Home Tags Posts tagged with "Microsoft"
Tag:

Microsoft

DatacenterSoftwareStorage

Force IE 11 Enterprise Mode to update a HTTP-hosted site list

by Philip Sellers
written by Philip Sellers

IEI have been spending a good bit of time implementing and learning about Internet Explorer 11’s Enterprise Mode. This feature is great of the enterprise because it allows administrators to tell IE exactly which version, or document mode, of IE to mimic for specific websites.  Previous versions of IE had Compatibility Mode, but this feature was only granular to a domain level, meaning your internal sites were all in or all out of Compatibility Mode.  Enterprise Mode improves allowing admins to configure settings for individual web sites within your internal domain or specific application on external domains.

The settings for each site are controlled by a site list.  This list can be published to a client through group policy (or set manually in the registry) and the list can reside on a File Share, web server or the local filesystem.  Microsoft has a free tool to edit the list called the Enterprise Mode Site List Manager.  This tool lets you import or add sites to the list, validate that they are online and responding and then save a correctly formated XML file for distribution.  The file format includes a version number and this is how IE keeps up with when to download an updated list to use.

I recently ran into an issue with the versioning where the site list won’t update often.  If you are trying to add a site to the list for a particular user to solve a problem, there isn’t an easy way to force IE to get a newer copy of the site list when the list is hosted on HTTP.  Using HTTP is part of the problem and I suspect the issue likely doesn’t occur on local or file share paths for the site list.  The problem seems to be that IE caches the site list when hosted on HTTP and won’t update until the cache expires.  Even if IE is relaunched, the cached copy is checked and the version number will match and so no update will occur.  To solve this problem and force an update, you need to:

  1. Clear the IE temporary internet file cache.
  2. Remove the CurrentVersion value under HKCU\Software\Microsoft\Internet Explorer\Main\EnterpriseMode key
  3. Restart IE

To help with this, I wrote a quick PowerShell script to delete the key and call the InetCpl control panel and clear the cache, leveraging part of a PowerShell script contributed by Chan V on TechNet.

[code language=”PowerShell”]

<# Force Refresh IE Enterprise Mode #>

<# Clear IE Cache for User #>
RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 8

<# Remove Version Registry Key #>
Remove-ItemProperty -Path ‘hkcu:\Software\Microsoft\Internet Explorer\Main\EnterpriseMode’ -Name CurrentVersion

<# Send Instructions #>
Write-Host "Close and restart Internet Explorer to refresh the Enterise Mode site list."

[/code]

 

4 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftwareStorage

Pass The Hash (No Really Don’t)

by Philip Sellers
written by Philip Sellers

IMG_8237I attended TechEd 2014 back in May of this year and there was one session that I wanted to share called “TWC: Pass-the-Hash and Credential Theft Mitigation Architectures”. The part from the session that I wanted to focus on was regarding administrative privileges. Credential theft has become a serious problem in today’s world where everyone is doing business online. While the internet has allowed us the ability to be more connected it also puts us at the risk of becoming a victim of cybercrime.

Being an administrator in today’s corporate world you have to make sure that you are doing everything you can to protect your company’s digital assets. You have to defend against every possible intrusion while an attacker only has to be successful at finding a vulnerability one time. The TechEd session provided some good ways of how you can lower your chance of becoming a victim of credential theft.

First, let me give you some background on what Pass-The-Hash is about. The “Pass-the-Hash” phrase comes from the ability to steal a password hash and reuse it to connect to other computers. A hash is created based off your password and is used for authenticating you across the network. It will only change when you change your password. The password hash gets stored in memory and allows you to access other resources on the network without having to type in your credentials every time. If someone is able to obtain this hash then they can potentially authenticate as you.

This becomes extremely dangerous when we are talking about local or domain administrator accounts. If you use the same password for the local administrator account on all your computers then an attacker only has to steal the password hash one time and can then use it to access other computers on the network. A password hash can only be used for a network login. It will not work for an interactive login.

In order for an attacker to steal your password hash using the Pass-The-Hash method, they will have to gain local administrative rights on your computer. If they cannot gain administrator equivalent access then they will not be able use this technique. You should use the method of least privilege and never allow users to have administrative rights if possible. A user can be easily tricked into downloading a piece of malware that can allow an attacker to have access to your network. A domain admin account should never log into a standard workstation that accesses the internet or email. If your domain administrator credentials are captured then you have given the attacker the keys to the kingdom. Don’t make it easier for someone to take control over your network.

Removing admin rights can be a challenging task within a corporate environment. Users most of the time think that you do not trust them or that you are trying to exercise your power. Corporate politics can also sometimes influence security decisions. It is our duty as systems administrators to make our users and management understand the importance of restricting administrative rights. You might not be the most liked person but it is better to know that you are doing what is needed to protect your company or organization.

