Are you in compliance with:

• EU General Data Protection Regulation (GDPR)

• and/or

• and/or

• and/or

• and/or

• and/or

Use Compliance Manager to help meet data protection and regulatory requirements when using Microsoft cloud services
https://docs.microsoft.com/en-us/office365/securitycompliance/meet-data-protection-and-regulatory-reqs-using-microsoft-cloud

Manage Your Compliance from One Place – Announcing Compliance Manager
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Manage-Your-Compliance-from-One-Place-Announcing-Compliance/ba-p/106493

Use Compliance Manager and Service Trust Portal to enhance your GDPR readiness
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Use-Compliance-Manager-and-Service-Trust-Portal-to-enhance-your/ba-p/196965

Announcing Compliance Manager general availability
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Announcing-Compliance-Manager-general-availability/ba-p/161922

• Compliance Manager Preview is now available
  https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Compliance-Manager-Preview-is-now-available/ba-p/124662

To give it a try:
https://aka.ms/STP and then click on “Compliance Manager” or go directly to it https://servicetrust.microsoft.com/ComplianceManager

Thanks,

Yong

執筆者: Ron Ortloff (Senior Program Manager)

このポストは、2019 年 3 月 14 日に投稿された Now available for preview: Workload importance for Azure SQL Data Warehouse の翻訳です。

Azure SQL Data Warehouse は、あらゆる規模の企業で利用できる高速で柔軟な安全性の高い分析プラットフォームです。本日マイクロソフトは、Gen2 プラットフォームで、ワークロードの重要度のプレビューを開始しました。ワークロードの重要度はお客様のリソース管理の効率化を支援する機能で、データ エンジニアは要求を重要度別に分類することができます。重要度が高い要求は優先的にリソースにアクセスできるようになり、SLA を満たしやすくなります。

データ ウェアハウス ソリューションの運用では、多くの場合、「少ないコストでより大きな成果」を出すことが求められますが、コンピューティング リソースを簡単にスケールアップできるようになれば、より柔軟な運用が可能になります。しかし、予算の制限が厳しかったり、スケールダウンの必要がある場合は一筋縄ではいきません。ワークロードの重要度を使用すると、リソースの限られた共有環境で、ビジネス価値の高い処理が優先的に SLA を満たせるようになります。

ワークロードの重要度の機能を以下のアニメーションで説明しましょう。アナリストの要求が続いた後、最後に CEO の要求が送信されました。CEO の要求は高い重要度に分類されたため、リソースへのアクセスが先に割り当てられました。これにより、完了までの時間も短縮されています。

重要度で要求を分類する方法

要求の分類は、新たに追加された CREATE WORKLOAD CLASSIFIER (英語) 構文で行うことができます。以下のログインの例をご覧ください。ExecutiveReports ロールが ABOVE_NORMAL重要度にマッピングされ、AdhocUsers ロールが BELOW_NORMAL 重要度にマッピングされています。この構成では、ExecutiveReports ロールのメンバーのクエリが先に完了します。これは、AdhocUsers ロールのメンバーよりも先にリソースへのアクセスが割り当てられるためです。

CREATE WORKLOAD CLASSIFIER ExecReportsClassifier
   WITH (WORKLOAD_GROUP = 'mediumrc'
        ,MEMBERNAME     = 'ExecutiveReports'
        ,IMPORTANCE     =  above_normal);

CREATE WORKLOAD CLASSIFIER AdhocClassifier
    WITH (WORKLOAD_GROUP = 'smallrc'
         ,MEMBERNAME     = 'AdhocUsers'
         ,IMPORTANCE     =  below_normal);

ワークロードの重要度の詳しい情報については、分類 (英語) と重要度 (英語) の概要ドキュメントをご確認ください。また、CREATE WORKLOAD CLASSIFIER (英語) のドキュメントもお読みください。

ワークロードの重要度の実際の動作は、以下のビデオで見ることができます。

• ワークロードの重要度の概念 (英語)
• ワークロードの重要度のシナリオ (英語)

次のステップ

• 使用を開始するには、Azure SQL Data Warehouse を作成してください。
• 機能に関するリクエストは、UserVoice (英語) までお寄せください。投票もできます。
• Twitter アカウント (@AzureSQLDW) をフォローして、Azure SQL Data Warehouse の最新情報をチェックしてください。

執筆者: MICROSOFT WINDOWS SERVER TEAM

このポストは、2019 年 3 月 7 日に投稿された Now available: Microsoft System Center 2019! の翻訳です。

今回は、System Center の主任 PM マネージャーを務める Vithalprasad Gaitonde の記事をご紹介します。

2019 年 3 月 14 日更新: 2019 年 3 月 7 日、マイクロソフトは System Center 2019 が近日中にリリースされることを発表しました。そして本日 3 月 14 日、System Center 2019 の一般提供を開始しました。System Center 2019 の有効なライセンスをお持ちのお客様は、ボリューム ライセンス サービス センター (VLSC) からさっそくダウンロードしていただけます。また、System Center 2019 の評価版は Microsoft Evaluation Center から入手可能です。

お客様のパブリック クラウドやオンプレミス データセンターの導入拡大に合わせて、管理ツールにも進化が求められます。System Center スイートは、オンプレミス データセンター管理において引き続き重要な役割を果たすと共に、パブリック クラウドの導入に伴って増える IT 部門の新たなニーズにも対応していきます。

本日は、Microsoft System Center 2019 の一般提供開始をお伝えでき、たいへん嬉しく思います。System Center 2019 によって、Windows Server 2019 のより大規模なデプロイと管理が可能になり、皆様のデータセンターのニーズにお応えできます。

System Center 2019 は、2018 年 12 月から Windows Server Technical Adoption Program (TAP) を通じてプライベート プレビューを実施してきました。その間お寄せいただいた皆様からのフィードバックに心から感謝します。

この記事では、System Center 2019 の概要を説明していきたいと思います。このリリースで重点的に取り組んできたポイントは以下のとおりです。

• 最先端のツールによるデータセンターの監視と管理
• Windows Server の最新バージョンのサポートと管理
• Azure とのハイブリッドの管理と監視の実現

System Center 2019 は長期サービス チャネル (Long Term Servicing Channel: LTSC) リリースであり、5 年間の標準サポートと 5 年間の延長サポートが提供されます。一般提供後は、5 年間のメインストリーム サポートの期間中 6 か月おきにリリースされる更新プログラムのロールアップ (Update Rollup: UR) の内容が継続的に反映されていきます。

System Center 2019 は次の点を重視して設計されています。

ハイブリッド

今日、企業における環境はオンプレミスからクラウドにまで拡大しており、お客様は社内にある既存のオンプレミス ツールで Azure サービスによるイノベーションを実現しようとされています。それを可能にするために、マイクロソフトは System Center と Azure の管理サービスを統合し、オンプレミス ツールを補完できるようにしました。

• Service Map と System Center Operations Manager (SCOM) を統合したことで、Service Map の動的な依存関係マップをベースに Operations Manager (OM) の分散アプリケーションの図を自動で作成できるようになりました。
• Azure Management Pack により、SCOM のパフォーマンスやアラート メトリックを表示したり、Application Insights の Web アプリケーション監視と統合したり、Azure Blob Storage や Azure Data Factory といったさらに多くの PaaS サービスを監視できるようになりました。
• Virtual Machine Manager (VMM) 2019 により、Azure Update Management との統合で、VM への修正が簡単になりました。

SCOM Web コンソールの Azure リソース用ダッシュボード

セキュリティ

セキュリティ脅威の数が増え、ますます巧妙化していることから、セキュリティは依然として企業の最優先課題であることがわかります。

• System Center 製品では新たにサービス ログオンがサポートされ、セキュリティのベスト プラクティスに従い、インタラクティブ ログオンの使用が回避されるようになりました。
• VM 管理者という新たなロールが追加されました。VM 管理者にはデータセンターのファブリックを読み取り専用で表示するための権限が提供されますが、ファブリック管理への特権のエスカレーションは禁止されます。

