerComponentState cmdlet details in Exchange Server 2013 or 2016 environment

4073097 Monitoring probes of ECP.Proxy health checks fail on all CAS roles in Exchange Server 2013 and 2016

4073098 The ETS and EXS groups are incorrectly granted “SeDebugPrivilege” in Exchange Server 2016 on-premises

4077924 Store Worker process crashes when you move, restore, or repair mailboxes that have issues with the logical index within the database in Exchange Server 2016

CU9 includes the security fixes released to address the issues in the March 2018 security bulletin.

CU9 also includes the latest DST updates.

Issues Resolved

4054513 Mailbox usage status bar in OWA displays incorrect mailbox usage

4055433 User is added to an entire series when accepting a single instance through Exchange ActiveSync

4057216 Health mailbox's password is exposed in logs for a failed probe in Exchange Server 2016 and 2013

4058373 "A parameter cannot be found" error when you run Install-AntiSpamAgents.ps1 in Exchange Server 2016 CU7

4058379 All cross-forest meeting updates have to be accepted again in Exchange Server 2016 and 2013

4058383 Exchange Control Panel (ECP) redirection fails in Exchange Server 2016

4058384 Get-CalendarDiagnosticAnalysis shows DateTime in 12-hour clock in Exchange Server 2016 and 2013

4058399 Disabling a mailbox can't remove legacyExchangeDN from user's properties in Exchange Server 2016

4073094 Emails outside a UID range are returned when you request for emails by using IMAP

4073095 "550 5.6.0 CAT.InvalidContent.Exception" and email isn't delivered in Exchange Server 2016 and 2013

4073104 PIN can be reset on a Unified Messaging (UM)-enabled mailbox for a user outside a scoped OU

4073103 The Enable-Mailbox cmdlet doesn't block migrated users from provisioning in Exchange Server 2016

4073107 Language can't be changed when a user from a child domain tries to change language in OWA

4073111 Can't access a CAS website such as OWA/ECP/Autodiscover in Exchange Server 2016

4073110 You can't access OWA or ECP after you install Exchange Server 2016 CU8

4073109 Search-MailboxAuditLog -ShowDetails not showing all messages in Exchange Server 2016

4073114 "ADOperationException" error when OWA text verification fails in Exchange Server 2016

4073214 Can't enable OWA offline access in Exchange Server 2016

4073531 CultureNotFoundException when selecting a LCID 4096 language in OWA for Exchange Server 2016

4076520 MatchSubdomains isn't usable for Set-AcceptedDomain in Exchange Server 2016

4076741 Incorrect NDR when an administrator deletes a message from a queue in Exchange Server 2016

4077655 Event ID 258 "Unable to determine the installed file" after you uninstall Windows PowerShell 2.0

4057290 Incorrect user is returned in the ECP when one user's display name matches another user's alias

4058372 Blank page in Exchange Admin Center Audit Log in Exchange Server 2016

4058382 Can't retrieve time slot information about private calendar items as a delegate on another user's account in Exchange Server 2016

4058401 Administrator audit logging does not record Set-ServerComponentState cmdlet details in Exchange Server 2013 or 2016 environment

4073097 Monitoring probes of ECP.Proxy health checks fail on all CAS roles in Exchange Server 2013 and 2016

4073098 The ETS and EXS groups are incorrectly granted “SeDebugPrivilege” in Exchange Server 2016 on-premises

4073108 “There was a problem loading your options” error when a user accesses OWA Voice Mail options in Exchange Server 2016

4077924 Store Worker process crashes when you move, restore, or repair mailboxes that have issues with the logical index within the database in Exchange Server 2016

4091453 Update improves linguistics features and CJK handling for search in Exchange Server 2016

4073392 Description of the security update for Microsoft Exchange: March 13, 2018

After you install Cumulative Update 9 for Exchange Server 2016, the Accept button disappears in the invitation email message of a shared calendar in Outlook Web App (OWA). Therefore, you cannot add the shared calendar by clicking the Accept button directly.

Some Items For Consideration

Exchange 2016 follows the same servicing paradigm for Exchange 2013 which was previously discussed on the blog.  The CU package can be used to perform a new installation, or to upgrade an existing Exchange Server 2016 installation to this CU.  Cumulative Updates are well, cumulative.  What else can I say…

For customers with a hybrid Exchange deployment, must keep their on-premises Exchange servers updated to the latest update or the one immediately prior ( N or N-1).

• Test the CU in a lab which is representative of your environment

• Review this post to also factor in AD preparation which is to be done ahead of installing the CU onto the first Exchange server

• Follow your organisation’s change management process, and factor the approval time into your change request

• Provide appropriate notifications as per your process.  This may be to IT teams, or to end users.

• After you install this cumulative update package, you cannot uninstall the cumulative update package to revert to an earlier version of Exchange. If you uninstall this cumulative update package, Exchange is removed from the server.