The presentation broke down computers and accounts into three different tiers. You have Tier 0 at the top which would be your core servers like domain controllers and domain admin accounts. This would be the most restrictive tier. Tier 1 would be your application servers and contain your server admin user accounts. Finally, Tier 2 would be your workstations and users that have access to internet and e-mail. You should never login with an account on a lower tier that has access to a higher tier. For example, an account with access to servers or domain controllers should not login to a workstation that has access to the internet. Microsoft also recommends having separate admin workstations that do not access the internet or e-mail for your domain admin account. This will help prevent your admin machine from becoming compromised.

Microsoft has created a document that discusses credential theft using Pass-The-Hash and ways to mitigate it. Please visit the links below to see more detail since I will not be able to cover everything from the presentation and whitepapers. It is well worth the time to learn more about this problem and ways to address it. They also mentioned in the presentation that this is not a flaw or vulnerability that can be addressed with a patch. Most operating systems rely on password hashes and we as administrators must take the steps to make them as secure as possible.

Link to the presentation:
http://channel9.msdn.com/Events/TechEd/NorthAmerica/2014/DCIM-B213#fbid=

Link to document discussing Pass-the-Hash attacks:
http://www.microsoft.com/en-us/download/details.aspx?id=36036

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
Home Tech

Customers lose with Microsoft’s takeover of NoIP domains

by Philip Sellers
written by Philip Sellers

You may have missed the news yesterday, but Microsoft coordinated a takeover a over 20 domain names held by dynamic DNS company NoIP.  Microsoft took control of the 20 domains NoIP offers to customers as free dynamic DNS subdomains.  In doing so, Microsoft was seeking to disable domains used by a couple of malware attacks that were being carried out using NoIP’s free address and DNS services.  The downside to yesterday’s takeover is that there were millions of innocent users of NoIP’s services that have been affected.  For its part, Microsoft says that was a technical error that should be corrected, however, the domains I use with NoIP’s free service are still unresolving more than 24 hours later.

For customers, neither company is really doing what’s in the best interest of the general public.  Microsoft may be playing the white knight seeking to put down malware providers, but by taking over all of NoIP’s free domain names, its targeted 18,472 targets were only a small percentage of the millions of addresses that have been taken offline for legitimate users.  To me, Microsoft clearly overstepped here.

And, does Microsoft want to talk about how its own software is the underlying cause of the malware attacks and how the two targeted malware, Jenxcus and Bladabindi, operate on Windows?  Microsoft should also be examining how to prevent unauthorized software from executing in Windows which is the larger root cause of this whole debacle.  Signed software and software execution policies should be the norm at this point in an operating system.  Microsoft should be looking at giving administrators and users whitelisting capabilities at the root of its OS and it should be doing more to prevent these things from running to begin with.  I’m not going to knock Microsoft’s responsiveness to issues when exposed, but what is Microsoft really doing to cut down on attack surface in their OS?  It doesn’t look like much to me.

NoIP asserts that of the 18,472 targets Microsoft was going after, less than 2,000 were active yesterday morning when the takeover occurred. Well, lets be honest, if you knew near 2,000 subdomains active in malware attacks were there, why didn’t you do anything about it?  NoIP should have been taking steps to stop known malware propagating through its service and should have been working with security researchers to put this out of business.  NoIP should have been more responsive and should have proactively taken steps to work with third parties on complaints.  The lack of cooperation has tarnished is reputation and will leave it in a precarious position as customer seek alternatives from other vendors.

In the wake of all of this are the customers, who should be cheering at a partially effective disablement of malware and jeering if they’re a legitimate NoIP user.  I say its partially effective, because the malware writers will adapt and change their tactic in light of this takeover.  Microsoft has only delayed an inevitable re-flare of the problem because they’ve done nothing to fix the underlying problem – Windows.

I don’t often rant on my blog, but in this case, the NoIP takeover affects me as a legitimate user and I’m a full-time, senior-level Windows administrator who has to deal with the lack of built-in security functionality that Microsoft delivers to customers.  For as much as Microsoft is trying to be the white knight, they seem to be missing their major obligation to patch and fix the main platform for distribution of malware – Windows…  That’s my two cents.

 

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftwareStorage

HP has released Powershell for iLO control with more to come

by Philip Sellers
written by Philip Sellers

PowerShellHP showed off its new, free Scripting Tools for Windows at Microsoft TechEd this week on the expo floor.  The scripting tools are specifically Powershell cmdlets for iLO control in the version 1.1 release.  The cmdlets allow you to script a number of functions against the iLO management processors.  The Powershell cmdlets work against iLO 3 and iLO4 which roughly equates to Proliant G7 and Gen 8 models.

Talking with Ana Machado on the showroom floor, this release is just the first of many to come that will expand the capabilities of the toolkit to include additional hardware.  I logically take that to mean that we will see expanded support for BladeSystem Onboard Administrators and other components in the future, though she didn’t specifically say.