VMM の VM 管理者ロール

ソフトウェア定義データセンター

ハイパーコンバージド インフラストラクチャ (HCI) は、今日のオンプレミス データセンターを取り巻く一大トレンドです。高パフォーマンスのローカル ディスク搭載サーバーを使用してコンピューティングとストレージのニーズを同時に満たし、コストを削減できるメリットがあります。

• VMM 2019 では、Storage Spaces Direct クラスターのアップグレードや修正プログラムの適用をダウンタイムなしで行ったり、ディスクの正常性を監視するなど、HCI 環境を効率的に管理、監視できます。
• VMM 2019 のストレージ最適化により、クラスターの共有ボリューム全体にわたって VHD の配置を最適化し、ストレージの空き容量が不足した場合に VM が停止するのを防止できます。

VMM のストレージの正常性

運用と監視の最新化

SCOM の拡張性と管理パックのエコシステムは、お客様がマイクロソフトとサードパーティのワークロードを監視するうえで欠かせないものとなっています。

• SCOM Web コンソールの HTML 5 ダッシュボードとドリルダウン操作により、レイアウトをシンプルに表示できるようになったほか、カスタム ウィジェットと SCOM REST API (英語) で監視コンソールを拡張できるようになりました。
• SCOM 2019 ではメール通知も最新化され、HTML メールがサポートされました。
• SCOM 2019 ではモニター ベースのアラートに新しいアラート エクスペリエンスが追加されました。ベースのモニターに異常な状態が表れた場合、オペレーターはアラートをただ停止することはできず、確認を行う必要があります。
• SCOM では、Fluentd (英語) を活用して Linux の監視を強化しています。SCOM 2019 では Linux 環境の管理サーバーのフェールオーバーに対する回復性が実現されました。
• すべての SCOM 管理パックで Windows Server 2019 のロールと機能がサポートされました。

SCOM Web コンソール

Data Protection Manager 2019 によるバックアップの高速化

Data Protection Manager (DPM) 2019 では、バックアップの時間と容量が最適化され、高速化とストレージ使用量の削減が実現しています。

• DPM を使用するとバックアップのパフォーマンスが向上します。バックアップ速度が 75% アップするほか、Log Analytics で主要なバックアップ パラメーターを監視できます。
• VMware VM からテープへのバックアップのサポートが強化されました。Windows Server 2019 に加え、SharePoint 2019 や Exchange 2019 などのワークロードのバックアップが新たに提供されます。

Log Analytics を使用した DPM のアラートとレポート

Orchestrator 2019 と Service Manager 2019

Orchestrator 2019 では PowerShell バージョン 4.0 以上をサポートしており、64 ビット コマンドレットを実行できます。Service Manager 2019 では Active Directory (AD) コネクタが強化され、特定のドメイン コントローラーと同期できるようになりました。

リリース頻度の変更

最後になりますが、新機能の提供方法を最適化するために、System Center のリリース頻度を変更することになりました。System Center には現在、長期サービス チャネル (LTSC) と 半期チャネル (Semi-Annual Channel: SAC) の 2 つに加え、更新プログラムのロールアップ (UR) があります。

お客様の多くは System Center 2016 などの LTSC を使用してデータセンターのインフラストラクチャを運用しています。LTSC では 5 年間のメインストリーム サポートと 5 年間の延長サポートが提供され、UR によって追加の修正プログラムと更新プログラムが提供されます。お客様からのフィードバックによると、多くの System Center デプロイには LTSC が適していることがわかりました。LTSC の方が更新サイクルが長く、安定しているためです。

こうしたことから、System Center のイノベーション計画では LTSC リリースにリソースを集中させ、SAC リリースを中止することにしました。System Center 2019 では、直前の 2 つの SAC リリースからのアップグレードがサポートされます。具体的には、System Center 1801 または 1807 から System Center 2019 にアップグレードできます。System Center 2016 を System Center 2019 にアップグレードできるのと同じです。

なお、System Center Configuration Manager (SCCM) は、この System Center 2019 のリリース頻度の変更による影響を受けません。「Configuration Manager の Current Branch バージョンのサポート」ドキュメントに記載のとおり、Current Branch は引き続き年 3 回リリースされます。

次のステップ

System Center 2019 には、3 月中にすべてのチャネルでアクセスできるようになります。System Center 2019 のリリースに合わせて、ブログ記事を公開する予定です。今後のリリースに追加してほしい新機能や機能強化がありましたらぜひお知らせください。アイデアやご提案は UserVoice までお寄せください。既にご提案いただいているアイデアに投票していただくこともできます。

よく寄せられる質問

Q: System Center 2019 はいつからダウンロードできますか。

A: 2019 年 3 月 14 日に System Center 2019 の一般提供が開始されます。System Center 2019 の有効なライセンスをお持ちの場合、ボリューム ライセンス サービス センター (VLSC) からメディアをダウンロードできます。

Q: System Center 2019 の価格に変更はありますか。

A: いいえ、ありません。

Q: System Center 2019 と同時に新しい半期チャネル リリースは提供されますか。

A: いいえ。半期チャネル リリースは提供されません。新機能は、次回の長期サービス チャネルのリリースの前に、更新プログラムのロールアップ (UR) を通じて提供されます。

Today's tip...

By now most of you should are probably familiar with the concept and cadence of the LTSC and SAC release cycles. Occasionally however, twists and turns in the evolution of servicing and the use of potentially unfamiliar terms such as CB, CBB, and SAC-T may leave you feeling a little…fuzzy.

Here is a nice little pair of articles that should help solidify your understanding of the past, present, and future of the Windows Servicing model, the second of which outlines a bit of what you can expect in the next version of Windows 10.

Windows 10 and the “disappearing” SAC-T (May 31st, 2018)

Windows Update for Business and the retirement of SAC-T (February 14th, 2019)

Announcing new, technical webinars and consultations that will rapidly expand your Intelligent Communications technical knowledge base. Technical webinars are available to you as a Partner Network member at no cost and one-to-one personalized consultations can be leveraged by using your MPN technical benefits.

New technical webinars:

Introduction to Intelligent Communications – Discover how Intelligent Communications boosts productivity by using Microsoft Teams. Utilizing Microsoft Teams features, in integration with Microsoft Cloud Portfolio, will allow partners to create a comprehensive practice with significant growth potential.

Technical Deep Dive on Microsoft Cloud Voicemail – Cloud Voicemail is replacing Exchange Online Unified Messaging (UM) in providing voice messaging functionality for Skype for Business 2019 voice users.

Cloud Voicemail provides the following benefits for on-premises and online users who have mailboxes on Exchange Server 2019 or Exchange Online:

• Voicemail answering and deposit functionality with enhanced speech transcription
• Access to Exchange mailbox voicemails by using Skype for Business Online or Outlook clients
• Ability to use the Office 365 web-based portal to manage voicemail options
• Support for Exchange mailboxes on-premises or in the cloud
• Leveraging of existing user greetings from Exchange Online Unified Messaging

New technical consults:

Intelligent Communications Starter Kit – In this technical webinar, you will receive an overview of how Intelligent Communications delivers immersive experiences that help organizations boost productivity. People can work more efficiently across Teams and stay connected wherever they are, on any device. You can make the most of this opportunity by offering integrated messaging, calling and meeting solutions built on Microsoft 365. You’ll also understand the different components and licensing options available for Microsoft 365.

Build your technical capabilities for Intelligent Communication by receiving technical guidance from Microsoft Partner Technical Consultants through additional, interactive technical webinars and personalized consultations, architecture reviews and best practices of real-world scenarios.

Intelligent Communications Presales Consultation – Help your customers understand and adopt the next generation of Microsoft Productivity Solutions; Learn how Unified Communications have evolved into Intelligent Communications. In this technical webinar, you will learn how Microsoft Teams interacts with email and collaboration services within Microsoft 365. You will also get a better understanding on why Microsoft defines Teams as the new Teamwork Hub as well as learn best practices and recommendations for initial adoption planning and set up of Microsoft Teams.

Intelligent Communications Deployment Consultation – Explore different approaches to the Microsoft Teams upgrade path and receive recommendations to define and deploy your Intelligent Communications solutions. Capture more of the Microsoft 365 opportunities by combining and expanding your communications and collaboration practices with Microsoft Teams offerings. Also get to know the new possibilities of the platform to integrate and deploy calling solutions with technologies like Direct Routing and Phone System.