• Place the server into SCOM maintenance mode prior to installing, confirm the install then take the server out of maintenance mode

• lace the server into Exchange maintenance mode prior to installing, confirm the install then take the server out of maintenance mode

• I personally like to restart prior to installing CUs.  This helps identifies if an issue was due to the CU or happened in this prior restart, and also completes any pending file rename operations.  3rd party AV products are often guilty of this

• Restart the server after installing the CU

• Ensure that all the relevant services are running

• Ensure that event logs are clean, with no errors

• Ensure that you consult with all 3rd party vendors which exist as part of your messaging environment.  This includes archive, backup, mobility and management services.

• Ensure that you do not forget to install this update on management servers, jump servers/workstations and application servers where the management tools were installed for an application.  FIM and 3rd party user provisioning solutions are examples of the latter.

• Ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed.  See KB981474.

• Disable file system antivirus prior to installing. Do this through the appropriate console.  Typically this will be a central admin console, not the local machine.

• Verify file system antivirus is actually disabled

• Once server has been restarted, re-enable file system antivirus.

• Note that customised configuration files are overwritten on installation.  Make sure you have any changes fully documented!

• CU9 does NOT contain new AD Schema updates for your organisation.

While CU9 does not add any new AD Schema changes.  If you are on an out-dated CU currently, then deploying CU9 may contain AD Schema updates for your organisation – please test and plan accordingly!  Whether or not your AD Schema needs to be updated depends upon your initial Exchange 2016 version.  This will dictate if the AD Schema needs to be modified.

Please enjoy the update responsibly!

What do I mean by that?  Well, you need to ensure that you are fully informed about the caveats with the CU  and are aware of all of the changes that it will make within your environment.  Additionally you will need to test the CU your lab which is representative of your production environment.

Cheers,

Rhoderick

Introducing Windows Server 2019 – now available in preview
https://cloudblogs.microsoft.com/windowsserver/2018/03/20/introducing-windows-server-2019-now-available-in-preview/

Interested in checking out the upcoming capabilities in Windows Server 2019? Head on over to the Insiders program and sign up if you haven't already. Have a look at the post on the Windows Server Blog to get started, and then head on over to Windows Server community join the conversation.

Frequently asked questions

Q: When will Windows Server 2019 be generally available?

A: Windows Server 2019 will be generally available in the second half of calendar year 2018.

Q: Is Windows Server 2019 a Long-Term Servicing Channel (LTSC) release?

A: Windows Server 2019 will mark the next release in our Long-Term Servicing Channel. LTSC continues to be the recommended version of Windows Server for most of the infrastructure scenarios, including workloads like Microsoft SQL Server, Microsoft SharePoint, and Windows Server Software-defined solutions.

Q: What are the installation options available for Windows Server 2019?

A: As an LTSC release Windows Server 2019 provides the Server with Desktop Experience and Server Core installation options – in contrast to the Semi-Annual Channel that provides only the Server Core installation option and Nano Server as a container image. This will ensure application compatibility for existing workloads.

Q: Will there be a Semi-Annual Channel release at the same time as Windows Server 2019?

A: Yes. The Semi-Annual Channel release scheduled to go at the same time as Windows Server 2019 will bring container innovations and will follow the regular support lifecycle for Semi-Annual Channel releases – 18 months.

Q: Does Windows Server 2019 have the same licensing model as Windows Server 2016?

A: Yes. Check more information on how to license Windows Server 2016 today in the Windows Server Pricing page. It is highly likely we will increase pricing for Windows Server Client Access Licensing (CAL). We will provide more details when available.

Today's tip...

We continue to expand the Azure Marketplace ecosystem. In February 2018, 81 new offers successfully met the onboarding criteria and went live.

Reference: New offers in Azure Marketplace – February 2018 - https://azure.microsoft.com/en-us/blog/new-offers-in-azure-marketplace-february-2018/

10 апреля в 11:00 приглашаем наших слушателей на вебинар «Введение в облачную аналитику с помощью машинного обучения в Azure»

Вебинар будет полезен широкому кругу специалистов, которые хотят использовать в своей практической деятельности облачную аналитику для реализации машинного обучения и построения сервисов прогнозов, и которым важна задача визуализации результатов анализа данных и представления отчетов о процессе работы в виде диаграмм.

Microsoft Azure Machine Learning (ML) делает машинное обучение доступным для каждого предприятия, научного сотрудника, разработчика, информационного работника, потребителя и специального устройства в любой точке мира.

В вебинаре будут рассмотрены вводные темы, помогающие понять как:

• Описать общую проблематику машинного обучения и то, как ML используется в службах Azure.
• Рассмотреть возможности Azure ML Studio, рабочие пространства, эксперименты, проекты и модули.
• Создавать ML приложения.

В программе вебинара:

• Среда Azure ML
• Azure ML Studio
• Использование моделей Azure ML
• Разработка ML приложений

Своими знаниями и опытом поделится преподаватель «Сетевой Академии» Сергей Гущин, обладающий сертификациями MCP,MCSD,MCPD,MCTS,MCT.  Регистрация на вебинар