With over 100 cmdlets included in the toolkit, users will be able to common tasks easily from pre-prepared scripts.  For instance, if you have a standard username and password assigned for iLO, you can easily create a script to execute and add your standard login using the Add-HPiLOUser cmdlet.  The cmdlet either takes parameters through the command line or prompts you parameter by parameter during execution.   Another potential goldmine is new deployments of HP Remote Support and registration of iLO4 to the service.  The Enable-HPiLOERSIRSConnection cmdlet will easily allow you to set these settings for any number of servers.  Just pipe in a list of destinations and then let the Powershell do the heavy lifting.

You may grab the tools from HP by going to www.hp.com/go/PowerShell with no login required.

Quick Reference of All HP iLO cmdlets

Name Synopsis
Add-HPiLOSSORecord Add a new HP SIM Single Sign-On (SSO) Server Record.
Add-HPiLOUser Adds a local user account to the iLO.
Clear-HPiLOAHSData Clear the AHS information from the AHS logs.
Clear-HPiLOEventLog Clear the iLO event logs.
Clear-HPiLOIML Clear the Integrated Management Logs.
Clear-HPiLOPowerOntime Clears the virtual clock counter without power-cycling the server.
Disable-HPiLOERSIRSConnection Disables Insight Remote Support functionality and un-registers the server.
Disable-HPiLOSecurityMessage Disables the display of security text message in the iLO Login Banner.
Dismount-HPiLOVirtualMedia Dismounts the Virtual Media image if one is mounted.
Enable-HPiLOERSIRSConnection Connect to the Insight Remote Support server and register the server
Enable-HPiLOFIPS Enables the Federal Information Processing Standard Enforce AES/3DES Encryption setting.
Enable-HPiLOSecurityMessage Enables the security text message in the iLO Login Banner.
Find-HPiLO Find list of iLO in a specified subnet.
Get-HPiLOAHSStatus Gets the AHS status.
Get-HPiLOAssetTag Gets the Asset tag.
Get-HPiLOCertificateSigningRequest Gets the Certificate Signing Request status.
Get-HPiLODefaultLanguage Gets the default language on iLO.
Get-HPiLODirectory Gets the current directory configuration.
Get-HPiLODriveInfo Gets the drive status of the server.
Get-HPiLOERSSetting Gets the Integrated Remote Support setting.
Get-HPiLOEventLog Gets the iLO event logs.
Get-HPiLOFan Gets the Fan health details from the server.
Get-HPiLOFIPSStatus Gets the current ‘Enforce AES/3DES Encryption’ status.
Get-HPiLOFirmwareInfo Gets the firmware details for the iLO.
Get-HPiLOFirmwareVersion Gets the iLO firmware version.
Get-HPiLOGlobalSetting Gets the iLO global settings.
Get-HPiLOHealthSummary Gets the health information summary of the host server.
Get-HPiLOHostAPO Gets the current Automatic Power On and Power On Delay settings.
Get-HPiLOHostData Gets the host data displayed on the Server Information page.
Get-HPiLOHostPower Gets the power state of the server.
Get-HPiLOHostPowerMicroVersion Gets the Power Micro Version number.
Get-HPiLOHostPowerSaver Gets the state of the processor power regulator feature of the server.
Get-HPiLOHotKeyConfig Gets hot keys available for use in remote console sessions.
Get-HPiLOIML Gets the integrated management logs.
Get-HPiLOLanguage Gets all languages on the iLO.
Get-HPiLOLicense Gets the license types and keys.
Get-HPiLOMemoryInfo Gets the memory details for the host server where the iLO is located.
Get-HPiLOModuleVersion Gets the module details for the HPiLOCmdlets.
Get-HPiLONetworkSetting Gets the current network settings.
Get-HPiLONICInfo Gets the NIC details for the system NIC and the iLO NIC.
Get-HPiLOOAInfo Gets the Onboard Administrator information from the enclosure where iLO is located.
Get-HPiLOOneTimeBootOrder Gets the current state of the one-time boot.
Get-HPiLOPersistentBootOrder Gets the current boot order.
Get-HPiLOPowerAlertThreshold Gets the power alert threshold for the iLO devices.
Get-HPiLOPowerCap Gets the power cap of the server.
Get-HPiLOPowerOnTime Gets the virtual clock value, in minutes, since the server was last powered on.
Get-HPiLOPowerReading Gets the power readings from the server power supply.
Get-HPiLOPowerSupply Gets the power supply details for the host server where the iLO is located.
Get-HPiLOProcessor Gets the processor details for the host server.
Get-HPiLOProfile Gets all the Profile Descriptors and the data stored in them in the perm directory of the blobstore.
Get-HPiLOProfileApplyResult Retrieves the result of the Invoke-HPiLOProfileApply cmdlet.
Get-HPiLORackSetting Gets the rack settings for an iLO.
Get-HPiLOSecurityMessage Gets the security message for the iLO login screen.