Explore the full suite of technical webinars and consultations available for the Intelligent Communications technical journey at aka.ms/IntelligentCommsTechJourney.

みなさま、こんにちは。WSUS サポート チームです。

こちらの公開情報でも紹介している通り、Microsoft ではセキュリティ保護のために SHA-1 から SHA-2 への移行を段階的に進めており、この一環として Windows Update や WSUS 等から配信される更新プログラムに付与されているコード証明書についても SHA-2 へ移行を行うことを予定しております。

具体的なタイムラインについては、以下の公開情報で最新の情報を随時紹介しております。特に WSUS 3.0 SP2 や Windows 7 SP1、Windows Server 2008 SP2、Windows Server 2008 R2 SP1 を利用しているお客様は、これからリリースされる SHA-2 の証明書のみが付与された更新プログラムを適用・配信するために、期限までに更新プログラムの適用が必要になります。

適用すべき更新プログラムや今後の移行スケジュールの情報は、次の公開情報に記載しております。ご一読いただき、期限までに更新プログラムを適用くださいますようお願いいたします。

The first part of this series introduced Semmle QL, and how the Microsoft Security Response Center (MSRC) are using it to investigate variants of vulnerabilities reported to us. This post discusses an example of how we’ve been using it proactively, covering a security audit of an Azure firmware component.

This was part of a wider defense in depth security review of Azure services, exploring attack vectors from the point of view of a hypothetical adversary who has already penetrated at least one security boundary, and now sits in the operating environment of a service backend (marked with * on the diagram below).

One of the targets of this review was a Linux-based embedded device that interfaces both with a service backend and a management backend, passing operational data between the two. The main attack surface of this device is a management protocol used on both interfaces.

An initial manual review of its firmware indicated that this management protocol is message-based, and there are over four hundred different message types, each with their own handler function. Manually auditing every single function would have been tedious and error-prone, so using Semmle to scale up our code review capabilities was an easy choice. We found 33 vulnerable message handler functions in total, using the static analysis techniques discussed in this post.

Defining the attack surface

Our first step was to write some QL to model data that would be sourced from an attacker. The management protocol works on a request-response basis, where every message request type is identified with a category number and a command number. This is defined in the source code using arrays of structures such as this:

In the example above, a message with category type CMD_CATEGORY_BASE and command type CMD_GET_COMPONENT_VER would be routed to the GetComponentVer function. The command handler table also has information on the expected size of the request message, which is validated in the message dispatch routines prior to calling the handler function.

We defined the message handler table with the following QL:

This takes a variable named g_MessageCategoryTable, finds its initializing expression, and matches all children of this expression – each child expression corresponds to a row of the message category table. For each row, it takes the second column (this is getChild(1) because the parameter of the getChild predicate is zero-indexed), each of which are references to a command handler table, and matches on the variable referenced. In the example above, these would be g_CommandHandlers_Base and g_CommandHandlers_App0.

We defined the set of message handler functions using a similar approach:

This QL class uses a member variable tableEntry to hold the set of all rows in all command handler tables. This is so it can be referenced in both the characteristic predicate (MessageHandlerFunction() { … }) and getExpectedRequestLength(), without repeating the definition.

All of this maps to the code structure above as follows:

Each message handler function has the same signature:

And follows a general pattern where the request data is cast to a struct type representing the message layout, and accessed via its fields:

In this analysis, we were only interested in the request data. We defined two additional predicates in the MessageHandlerFunction QL class to model the request data and its length:

Having abstracted away the definition of a message handler function, it can be used as we would any other QL class. For example, this query lists all message handler functions in descending order of their cyclomatic complexity:

Analyzing data flow

Now that we’d defined a set of entry points for untrusted data, the next step was to find where it may be used in an unsafe manner. To do this, we needed to follow the flow of such data through the codebase. QL provides a powerful global data flow library which abstracts away most of the tricky language-specific detail involved in this.

The DataFlow library is brought into the scope of the query with:

It is used by subclassing DataFlow::Configuration and overriding its predicates to define the data flow as it applies to DataFlow::Node, a QL class representing any program artefact that data can flow through:

Most data flow queries will look something like this:

Note that the QL data flow library performs an interprocedural analysis – in addition to examining data flows local to a function, it will include data flowing through function call arguments. This was an essential feature for our security review, as although the vulnerable code patterns discussed below are shown in simple example functions for ease of demonstration, in the actual source code for our target, most of the results had data flows spanning multiple complex functions.

Finding memory safety vulnerabilities

As this firmware component was a pure C codebase, we first decided to search for code patterns relating to memory safety.

One common source of such bugs is array indexing without performing a bounds check. Searching for this pattern in isolation would provide a large proportion of results that are most likely not security vulnerabilities, as what we are really interested in is where the attacker has some control over the index value. So in this case, we are looking for data flows where the sink is an array indexing expression, the source is the request data of a message handler function, and there is a barrier on any data flow node guarded by a relevant bounds check.

For example, we want to find data flows matching code like this:

But we also want to exclude data flows for code like this:

The source is defined using the MessageHandlerFunction class discussed earlier, and we can use the getArrayOffset predicate of an ArrayExpr to define a suitable sink:

By default, the DataFlow library only includes flows that preserve the value at each node, such as function call parameters, assignment expressions, and the like. But we also need data to flow from the request data pointer to the fields of the structure it was cast to. We’ll do that like this:

To exclude flows with a bounds check, we place a barrier on any node with a variable or field that is used in some conditional statement earlier on in the control flow graph (for now, we make the assumption that any such bounds check is done correctly):

Applying this to the two examples above, the data flow through each node would be:

In our firmware codebase, this query located a total of 18 vulnerabilities across 15 message handler function, a mix of attacker-controlled out of bounds reads and writes.

We applied a similar analysis to find where arguments of function calls were taken from the message request data without first being validated. Firstly, we defined a QL class to define the function calls and arguments of interest, including the size argument of calls to memcpy and a similar function _fmemcpy, and the length argument of CalculateChecksum. CalculateChecksum is a function specific to this codebase that would return the CRC32 of a buffer, and could be potentially be used as an information disclosure primitive where the message handler function copied this value into its response buffer.

Next, we modified the sink of the previous query to match on ArgumentMustBeCheckedFunctionCall instead of an array index:

This query revealed a further 17 vulnerabilities in 13 message handlers, mostly attacker-controlled out of bounds reads (for which we later confirmed was disclosed in a response message), with one out of bounds write.

Taint tracking

In the above queries, we overrode the DataFlow library’s isAdditionalFlowStep predicate to ensure that where data flowed to a pointer to a structure, the fields of that structure would be added as nodes in the data flow graph. We did this because by default, the data flow analysis only includes paths where the value of the data remains unmodified, but we wanted to keep track of a particular set of expressions that it may have affected too. That is, we defined a particular set of expressions that were tainted by untrusted data.

QL contains a built-in library to apply a more general approach to taint tracking. Developed on top of the DataFlow library, it overrides isAdditionalFlowStep with a much richer set of rules for value-modifying expressions. This is the TaintTracking library, and it is imported in a similar manner to DataFlow:

It is used in almost the same way as the data flow library, except that the QL class to extend is TaintTracking::Configuration, with these configuration predicates:

We re-ran the earlier queries with isAdditionalFlowStep removed (as we no longer need to define it) and isBarrier renamed to isSanitizer. As expected, it returned all the results mentioned above, but also uncovered some additional integer underflow flaws in array indexing. For example:

For our internal reporting of each vulnerability type, we were interested in classifying these separately from the earlier query results. This involved a simple modification to the sink, using the SubExpr QL class:

This gave us an additional 3 vulnerabilities in 2 message handler functions.

Finding path traversal vulnerabilities

With the intent of finding potential path traversal vulnerabilities, we used QL to attempt to identify message handler functions which used an attacker-controlled filename in a file open function.

We used a slightly different approach to taint tracking this time, defining some additional taint steps that would flow through various string-processing C library functions:

And defined the sink as the path argument to a file open function:

With some foreknowledge of how our target device worked, observed from an initial review, we expected at least some results before we tackled the next problem of excluding flows where the data was validated, as with the earlier queries. However, the query returned nothing at all.

With no data flow paths to examine, we fell back on querying the function call graph to search for any path between the message handler functions and a call to a file open function, excluding calls where the path argument was a constant:

This query provided 5 results – sufficiently few to examine manually – and from this we uncovered 2 path traversal vulnerabilities, one in writing to a file and one in reading from a file, both with an attacker-supplied path. It turned out that the taint tracking didn’t flag these because it required two separate message types to be sent: the first to set the filename, and the second to read or write data to the file with that name. Fortunately, QL was flexible enough to permit an alternative route of exploration.

Conclusions

At Microsoft, we take a defense in depth approach to securing the cloud and keeping our customers’ data safe. An important part of this is performing comprehensive security reviews of Azure internal attack surfaces. In this source code review of an embedded device, we applied the advanced static analysis techniques of Semmle QL to finding vulnerabilities in a message-based management protocol. This uncovered a total of 33 vulnerable message handlers, within a variety of bug classes. Using QL enabled us to automate the repetitive parts of what would otherwise be an entirely manual code review, while still applying an explorative approach.

 
Steven Hunter and Christopher Ertl, MSRC Vulnerabilities & Mitigations team

In script version 1.3 we began the introduction of logic that allowed administrators to convert the distribution group to a mail enabled contact post migration.  It was extremely simplistic in that the function utilized retained as many attributes of the distribution list, deleted the distribution list, and created a mail enabled contact utilizing the retained attributes.  On the surface this functionality worked well for preserving mail flow and allowing an object to be represented in the global address list. 

The simplistic logic introduced several potential issues.

• The deleted distribution list could be members of other distribution lists or groups.
• The deleted distribution list could have exceptions on other groups – for example managedBy, AcceptMessagesOnlyFromSendersOrMembers, RejectMessagesFromSendersOrMembers, etc.
• When the distribution list is deleted all of the other dependencies on that list are lost.

In addition to the concerns of what is lost when deleting the distribution group this version also attempts to address a concern brought forth by a customer utilizing the script for migration.  In version 1.4 the default behavior was to move the distribution group to an organizational unit that does not synchronize through Azure Active Directory Connect.  This method is utilized to ensure that the group object on premises does not collide with the group object created directly in Office 365.  In this customers instance the organizational unit that was intentionally excluded from synchronization was accidentally selected for synchronization.  When the groups were detected – Azure Active Directory Connect soft matches the on-premises group to the migrated group and changes the source of authority to on-premises.  In addition any changes that were processed directly in the cloud were overwritten with old data retained on-premises.

With the background what changed in version 1.4.

Changing default convert to contact logic:

In prior versions the conversion to contact was optional.  It continues to be optional but the default behavior has changed.  Instead of moving the group to the non-sync OU and leaving it – it is now deleted and converted to a mail enabled contact by default.

Changing domain controller logic:

In prior versions a specific domain controller was not specified by the administrator for directory operations.  Using the Exchange Management Shell logic – a domain controller local to the connected Exchange Server was utilized.  In multi-site environments it was possible that the endpoint processing the Exchange commands and the Azure Active Directory Connect server would be utilizing different sets of domain controller.  The scripts logic for dealing with this was to perform a global Active Directory replication which was inefficient.  The script now requires the administrator to specify a specific domain controller for operations.  Inbound and outbound replication is triggered from this specific domain controller.  The domain controller specified should be in the same site as the Azure Active Directory Connect Server.  When utilizing a domain controller in the same site as the ADConnect server we cut down on overall time waiting for ADConnect to replicate the distribution group removal from Office 365.

Tracking migrated distribution group settings for on-premises objects:

To facilitate a lossless migration new logic was implemented to track permissions and settings of the migrated group.  Specifically we do the following:

• Record all distribution lists where the migrated distribution group has managedBy rights.
• Record all distribution lists where the migrated distribution group has BypassModerationFromSendersOrMembers rights.
• Record all distribution lists where the migrated distribution list has AcceptMessagesFromSendersOrMembers rights.
• Record all distribution lists where the migrated distribution lists has RejectMessagesFromSendersOrMembers rights.
• Record all groups in the Active Directory where the migrated distribution list is a member.

It should be noted that this process does introduce some inefficiency into the overall scripts.  Unfortunately BypassModerationFromSendersOrMembers is not a filterable property of get-distributionGroup.  This requires scanning all distribution groups in the organization in order to determine if the migrated DL has this right.  Depending on the number of on-premises distribution group this could add significant time to the migration process.

Changed the convert to mail enabled contact logic:

In order to facilitate changing the distribution list to a mail enabled contact several logic items needed to change.  The first logic change that needed to occur was provisioning the mail enabled contact.  When the on-premises distribution list is deleted a mail enabled contact is created in the original OU where the distribution list originally resided.  The script utilizes a name prefix specified in the script by the administrator, and is appended to the distribution groups name, to create  random contact name.  The remote routing address on the contact is set to the *.onmicrosoft.com email address of the migrated distribution list.  When a mail enabled contact is created the remote routing address is added as a proxy address to the proxy addresses attribute.  This causes proxy address collisions with the migrated distribution list since the object is created in a synchronized OU.  The script removes these email addresses from the proxy addresses attribute to prevent any collision – they are not required to be present.  The last customizations to the mail enabled contact are to set custom attribute 1 of the object to a migration string for easy location and customer attribute 2 to the original primary SMTP address.  This is required to retain mail flow from on premises to Office 365.  The mail contact is replicated to ensure that group membership and distribution list rights settings can be retained from on-premises to Office 365. 

The second logic change that need to occur was preserving an object on premises that allowed for cross premises mail flow.  The object needed to not replicate or have the ability to replicate and be soft matched to the migrated group in the event of an accident.  A dynamic distribution group is the perfect object.  A dynamic distribution list can be created, will appear in the global address list, but in no way can be replicated to Exchange Online.  The script provisions a dynamic distribution group in the organizational unit specified for converted distribution groups.  The settings of the original distribution group are preserved on the dynamic distribution group.  These include name, alias, and proxy addresses.   In addition the X500 address of the migrated distribution list is stamped on the dynamic distribution group to ensure that reply to and nickname functionality works.  The dynamic distribution list is scoped to look for mail enabled contacts in the distribution groups original organizational unit where custom attribute 2 equals the original primary SMTP address.  I will outline the mail flow scenarios later in the article.

The third logic change was to change how membership lists were built during the migration process.  A function of the script is to scan all settings of the DL to be migrated and convert attributes lists into primary SMTP address lists.  In the case of the mail enabled contact we do not want to include it as the member where we should be adding another migrated DL.  The script looks at each object and if it is a mail enabled contact where custom attribute 1 is the migration string – the recorded SMTP address to the array is custom attribute 2 which is the original DLs primary SMTP address.  This ensures that when attributes are reset within Office 365 the migrated group is added back with permissions or membership and not the mail enabled contact that also exists.

The forth logic change was to preserve group membership.  Distribution groups can be nested into any number of other security and distribution groups in the organization.  If we simply deleted the original distribution list this membership would be lost.  The script will go through and reset the mail enabled contact to be members of the groups that the migrated DL was originally a member of.  In the case of security groups on premises this DOES NOT preserve permissions as a mail enabled contact is not a security context for shares or other resources.  Retaining the membership also ensures that as other distribution lists are migrated the membership can be converted and retained in Office 365.

The fifth logic change is to handle any other settings that the migrated distribution list could have on other distribution groups.  These include managedBy, BypassModerationFromSendersOrMembers, AcceptMessagesFromSendersOrMembers, and RejectMessagesFromSendersOrMembers.  The script tracks arrays of all of these settings and then steps through the remaining groups on premises to add the mail enabled contact to the lists.  This allows the contact to be detected when future distribution list migrations occur and for the group permission to be added to those lists in Office 365 post migration. 

On-Premises Mail Flow:

To ensure full migrated group access to on premises the script has implemented logic that changes the message flow.  Here is how messages will flow after the DL migration has completed.