Get-HPiLOServerName Gets the host server name used by iLO.
Get-HPiLOSNMPIMSetting Gets the respective iLO
SNMP IM settings.
Get-HPiLOSpatial Gets the location information and system data with HP Asset Manager to obtain more precise and complete asset data.
Get-HPiLOSSOSetting Gets the SSO Setting for the iLO.
Get-HPiLOStorageController Gets the storage controller of the server.
Get-HPiLOTemperature Gets the temperature health details of the server
Get-HPiLOUIDStatus Gets the UID Status of the server.
Get-HPiLOUser Gets the information for a local user.
Get-HPiLOUserInfo Gets detailed information for all local users.
Get-HPiLOUserList Gets a list of all local users.
Get-HPiLOVMStatus Gets the Virtual Media drive status.
Get-HPiLOVRM Gets the Voltage Regulator Module (VRM) health details from the server.
Import-HPiLOCertificate Imports a signed certificate into iLO.
Import-HPiLOSSHKey Imports an SSH Key and
associated username into iLO.
Invoke-HPiLOProfileApply Applies a deployment setting profile in iLO 4.
Invoke-HPiLOProfileDownload Modifies a Profile Description, downloads a specific blob, and writes the blob to the blob store.
Mount-HPiLOVirtualMedia Mounts the specified media image.
Remove-HPiLOProfile Removes a deployment profile.
Remove-HPiLOSSORecord Removes an HP SIM Trusted
SSO Server record.
Remove-HPiLOUser Removes an existing local user account.
Remove-HPiLOUserSSHKey Removes any SSH keys associated with a particular UserLogin.
Reset-HPiLOAdministratorPassword Resets the administrator password to a default value.
Reset-HPiLORIB Resets the iLO.
Reset-HPiLOServer Resets the host server on which the iLO is operating.
Set-HPiLOAHSStatus Enables or disables AHS logging.
Set-HPiLOAssetTag Sets or clears the asset tag.
Set-HPiLOBrownout Turns the brownout recovery feature on or off.
Set-HPiLOComputerLockConfig Configures the computer lock settings.
Set-HPiLODefaultLanguage Sets the default language on iLO.
Set-HPiLODirectory Modifies the directory settings on iLO.
Set-HPiLOFactoryDefault Sets the Lights-Out device to factory default settings.
Set-HPiLOGlobalSetting Modifies global settings of the host server.
Set-HPiLOHostAPO Sets the automatic power-on and power-on-delay settings.
Set-HPiLOHostPower Toggles the power on the host server.
Set-HPiLOHostPowerSaver Sets the power regulator setting for the server processor.
Set-HPiLOHotKeyConfig Configures the remote console hot key settings in iLO.
Set-HPiLOKerberosConfig Configures the Kerberos authentication.
Set-HPiLOLicenseKey Applies a license key for the Integrated Lights-Out Advanced Pack.
Set-HPiLOLockConfiguration Enable the data-center configuration lock for iLO.
Set-HPiLONetworkSetting Modifies the network settings of the host server where the iLO is located.
Set-HPiLOOneTimeBootOrder Sets one time boot order.
Set-HPiLOPassword Changes the password of a local user.
Set-HPiLOPersistentBootOrder Sets the persistent boot order.
Set-HPiLOPowerAlertThreshold Sets the power alert threshold value for the iLO.
Set-HPiLOPowerCap Sets the power cap feature on the host server.
Set-HPiLORBSUPOSTIP Configures the management processor RBSU to display the IP address during POST.
Set-HPiLOSchemalessDirectory Modifies the current schemaless directory configuration on iLO.
Set-HpiLOServerName Assigns the Server Name attribute shown in the user interface and host RBSU.
Set-HPiLOSharedNetworkPort Configures Lights-Out device to pass network traffic on the shared host network port.
Set-HPiLOSNMPIMSetting Modifies the respective iLO SNMP IM settings.
Set-HPiLOSSOSetting Modifies the HP SSO settings for the iLO.
Set-HPiLOUIDStatus Toggles the UID on the host server.
Set-HPiLOUser Modifies an existing local user account present in the iLO.
Set-HPiLOVirtualPowerButton Simulates the physical press of the power button, press and hold of the power button, coldboot and warm boot of the server.
Set-HPiLOVLAN Configures the iLO Shared Network Port with a user defined VLAN ID.
Set-HPiLOVMPortSetting Configures the virtual media port functionality for the iLO.
Set-HPiLOVMStatus Sets the virtual media drive status.
Start-HPiLOERSAHSSubmission Initiates Active Health System data submission to the Insight Remote Support server.
Start-HPiLOL2Collection Initiates an L2 data collection submission to the Insight Remote Support server.
Start-HPiLOTestEvent Initiates a test service event submission to the Insight Remote Support server.
Update-HPiLOFirmware Update iLO firmware.
Update-HPiLOModuleVersion Checks to determine if a newer version of the HPiLOCmdlets is available on the HP website for download.
3 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftwareStorage

Elitebook Challenge: Day 1 crash, recovery and comparing Elitebooks

by Philip Sellers
written by Philip Sellers

unrecoverable_error

Sunday was my travel day, so I’m considering Monday as Day 1 full time on the Elitebook Folio 1040.  It’s been a doozy of a day with the new Elitebook starting off with an unrecoverable software error from Windows.  I cannot blame the hardware – its completely the software and perhaps my botched install of Windows 8.1 to blame.  This morning, when I attempted to boot my Elitebook Folio 1040, Windows 8.1 game me an error during boot and auto-repair did not work.  I suspect that maybe the drive encryption was to blame – I had not intended to enable drive encryption, but while setting up the fingerprint scanner I enabled it during my time in the airport yesterday.  But certainly Windows 8.1 played a part here, so I will have to try it again with Windows 8.1 installed after I return home.

I don’t have a backup system with me this trip and its an incredibly crippling feeling to know that I’m without what I need to both work and attend the conference.  But in case you’re not clued in by a new blog post, the Elitebook is working again.  I was able to boot the system into HP Recovery and thanking my lucky stars for a recovery partition because I brought no physical media with me.  In the end, I’m back to trusty and reliable Windows 7 from the HP image and I’ve already noticed some things working better than when I installed Windows 8.1.

After the reinstall, I was able to quickly recover things thanks to the cloud – Office 365 quickly reinstalled Office, Adobe Creative Cloud quickly reinstalled my Photoshop & Illustrator, OneDrive restored my personal files I needed for the trip and I had an external drive with my VM and VMware Player from their site.  So, I’m back in business and so far, the laptop is running much better than under Windows 8.1  It is truly amazing how much difference a functional operating system [Windows 7] makes to getting work done.

Cloud to the rescue. And, I’m hearing a lot about cloud at Microsoft TechEd this week.  The mantra is “Cloud First, Mobile First.”   But that’s another post…

Comparing to Nerdblurt’s Elitebook 840

The rest of the week has gone without a hitch.  The system loaded with Windows 7 is much more usable to me.  Its battery life has been excellent.  I have noticed with running a VM in VMware Player on the system, it does tend to drain the battery much more than using the laptop on its own.  HP’s claims of 9 hours battery life have not quite held up at this point, but I do see myself getting a solid 4 or 5 from my testing – browsing, writing and using less-CPU intensive apps.

One of the things that I do like on this model is the inclusion of HP’s Client Security software.  It allows for biometric, fingerprint password control in the system and it allows for drive encryption.  I have not re-enabled the drive encryption during this trip, but the fingerprint scanner has been used a lot and its a handy feature – fully integrated into Windows login.

I mentioned the Forcepad in my first post about the Elitebook Folio 1040 – the issue with not accpeting gestures is also resolved with the rebuild from the factory image.  Gestures and multitouch seem to work better, though the right click still seems to be an issue for me to learn.  I can’t consistently get the system to right-click where I want.  I will be watching HP’s Forcepad instructional video again.

I compared my eval Elitebook Folio 1040 to the Elitebook 840 that my good friend Luigi (aka NerdBlurt) was carrying this week.  The 840 is a more traditional ultrabook.  The 840 includes a touch screen display and the other obvious difference is that the 840 has both traditional trackpad and pointing stick with physical buttons.  The Elitebook Folio 1040 definitely looks sleeker in the pointing department, without the extra physical buttons, but there were also no right-click problems on the 840 – just sayin’.

Other than the mouse differences, the Elitebook 840 and Elitebook Folio 1040 are pretty close cousins.  The 840 comes in a much lower price point, but ships with a traditional HDD inside instead of the SSD storage in the Folio 1040.  The Folio 1040 is about a half centimeter thinner than the 840 at its thickest and the 840 weighs more.

It was a happy run-in to get to compare the two during Microsoft TechEd when I met up with Luigi.

1 comment
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftwareStorage

TechEd Session Recap: Future Look at Microsoft Exchange Server (OFC-B310)

by Philip Sellers
written by Philip Sellers

Microsoft Exchange is the cornerstone for email in many businesses.  And a quick poll of the users in the room during this session indicated that the majority of those users are running Exchange on-premise and not Office 365’s flavor of Exchange.  So, we were all extremely interested to here where things are going in terms of development in Exchange.  This session focused on the future features with previews of some of these feature in Office 365 hosted Exchange and slides showing others.  It was intended to be an overview of where things are going for development, but didn’t delve deeply into any one of the features or the technical layers below them.