• Message enters receive connector to on-premises Exchange Server.  Sample address migratedDL@contoso.com.
• Transport matches the address migratedDL@contoso.com to the script created dynamic distribution group migratedDL@contoso.com.
• Transport expands the distribution group searching for a mail enabled contact in the migrated distribution lists original organizational unit where custom attribute 2 equals the primary SMTP address.
• The mail enabled contact is located and has a remote routing address of migratedDL@mail.domain.onmicrosoft.com.  The email is then converted to migratedDL@mail.contoso.onmicrosoft.com.
• The message is transferred through the hybrid connector to Office 365.
• The message arrives in Office 365 addressed to migratedDL@mail.contoso.onmicrosoft.com.  The message address is converted to migratedDL@contoso.com.
• The message delivers to the migrated distribution list where it is expanded and sent to the recipients.

Script Performance:

I wanted to provide some sample script performance values.  In this test we have the following:

• A distribution list to migrate that has 10,000 members comprised of mailboxes, remote mailboxes, mail enabled users, and mail enabled contacts.
• The distribution list is a member of 10,000 other groups within the Active Directory.
• The distribution list to be migrated is set as managedBy to 5,000 other distribution groups.
• The distribution list to be migrated is set as BypassModerationFromSendersOrMembers to 5,000 other distribution groups.
• The distribution list to be migrated is set as AcceptMessagesFromSendersOrMembers on 5,000 other distribution groups.
• The distribution list to be migrated is set as RejectMessagesFromSendersOrMembers on 5,000 other distribution groups.

Here is the performance statistics given those values.

Days              : 0

Hours             : 6

Minutes           : 19

Seconds           : 32

Milliseconds      : 34

Ticks             : 227720349894

TotalDays         : 0.263565219784722

TotalHours        : 6.32556527483333

TotalMinutes      : 379.53391649

TotalSeconds      : 22772.0349894

TotalMilliseconds : 22772034.9894

The distribution list took short of 7 hours to migrate in that configuration.

A more reasonable test was performed with the following characteristics:

• A distribution list to migrate that has 1,000 members
  comprised of mailboxes, remote mailboxes, mail enabled users, and mail enabled
  contacts.
• The distribution list is a member of 1,000 other groups
  within the Active Directory.
• The distribution list to be migrated is set as managedBy to 100 other distribution groups.
• The distribution list to be migrated is set as
  BypassModerationFromSendersOrMembers to 100 other distribution
  groups.
• The distribution list to be migrated is set as
  AcceptMessagesFromSendersOrMembers on 100 other distribution
  groups.
• The distribution list to be migrated is set as
  RejectMessagesFromSendersOrMembers on 100 other distribution
  groups.

Days              : 0

Hours             : 0

Minutes           : 21

Seconds           : 58

Milliseconds      : 822

Ticks             : 13188223153

TotalDays         : 0.0152641471678241

TotalHours        : 0.366339532027778

TotalMinutes      : 21.9803719216667

TotalSeconds      : 1318.8223153

TotalMilliseconds : 1318822.3153

In this instance the distribution group took 21 minutes to finalize and sync. 

For factors affecting overall time please review the additional blog posts on prior script revisions.

Happy migrating!

こんにちは、Windows プラットフォーム サポートチームです。

2019 年 3 月をもちまして、弊社システム刷新の都合により、本 Blog を終了いたします。

今後の Windows プラットフォーム サポートチームからの情報発信は、以下のフォーラムにて行ってまいります。

Japan Windows Commercial Support チーム フォーラム

https://social.technet.microsoft.com/Forums/ja-JP/home?forum=Wcsupportja

フォーラムの運用については、以下のお知らせをご一読ください。本ブログの過去の記事もフォーラムへの移行を進めております。

【お知らせ】Japan Windows Commercial Support フォーラムについて

https://social.technet.microsoft.com/Forums/ja-JP/5a1b35b1-81a2-4bcc-9b68-5ac77a051996/123041236230693124251237912305japan-windows-commercial-support?forum=Wcsupportja

これまで、多くのお客様にご覧いただき、誠にありがとうございました。

読者の皆様のビジネスに多少なりとも貢献できておりましたら幸甚です。

今後ともどうぞよろしくお願いいたします。

Dataři a databázisté, nenechte si ujít konference, které připravila společnost Gopas ve spolupríci s Microsoftem přesně pro vás.

DataDay 2019 | BRATISLAVA

Kedy: 5. apríl 2019
Kde: Cinema City Aupark, Bratislava

• David Gešvindr | Doporučovací systém v SQL Serveru s pomocí SQL Graph
• Marek Chmel | Maximalizace zabezpečení dat v SQL Server včetně GDPR pravidel
• Vladimír Mužný | Využití SQL Server Service Broker pro asynchronní úlohy v databázích
• Jiří Neoral | Jak na personalizovaný reporting
• Martin Haman | Práce s nestrukturovanými daty
• Filip Slánička | Power BI Data Flows – datové modelování v cloudu

Prezrite si kompletný program 2. ročníka IT odbornej konferencie DataDay 2019, ktoré je Microsoft Gold partnerom.
Viac info a registrácia na www.dday.sk.

PowerBI Day 2019 | PRAHA

Kdy: 11. dubna 2019
Kde: Microsoft s.r.o., Praha

• Power BI ve velké firmě | Jiří Neoral
• Moderní BI platforma pro malé firmy | Jaroslav Reken
• Personalizovaný reporting v Power BI | Jiří Neoral
• Power BI Data Flows – datové modelování v cloudu | Filip Slánička
• Power BI a otevřená data | Karel Rejthar
• Monitoring s Power BI | Petr Pařík

Na 2. ročníku konference Power BI Day  se můžete těšit na přednášky odborníků na PowerBi s reálnými příklady z praxe a návody i tipy jak řešit praktická a reálná zadání pomocí reportingových nástrojů PowerBI.

Více informací a registrace na www.powerbiday.cz

Těšíme se na viděnou.

Today's tip...

Version 1.0.7 of the Remote Desktop web client has been released with offline access and other improvements.

Updates for version 1.0.11

• Enabled connection to RD Broker without an RD Gateway in Windows Server 2019.
• Sorted feeds alphabetically (i.e., RemoteApps first, Desktops second).
• Fixed multiple accessibility bugs improving screen reader compatibility.
• Updated our build tools.
• Various bug fixes.

To learn more about Remote Desktop Web client go HERE

To get started with Remote Desktop Web client go HERE

References:

• What's new for the Remote Desktop web client? - https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/web-client-whatsnew
• Access the Remote Desktop web client - https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-web-client
• Set up the Remote Desktop web client for your users - https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-web-client-admin

___________________________________________________________________________________________________________________________

IMPORTANT ANNOUNCEMENT FOR OUR READERS!

AskPFEPlat is in the process of a transformation to the new Core Infrastructure and Security TechCommunity, and will be moving by the end of March 2019 to our new home at https://aka.ms/CISTechComm (hosted at https://techcommunity.microsoft.com). Please bear with us while we are still under construction!

We will continue bringing you the same great content, from the same great contributors, on our new platform. Until then, you can access our new content on either https://aka.ms/askpfeplat as you do today, or at our new site https://aka.ms/CISTechComm. Please feel free to update your bookmarks accordingly!

Why are we doing this? Simple really; we are looking to expand our team internally in order to provide you even more great content, as well as take on a more proactive role in the future with our readers (more to come on that later)! Since our team encompasses many more roles than Premier Field Engineers these days, we felt it was also time we reflected that initial expansion.

If you have never visited the TechCommunity site, it can be found at https://techcommunity.microsoft.com. On the TechCommunity site, you will find numerous technical communities across many topics, which include discussion areas, along with blog content.

NOTE: In addition to the AskPFEPlat-to-Core Infrastructure and Security transformation, Premier Field Engineers from all technology areas will be working together to expand the TechCommunity site even further, joining together in the technology agnostic Premier Field Engineering TechCommunity (along with Core Infrastructure and Security), which can be found at https://aka.ms/PFETechComm!

As always, thank you for continuing to read the Core Infrastructure and Security (AskPFEPlat) blog, and we look forward to providing you more great content well into the future!

__________________________________________________________________________________________________________________________

Hello IT Professionals. Robert M. Smith, PFE here, with a short blog post regarding Virtual Desktop Infrastructure (VDI). A peer of mine Tim Muessig (also PFE), developed a PowerShell script that can be used to optimize Windows 10 Enterprise, 1803, for use in a VDI environment.