The development cycle for Exchange has changed some, as many customers witnessed for the first time with Exchange 2013.  The newest version of Exchange released to customers on Office 365 before the on-premise version released and our speakers Pavani Haridasyam and Ef Regalado attributed the switch to the nature of cloud and the ability to iterate and release more often on the cloud platform.  The development cycle is to first release the newest features internally to Microsoft employees and after getting bugs worked out and feedback from users, those changes are pushed to Office 365 customers and will ultimately be incorporated into a future on-premise version of Exchange.  But Microsoft chose to keep all Exchange development, both for the cloud and for on-premise, with a single team in order to keep things consistent for all customers.

Investment in Exchange has not slowed and a considerable amount of effort has been going into creating new features that customers are requesting and that Microsoft believes customers need.  This session focused on three major areas of development for customers on Exchange – Security and Compliance, Working Smarter, and Social Email.

In terms of security and compliance, Microsoft has been taking the Exchange compliance views and been working towards creating a unified compliance console for Exchange, SharePoint and Lync.  The compliance center aims to be user friendly tool for non-technical compliance officers in companies to perform their job functions – power with usability.

Data loss prevention is also another major focus in the security and compliance area – with the ability to fingerprint documents in Exchange and then pinpoint those to ensure that they do not get sent out of the company.  The DLP features are also extended into the OWA apps for mobile devices in attempts to ensure that documents do not leak through email.  S/MIME has also been added in the OWA interface, which many customers have requested.

The Exchange team is also working diligently on features that help people work smarter with  their email.  Admitting that many customers are overwhelmed by the volume of email they receive, OWA has a new People View or Personalized Inbox feature that lets you easily view email with a particular person from an easy People list in the sidebar.  This is one of the features making its way into Office 365 hosted Exchange now.  In addition to the arranagement by people, the Exchange team has been working to improve collaboration of documents with integration to OneDrive for Business to ‘attach’ files – which are actually stored in OneDrive rather than being attached to an email, which is quickly outdated.  It allows for multiple people to collaborate in a document in real time using Office Web Apps and all changes to be stored and updated centrally, rather than having to email multiple revisions between people.  Enhanced previews are also a part of Outlook Web App, so that when you paste in a URL, it will give you a Facebook-like preview of the URL and the ability to copy and paste in images is now supported in Office 365 hosted Exchange and will be included in a future on-premise version of Outlook Web App.

Pushing collaboration even further, the Exchange team has been working on a new Groups functionality to allow for social interaction with integration into Yammer.  The team is working to unify groups which have existed in various forms in AD and Exchange and in SharePoint separately.  The unified approach should allow for things to be logically located and less overlap in features or function to exist between the Microsoft platforms.  Azure Active Directory is the mast of the Group identities according to the slides presented and it will be federated with other Office 365 apps.  Notifications are sent to groups members when changes are made, but they are not overwhelming in the way that email notifications have in the past – instead they are collected into the unified group.  Email conversations and calendars are stored in Exchange.  Documents, OneNote and lists are stored in SharePoint and Yammer will be the group feed of activities.  The Yammer piece has yet to be implemented.

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftwareStorage

TechEd Session Recap: The StorSimple Approach to Solving Issues Related to Growing Data Trends (DCIM-B310)

by Philip Sellers
written by Philip Sellers

Dealing with astronomical data growth is a problem that every business, small to large, is dealing with.  Data is expected to grow from about 4.4 trillion gigabytes to over 44 gigabytes by the end of this decade according to numbers reported by IDC this year.  But of all the data captured and created, most of it sits idle just a few days after its initial creation, never to be referred to again.  So, how do businesses combat this?

StorSimpleTiersMicrosoft’s Marc Farley offered one Microsoft solution during his session, The StorSimple Approach to Solving Issues Related to Growing Data Trends.  Utilizing StorSimple, a Microsoft owned company, businesses can implement a third tier of storage in the cloud.  But storing data in the cloud comes with its own set of challenges.  The folks behind StorSimple recognized that most data in the cloud is stored in objects – not file and block like traditional datacenter data.  Moving data back and forth between the cloud presents problems because you have to change the data type from file or block into objects going into the cloud and from objects back to file or block from the cloud.  StorSimple is a solution to that problem by natively storing the data in object stores locally and providing companies with the ability to transport these objects into the cloud for backup, archive and off-site storage all the while providing applications with fast access to the data on-premise.

StorSimple is an iSCSI storage appliance that combines traditional hard disks with solid state to offer fast storage performance for applications.  It uses a queuing technique to store all incoming data as quickly as possible and then uses a ‘spill-over’ technique to move them down to lower tiers of storage.  It keeps primary data on the HDD and SDD and then utilizes cloud object stores to create snapshots of the data for backup, archive and off-site retention.  StorSimple uses SSD to ingest the data a quickly as possible and then uses dedupe and compression to make better utilization of space on the hard drive and cloud tiers of storage.

Traditionally, businesses have utilized tape for the purposes of backup, archive and off-site storage, but tape comes with its own set of challenges.  Marc talked a bit about the challenges of backup and especially backup to tape in business environments – from tracking cartridges to operational challenges of locating and off-siting tapes.