This script goes through and performs the following actions:

• Remove non-essential UWP apps
  
• Disables several services
  
• Sets some default user settings
  
• Disables several scheduled tasks
  
• Disables several Windows "auto-logger" startup traces
  
• Applies dozens of GPO settings to local policy using the Microsoft Local Group Policy Object (LGPO) tool.
  
• Runs disk cleanup using the Disk Cleanup Wizard
  
• Changes network interface controller (NIC) settings, to optimize for networking performance
  

The PowerShell script uses core code in the main script to call and enumerate lists in the form of text files, of the various objects that will be changed. For example, the UWP apps to be removed are in a text file named 'AppXPackages.txt'. If you decide that a UWP app on the list should not be removed, simply edit the 'AppXPackages.txt' file.

Once you download the tree of files, you are free to edit as you like for your environment.

There are a few dependencies of this script:

• The script calls a number of text files for the various categories of items to remove or disable. Those files must be in place for the script to work correctly.
  
• The script uses the 'LGPO.exe' Microsoft tool to import an included LGPO export of GPO settings from a generic Windows 10, 1803 virtual machine (VM). That tool must be included and in the proper location in your tree of files and folders for the script to function correctly.
  
• The script and the text files must be all in the same folder, which can be any folder of your choosing.
  

The VDI script and associated files are publicly available on GitHub, at the following location:

https://github.com/TheVDIGuys/W10_1803_VDI_Optimize

This script is based on the same settings in a soon to be released white paper on optimizing Windows 10 1803 in a VDI environment. This blog post will be updated when that paper is published. The publication for this white paper will be the 'Docs.microsoft.com' knowledge repository.

Any comments and/or questions are welcome. Thank you for visiting the blog, and let us know if you have any suggestions for topics you would like to see in future blog posts.

The Feb’19 release for Dynamics AX 2012 R3 version is now available in LCS on the updates tile inside your R3 project. This update represents a typical collection of smaller functional improvements and technical fixes.  Bugs were fixed in all areas with enhancements found in Warehouse & Transportation, Master planning, Service Management, BI and Reporting, Procurement, Sales, Client, Server, SI, Project Accounting, Inventory, Retail, Invoicing and Payments, Regulatory Reporting, Dimensions, Reports, Payroll, Public Sector, Project management, Timesheets, Workflow, Production, Server, Cash and Expense, Tax updates. Please see the full list of hotfixes below to search for your specific issue newly included in this release. This release is intended to give visibility into fixes recently shipped for R3, including some features and design changes that are newly released in this quarter.

NOTE: This will be the last blog for this site that is scheduled to retire in March.

Here are a few details related to this release:

• Primary Build: 6.3.6000.8149
• Number of Application hotfixes: 246
• Number of Binary hotfixes: 32

Details of the install process can be found here: https://technet.microsoft.com/en-us/library/hh538446.aspx#PackageR3

What is included in this month’s release?

Known Issues: -

Design Change Requests

Fixes Released

Por: Jenny Lay-Flurrie, jefa de accesibilidad.

Theo, estudiante de Kings College, muestra un programa que creó con la tecnología detrás de Code Jumper mientras su madre observa. Foto por Jonathan Banks.

Hola, les escribo desde Seattle debido a que no pude asistir a la Conferencia CSUN de Tecnología de Asistencia en Anaheim como lo tenía planeado. Por desgracia, no pude estar ahí este año debido a una condición de salud de último minuto que no me permitió volar para allá. Esperé por meses este evento pero por fortuna, 94 Microsofties de toda la compañía asistieron con la emoción de compartir en qué estamos, y lo que es más importante, escuchar, aprender, y fomentar relaciones.

Ya que no pude asistir, pensé que esta sería una buena oportunidad de compartir lo que iba a cubrir en mi presentación.

Cada año, este evento reúne a personas de toda la comunidad de accesibilidad para compartir conocimiento y mejores prácticas en el campo de la tecnología de asistencia. La accesibilidad no es un espacio donde podemos mover la aguja por nuestra cuenta, por lo que contar con socios efectivos es un elemento crítico en la creación de productos que trabajen mejor para todos. Hay algunos grandes ejemplos de esto que quiero compartir. Como compañía, construimos un enfoque de asociación en nuestro ADN y en cada uno de nuestros cuatro pilares clave que nos mantienen en la ruta de nuestra jornada hacia la accesibilidad. Estos son algunos ejemplos:

Pilar uno: Gente

Construir accesibilidad en nuestra compañía comienza con la construcción de una cultura que adopte la accesibilidad y la discapacidad. Contratar a gente diversa y talentosa con expertos en discapacidades y accesibilidad genera experiencias que impulsan y aceleran los esfuerzos por construir productos que funcionen para todos. Uno de los programas que lanzamos hace unos años es nuestro Austism Hiring Program. Mientras este programa madura, estamos igual de enfocados en cómo compartimos nuestros aprendizajes y mejores prácticas en encontrar talento con otras compañías con ambiciones similares. Hoy, 16 compañías trabajan en conjunto para aprender y compartir juntos a través de Autism @ Work Employer Roundtable. Queríamos facilitar para la gente que supieran cómo iniciar, y en asociación con Disability:IN, SAP, EY, y JP Morgan Chase y la Universidad de Washington, hemos desarrollado un nuevo manual que los lleva a través de todas las preguntas que pudieran tener. Véanlo.

Pilar dos: Sistemas

Para en verdad dirigir el negocio de la accesibilidad, necesitan un marco de trabajo sistemático; un ecosistema para cómo impulsan a la gente para que cumplan. Ese ecosistema cubre todos los aspectos de la compañía, y apoyar a nuestros clientes es una parte importante. Tenemos muchas otras asociaciones, como Be My Eyes, que en 2018 comenzó a brindar a los clientes una conexión directa para recibir asistencia técnica de Disability Answer Desk (DAD), un servicio gratuito para clientes para clientes de Microsoft con discapacidades. Desde el lanzamiento del servicio Be My Eyes en 2018, hemos tomado más de 4 mil llamadas y la satisfacción de los clientes está al 90%. Esta asociación fue un gran paso adelante en brindar a la gente con discapacidades un apoyo efectivo en la manera que prefieran, y es solo el inicio de lo que es posible conseguir. También estamos emocionados por anunciar que DAD lanzó soporte en Twitter en cinco mercados. Los clientes ahora podrán enviarnos un mensaje directo a través de Twitter para solicitar asistencia técnica a través de la página de soporte de DAD.

Pilar tres: Producto

Cuando se combina una cultura inclusiva con un ecosistema que impulsa a la gente, y lo hacen en asociación con alguien más, están listos para crear productos innovadores que funcionen para todos.

Windows 10: Estamos ansiosos por conocer usuarios para conocer sus comentarios sobre las más recientes mejoras en accesibilidad y compartir lo que viene el próximo año. Y sí, hay anuncios para Narrador, incluido el soporte para Chrome. Narrador también recibirá una nueva Página de Inicio que hace más fácil encontrar la Guía de Usuario, tutorial para Inicio Rápido, nuevos ajustes para personalizar su experiencia, y ligas para brindar retroalimentación para que podamos continuar con nuestro foco en las características que les importan más a los usuarios. Narrador también ha recibido funcionalidad mejorada de lectura; es más eficiente (es menos florido), más natural y más responsivo con aplicaciones como Outlook. También se verá soporte adicional para las tablas de traducción más recientes y pantallas braille.

También tomamos el éxito de opciones de texto más grande al agregar apuntadores más grandes. Los usuarios pueden hacer su apuntador más fácil de ver al hacerlo más grande y agregar un color personalizado, les recomiendo el rojo. También hemos pulido el “modo de mouse centrado” en la Lupa para hacer que su apuntador encuentre el centro de su pantalla. ¡El equipo está muy orgulloso de este “fluido” desempeño!

Office 365: Nuestros entusiastas socios están integrados en cada parte de nuestro proceso de diseño, desde pruebas de concepto, a comentarios post lanzamiento de usuarios que utilizan Disability Answer Desk, un número de expertos han ayudado a construir un producto accesible por diseño que esperamos facilite la inclusión digital para que sea parte de la transformación digital de su organización.

El grupo ATHEN jugó un rol crucial en el desarrollo de un listón nuevo y simplificado que se encuentra en la parte superior de cada documento de Word y cuaderno de OneNote. La simplicidad del nuevo y sencillo listón fue diseñada para permitir a los usuarios de lector de pantalla encontrar de manera más sencilla los comandos que buscan. ¡Resulta que es una experiencia más sencilla para todos!

Otro avance importante es con nuestro Accessibility Checker. Hemos actualizado las reglas para el verificador de accesibilidad y que se reduzcan los falsos positivos para hacer aún más fácil de conseguir la accesibilidad para impulsar a todas las personas. Además, ahora pueden ‘revisar en el camino’ al permitir al verificador de accesibilidad mantener un ojo en su documento mientras lo crean. Esto brinda un recordatorio a simple vista en la barra de estado cuando existe algún problema en el documento, y una acción de un clic para investigar recomendaciones.

Asociaciones AT: Nuestras asociaciones en tecnología de asistencia son críticas para asegurar que en verdad podemos impulsar a la gente con discapacidades. Nos entusiasman nuestras herramientas propietarias, pero también nos entusiasma impulsar a todo el ecosistema. Somos exitosos no solo cuando nos construimos a nosotros mismos, sino también cuando impulsamos a otros a que construyan. Algunos ejemplos incluyen Eye Tech Digital Systems, que se integra con el rastreador ocular integrado en Surface; Guide Connect de Dolphin Computer Access, un asistente digital que habla; e InsideOne de InsideVision, una tableta táctil con un teclado braille integrado. Estos son solo unos ejemplos, y queremos agradecer a nuestros socios por su continua colaboración para empujar los límites de la tecnología de asistencia.

Accesibility Insights: También tenemos increíbles noticias para los desarrolladores con el código abierto de Accesibility Insights, una herramienta que ayuda a los desarrolladores a encontrar y arreglar problemas de accesibilidad en su código. Accessibility Insights ofrece a los desarrolladores la capacidad de correr FastPass e identificar problemas comunes de accesibilidad a inicios del ciclo de desarrollo y brinda consejos sobre cómo resolverlos. Además, nos asociamos con Deque Systems para agregar soporte para la plataforma Windows para el motor de reglas del eje de accesibilidad. Ahora los desarrolladores pueden probar su código en desarrollo a través de un enfoque común y unificado. Los invito a conocer más sobre Accessibility Insights en el blog de Keith Ballinger.

Pilar 4: Innovación / Futuro

Por último, lo que ansiamos: innovación. Nos motiva, nos inspira y nos dirige. Construir soluciones con y para la gente con discapacidades al aprovechar mucho del conocimiento que tenemos a través de la industria y trabajar en asociación con la comunidad para asegurar que lo que construimos tiene impacto y propósito. Dos proyectos que resumen esto:

Seeing AI: Diseñado para la comunidad de personas con ceguera y baja visión, este proyecto de investigación y aplicación móvil gratuita aprovecha el poder de IA para describir gente, texto y objetos. El equipo anunció nuevas características y funcionalidades inspiradas por los comentarios y recomendaciones brindadas por la comunidad de usuarios de Seeing AI. Estas actualizaciones ya están listas, ¡No se las pierdan!

• Explorar fotos con la función táctil: Pongan su dedo en una imagen en una pantalla táctil para escuchar una descripción de los objetos en ella y la relación espacial entre ellos.
• Soporte nativo para iPad: Por primera vez lanzamos soporte para iPad, para brindar una mejor experiencia de Seeing AI que cumpla con los requerimientos de pantallas más grandes.
• Mejoras en canales: Personalicen el orden de sus canales, accedan a la función de reconocimiento facial mientras están en el canal Persona, ¡Obtengan pistas de audio mientras analizan fotos en otras aplicaciones!

Code Jumper: Por último, Code Jumper es un lenguaje físico de programación para niños entre 7 y 11 con todos los rangos de visión. Comenzó como un proyecto de investigación de Microsoft en Reino Unido, pero conforme evolucionó el equipo trabajó para crear una ruta para fabricación a escala. La investigación y la tecnología detrás de Code Jumper están detrás de las capaces manos de American Printing House for the Blind (APH), una organización no lucrativa en Louisville, Kentucky, que crea y distribuye productos y servicios para gente con ceguera o con baja visión. En los últimos cinco años, APH planea ofrecer Code Jumper y planes de estudios relacionados a estudiantes de todo el mundo. Conozcan aquí más sobre este proyecto.

Para más información y estar al tanto de accesibilidad en Microsoft, visiten www.microsoft.com/accessibility.

Applies to:

Windows Server 2008 R2 SP1

Windows Server 2008 SP2

Hello IT Architects and IT Admin’s.

The end of support (e.g. Security updates) for Windows Server 2008 R2 SP1 (and Windows Server 2008 SP2) is quickly approaching.

When is the end-of-support?

Jan. 14th, 2020.

In order to assist our customer migrate to a supported version of Windows Server 2016 or Windows Server 2019.

The following website https://www.microsoft.com/en-us/cloud-platform/windows-server-2008 has instructions on how you could move it.

• On-Premises Upgrade Center

• Assess
• Migrate
• Optimize

• Azure Migration Center

• Assess
• Migrate
• Optimize

It also contains free e-books for:
     Windows Server 2016 Guide
     Windows Server on Azure Guide

Thanks,

Yong

Check out the list of remote, interactive technical webinars and one-on-one consultations, available to help you build your technical capabilities. Through live, instructor-led webinars, you will receive interactive training with real-time Q&A capabilities - all at NO COST to Microsoft Partner Network members.

If you are looking for one-on-one technical assistance, focused on real-world scenarios, explore the list of technical consultations available, using your MPN technical presales and deployment benefits.

Application-Innovation_technical-webinars-consultations-list_March-April-May-June

Business-Applications_technical-webinars-consultations-list_March-April-May-June

Cloud-Infrastructure-and-Management_technical-webinars-consultations-list_March-April-May-June

Data-and-AI_technical-webinars-consultations-list_March-April-May-June

Modern-Workplace_technical-webinars-consultations_March-April-May-June

Important: Be sure to check out all of the webinars listed outside of your time zone, as they may work with your morning or evening schedule!

For more information on all technical journeys and the recommended paths to consume these webinars and consultations, visit aka.ms/technicaljourney.

When looking at the details of objects in Exchange Management Shell, it is often useful to know when an object was created or modified.  In a recent Office 365 engagement, the customer was convinced that one of the other administrators had made an unauthorised change to their environment as there was an apparent recent change to the Exchange Hybrid Object.

The details of the this object can be viewed using Get-HybridConfiguration.  Note that this post illustrates the discussion using the hybrid object in AD, though it will apply to other cases.

In the screenshot below, note that the yellow arrow indicates the whenChanged attribute reports a date of 3/10/2019 10:33:22 PM.  This is the 10th of March 2019.

The admin did not expect to see this date contain a value of 2019 as it was over a year since the Exchange Hybrid Configuration Wizard (HCW) had been executed.  The HCW was last used to update the hybrid SMTP certificate.  This certificate has a two year validity and it was not expected to see modifications to the date.

Was the HCW executed without permission?  Was someone going to have a meeting without coffee?  Stay tuned…

Lab Environment

This is a lab repro so that screenshots can be used.  In this lab there are three domain controllers.  The lab contains Exchange 2010 servers.  The reason that there whenCreated dates are quite different is due to the different OS versions used by the DCs.  Exchange 2010 has added support for newer versions of AD, and this is reflected in the dates below.  The oldest server is Windows 2012, then 2012 R2 and finally the newest one is Windows Server 2016

Issue Explained

You may have noted the DCPromo date of the Windows Server 2016 DC, it is the 10th of March 2019 at 10:32:39 PM.  Well, that’s interesting I hear you say…

What if we take a look at how each of the DCs reports the whenChanged value of the object.  Since there are three DCs in the environment, we will run the same command three times and use the –DomainController switch to interrogate them one by one.