But in addition to the backup, recovery and archive data, what happens when a company runs out of hard disk space in an array?  Interestingly, StorSimple utilizes the cloud as another layer of spill over for stale data that will likely never be recalled again.  That is a unique take to solving the increasing storage demands for businesses.

In terms of management, StorSimple brings all the functions of primary and backup storage into a single appliance and, more importantly, into a single management interface where all the functions are managed together – rather than in different silos by different administrators.  This allows for administrators to have an unified view of their storage.

Living up to the ‘simple’ part of its name, StorSimple is a straight forward solution that doesn’t necessarily offer some of the high availability features that other storage platforms include.  The hardware is fully redundant, but there aren’t clustering features built into the platform, although disaster recovery to another site is possible using the cloud transport between the two combined with policies that dictate the recovery time objectives and recovery point objectives.

Find out more at www.storsimple.com or get a copy of Marc Farley’s book Rethinking Enterprise Storage: A Hybird Cloud Model.

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftwareStorage

Elitebook Folio 1040 Challenge: Attending MS TechEd with a twist

by Philip Sellers
written by Philip Sellers

Tomorrow morning, I will depart for Microsoft TechEd in Houston, TX, and something will be missing from my bag when I go tomorrow.  I’m leaving my Macbook Pro at home and I’m calling the next week my Elitebook Challenge.   Instead of taking my Mac, I’m going to spend the next week running on an HP Elitebook Folio 1040 and attempting to use it exclusively for the week.  HP sent me an evaluation unit to test drive and how better to test it than making it my primary computer for the week.

This is going to be a challenge for me after spending a decade running on the Mac in personal life.  I gifted away my last personal PC back in 2003.   Granted, I run PC at work,  but this blog, web development and my personal computing has been Apple-centric for years – long before the Intel switch and before the Mac became mainstream again.

HP Elitebook Folio 1040For the next week, I really want to try and give the Elitebook Folio a good run through and the only way for me to do this for sure is to leave my Mac behind.  I’m writing this post on the new Elitebook and I can already feel many similarities between it and my Mac.  The keyboard is very familiar to a Mac user.  The display is great in terms of resolution and brightness.  The trackpad is different – enough so that HP packages a how-to video about the trackpad, but as a Mac user I do miss multi-touch jestures.    When I unpacked the Elitebook, I was very impressed with how lightweight but sturdy the hardware felt.  I promise a full review of the hardware after I’ve given it a solid test.

In terms of PC’s, I’ve been stuck in Dell hell for years with the devices I had been given for work – both with a lack of sex appeal and horse power.  So I was thrilled when I unpacked the Elitebook Folio 1040. The Elitebook oozes sex appeal in the same ways that the Macbook Air and other ultralight notebooks.  While its not as razor thin as an Air, but its not far from it weighing in at just 3.3 lbs.  As I’m using it for the first time, the thought crosses my mind – this is a PC I could actually see myself using long term.  I’ve tried a bunch of Windows tablets out for work while we’ve been looking at them and there has actually only been one that I ever thought I could use for myself – that made sense.  This Elitebook is on the same list as that tablet.

Windows 8.1 is by far my biggest challenge so far – its a different animal – and one I have no real experience using since my office refuses to upgrade [for good reason, I now say].  The new Start screen is pretty awful in my opinion and although its attractive, its lost lots of user-friendliness.  My biggest complaint is that you have icons to easily identify applications, but the live tile concept replaces the icon with other content making it hard to find the app I’m looking for.  Gladly, the Windows 8.1 operating system is not the default installed and HP is giving its users a choice with the Elitebook Folio 1040 – pre-installing Windows 7 instead of Windows 8.1 onto the device.

The biggest thing for a switcher has to be software.  I have a lot of software I adore on the Mac that is Mac-only – titles like OmniOutliner which I use extensively for blogging outlines that simply aren’t available for PC.  But most of my major vendor apps have gone to subscriptions – like Office 365 Home and Adobe Creative Cloud, which made adapting to the PC titles really easy for what I need.  I have OneNote, Word and Excel along with Photoshop and Illustrator all by virtue of subscription.  These make switching much easier.  The cloud has really enabled a user like me to do a platform switch while keeping many of the services I use the same.

So, I am committed to blogging another post within one week where I will chronicle my week with the Elitebook Folio 1040.  Off we go…

Disclaimer: HP provided the Elitebook Folio 1040 to me, free of charge, to evaluate, use and to blog about with no strings attached.  HP in no way has influence or editorial control over what I blog about the Elitebook they provided.  These viewpoints are my own.  

1 comment
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterSoftware

Resolving issues with SharePoint 2013 App Store running HTTPS/SSL with a web proxy

by Philip Sellers
written by Philip Sellers

Earlier this year, I wrote a post about running the SharePoint 2013 App Store behind a web proxy.  It went over the instructions on how to configure the SharePoint application to recognize and direct App Store traffic through your web proxy to make the App Store functionality work properly.