Note that we see different timestamps on each the DCs for the whenChanged  value.  The newest DC, the 2016 server, has the most recent whenChanged value.  Though the older two DCs have slightly different values.

Is this some mystery with the Exchange Management Shell?  Lets see what AD has to say on its own.

What ADSIEdit Saw

The object we are looking at above is located here in AD:

CN=Hybrid Configuration,CN=Hybrid Configuration,CN=TailspintoysCanada,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Tailspintoys,DC=ca

If we look at its properties in ADSIEdit we see the below:

Hmm – this timestamp is unsurprisingly the same as what we saw in the Exchange Management Shell.

Why is that…

The Prestige

whenCreated is not a replicated attribute.  It is updated when a local write occurs which is why you see different values on each of the domain controllers.  The difference between the original two DCs is small as this is the replication latency, at that time both DCs were installed.  Many months later the Windows Server 2016 DC was installed.  This server was promoted and during the initial directory replication local copies of the existing objects were created.

From the AD Schema documentation When-Changed attribute

“The date when this object was last changed. This value is not replicated and exists in the global catalog.”

If you want to see more information about the object you can also use:

Repadmin.exe /ShowObjMeta:”CN=Hybrid Configuration,CN=Hybrid Configuration,CN=TailspintoysCanada,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Tailspintoys,DC=ca”

Cheers,

Rhoderick

At Microsoft Ignite, Outlook for iOS and Android announced support for deploying managed device general app configuration settings for Office 365 mailboxes and on-premises mailboxes leveraging hybrid modern authentication. This capability leverages either the Managed App Configuration for iOS or the Android managed configurations to enable MDM solutions to push configuration settings.

Today, we are announcing the availability of new functionality within Intune that enables admins to easily deploy general app configuration to Outlook for iOS and Android via App configuration policies. This new functionality allows IT admins to configure the default behavior for several settings within Outlook for iOS and Android, such as Focused Inbox.

Note: For Outlook for iOS and Android to apply these settings, the app needs to be installed and managed by the Company Portal.

Figure 1: App Configuration Policy for Outlook for iOS on enrolled iOS devices from https://devicemanagement.microsoft.com. If you're in https://portal.azure.com, then you'll go to Intune -> Client apps -> App configuration policies and add a configuration policy. 

General App Configuration details

With this new policy experience, administrators can simply configure certain Outlook app settings’ default behavior and deploy them to their user’s enrolled mobile devices. For this first release, Outlook is supporting the following settings for configuration:

As you may have noticed, settings that are security-related in nature have an additional option, Allow user to change setting. For these settings (Save Contacts, External recipients MailTip, Block external images, and Require Biometrics to access the app), administrators can prevent the user from changing the app’s configuration; in other words, the administrator’s configuration cannot be overridden.  Allow user to change setting does not change the app behavior. For example, if the admin enables Block external images and prevents user change, then by default external images will not be downloaded in messages; however, the user can manually download the images for that message body.

Note: The Allow user to change setting for Require Biometrics to access the app is currently only available as a configuration key. This will be addressed in a future Intune portal update. For more information regarding the configuration key, please see Deploy app config settings.

The following conditions apply with respect to Outlook’s behavior when implementing app configuration:

• If the admin configures a setting with its default value, and the app is configured with the default, then the admin’s configuration doesn't have any effect. For example, if the admin sets External recipients MailTip=on, the default value is also on, so Outlook’s configuration doesn't change.
• If the admin configures a setting with the non-default value and the app is configured with the default, then the admin’s configuration is applied. For example, the admin sets Focused Inbox=off, but app default is on, so Outlook’s configuration for Focused Inbox is off.
• If the user has configured non-default value, but the admin has configured a default value and allows user choice, then we retain the user’s configured value. For example, the user has enabled contact sync, but the admin sets Save Contacts=off and allows user choice, so Outlook keeps contact sync on and does not break caller-ID for user.
• If the admin disables user choice, then Outlook always enforces the admin defined configuration, regardless of the user's configuration or default app config. For example, the user has enabled contact sync, but the admin sets Save Contacts=off and disables user choice, so contact sync gets disabled and the user is prevented from enabling it.
• If after the MDM configuration is applied, if the user changes the setting value to not match the admin desired value (and user choice is allowed), then the user’s configuration is retained. For example, block external images is off by default, admin set Block external images=on, but afterwards, user changes block external images back to off; in this scenario, block external images remains off the next time the policy is applied.

Users are alerted to configuration changes via a notification toast in the app:

Figure 1: Outlook for iOS and Android app config notification toast

This notification toast will automatically dismiss after 10 seconds. There are two scenarios where this notification toast will not appear:

• If the app has previously shown the notification in the last hour.
• If the app has been installed in less than 24 hours.

Save Contacts

The Save Contacts setting is a special case scenario because unlike the other settings, this setting requires user interaction – the user needs to grant Outlook permissions to access the native Contacts app and the data stored within. If the user does not grant access, then contact sync cannot be enabled.

Note: With Android Enterprise, administrators can configure the default permissions assigned to the managed app. Within the policy, you can define that Outlook for Android is granted READ_CONTACTS and WRITE_CONTACTS within the work profile; for more information on how to assign permissions, please see Add app configuration policies for managed Android devices. When assigning default permissions it is important to understand which Android Enterprise deployment models are in use, as the permissions may grant access to personal data.

The workflow for enabling Save Contacts is the same for new accounts and existing accounts.

1. The user is notified that the administrator has enabled contact sync. In Outlook for iOS, the notification occurs within the app, whereas, in Outlook for Android, a persistent notification is delivered via the Android notification center.
   
   Figure 3: User notification regarding contact sync
2. If the user taps on the notification, the user is prompted to grant access:
   
   Figure 4: User is prompted to grant access to native Contacts app
3. If the user allows Outlook to access the native Contacts app, access is granted and contact sync will be enabled. If the user denies Outlook access to the native Contacts app, then the user is prompted to go into the OS settings and enable contact sync:
   
   Figure 5: User is prompted to enable contact sync in OS settings
4. In the event the user denies Outlook access to the native Contacts app and dismisses the previous prompt, the user may later enable access by navigating to the account configuration within Outlook and tapping Open Settings:
   
   Figure 6: User can re-enable contact sync access in OS settings

Summary

We hope you enjoy this new policy experience available within the Intune portal for Outlook for iOS and Android. We'll continue to update the list of settings that can be managed via the MDM OS channel.

For more information on general app config with Outlook for iOS and Android, see Deploy app config settings. Up next is general app configuration for the without enrollment scenario. Stay tuned!

Ross Smith IV
Principal Program Manager
Customer Experience Engineering

Common questions

Q: What versions of Outlook for iOS and Android support general app configuration on enrolled devices?

Outlook for iOS 3.15.0 and Outlook for Android 3.0.30 and later support this functionality.

Q: Can I deploy general app config to Outlook for iOS and Android if the device is not enrolled?

Not at this time, but in the future, we plan to support this scenario for accounts that have an Intune App Protection Policy applied.

Q: What if I had already deployed the configuration keys manually in an App Configuration Policy; do I need to do anything?

No! The keys will be automatically consumed in the new policy experience.

Q: How do I create an App Configuration Policy for Outlook for iOS or Outlook for Android?

We’ll be updating Deploy app config settings to include the new policy experience, but you can also review Add app configuration policies for managed iOS devices and Add app configuration policies for managed Android devices.

Q: What if we are not using Intune to manage device enrollment, but instead are leveraging a third-party MDM solution?

Not to fear, we have you covered. These settings can be delivered via any MDM provider. For more information on the configuration keys you need to use, see Deploy app config settings.

Applies to:

MacOS

Announcing Microsoft Defender ATP for Mac and new Threat and Vulnerability Management capabilities
https://www.microsoft.com/security/blog/2019/03/21/microsoft-defender-atp-for-mac-new-threat-and-vulnerability-management-capabilities/

Announcing Microsoft Defender ATP for Mac
https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Announcing-Microsoft-Defender-ATP-for-Mac/ba-p/378010

Thanks,

Yong

P.S. Get the latest security stories from the Windows Defender Research team here:

Blog: Microsoft Secure Blog

Twitter: https://twitter.com/WDSecurity/

Facebook: https://www.facebook.com/MsftWDSI