Now that we’ve moved from a test environment towards our production, the same fix applies, but in a production environment, it is a requirement for us to run our SharePoint 2013 over HTTPS.  This threw an additional error when configuring the App Store for production.  It seemed that the SSL traffic was breaking down with an error “Unable to connect to SharePoint Appstore please retry again later.”

We double and triple checked our configuration and the only difference between proof-of-concept and production is SSL/HTTPS enabled on the SharePoint farm.  After working a case with Microsoft, it turns out our issue was an untrusted root certificate.  Well now, if that sounds familiar, I ran into this same type of problem with VMware Update Manager last year when new certificates were issued.  Although it was a different root certificate, it was the same basic problem.

Under Microsoft’s direction, we had to import the root certificate in the following screenshot.

missingrootcertificate

After importing the certificate, it resolved the issue.  Windows Server 2008 includes the ability to autoupdate its trusted root certificate authorities, but this obviously doesn’t work correctly behind a proxy configuration.  Microsoft recommends that you update and push the trusted root CA’s using Active Directory Group Policy in a domain environment.

There is an installer to update the root certificate authorities in disconnected environments, however, Microsoft says it is only for Windows XP – so please read on before using this on a server.   Microsoft added a revision to KB931125 in January 2013 with a new warning:

The KB 931125 package that was posted to Windows Update and WSUS on December 11, 2012, was intended only for client SKUs. However, the package was also offered for server SKUs. Because some customers reported issues after they installed the package on servers, the KB 931125 updates for server SKUs were expired from Windows Update and WSUS. We recommend that you sync your WSUS server and approve the expiry.

However, it was provided to us by Microsoft support.  So, mileage will vary and there is a link in KB931125 that helps to fix a problem if the update causes issues on a server.

 

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
Virtualization

HP Virtual Performance Viewer offers heat map for virtual performance

by Philip Sellers
written by Philip Sellers

A couple weeks ago at VMworld, I stopped by the HP booth to see what they had new for this year and I was introduced to HP Virtualization Performance Viewer (vPV).   Presented as a virtual triage tool, the idea behind vPV is to quickly let a virtualization administrator identify host spots of CPU or Memory that deviate from their baseline so they can pinpoint and fix problems quickly.

vPV comes in two editions – a free edition supporting up to 200 VM objects and a paid for edition with no limit.

The interface is clean and shows an overview of the entire environment, color coded – with shades of greens being good and oranges and red representing the problem areas.  What is even better is you are able to drill down into a specific host or VM by double clicking one of the blocks.  Drill down is simple and acts as it should, filtering the results to a specific cluster, resource pool, datastore or host to view what is happening inside of that object.  This provides quick information about why a particular object is deviating from its norm.

A simple toggle radio button on the right side allows users to switch between vSphere and Hyper-V in the interface.

HP Virtualization Performance Viewer

Screenshot of the HP Virtualization Performance Viewer dashboard — click for larger image

Hypervisor Support

vPV documentation says the system supports both VMware vSphere, Microsoft Hyper-V, KVM and Xen hypervisors.  In addition, it supports OpenStack OS in a private cloud deployment and HP Cloud Application Platform as a Service (Paas).

In the free edition that I downloaded, I was able to see where I could configure against VMware vCenter or Microsoft System Center Virtual Machine Manager, but not against the other hypervisors or hosts listed.  vCenter requires no agent.  For Hyper-V, it appears SCVMM is required and to communicate with SCVMM an additional data collector must be installed.  I did not see a requirement for SCVMM in the documentation, however.

HP is very big on the message of customer choice and support across heterogeneous virtualized environments.  This is another product supporting the message, in my opinion.

Installation

HP documentation says that deployment should take about 15 minutes and I found that to be true.  vPV is packaged as a virtual appliance, so the installation into VMware was quick and simple from an OVA template.  After spinning up the OVA, configuration against vCenter was simple, too, except I had too many VM objects for the free edition and so vPV presented an error.  I was able to begin testing against a subset of VMs by creating a special username and limiting permissions to specific hosts, so the free tool can be useful even in a larger environment against a subset of virtual guests.

Free versus Licensed

The free edition of vPV does not provide any security for the application.  If you can get the URL for your browser, you are in and able to make configuration changes.  The licensed edition includes AD integration and password protection for the application.  The licensed edition also includes 3 months of data retention, while the free version only includes 1 day.

Integration

The licensed version of vPV has integration points against other HP management software packages – HP Performance Manager and HP Business Software Manager (BSM).

Support

For the free edition, community support is available from an HP support forum.

Video Overview – How to install vPV in under 15 minutes


More Information

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
@2019 - All Right Reserved. Designed and Developed by PenciDesign