Windows Azure network security white paper : https://azure.microsoft.com/blog/2014/01/07/new-windows-azure-network-security-whitepaper/

(all that you need is mentioned in white paper based on scenarios)

Few related blogson azure network security

https://blogs.technet.com/b/canitpro/archive/2013/10/29/set-by-step-setting-up-network-access-control-lists-acls-in-azure.aspx

https://blogs.msdn.com/b/walterm/archive/2014/04/22/windows-azure-paas-acls-are-here.aspx(PaaS)

Azure Security Overview

https://www.microsoftvirtualacademy.com/training-courses/windows-azure-security-overview#fbid=UOvc-8teY10

Azure Overview for IT pros

https://www.microsoftvirtualacademy.com/training-courses/windows-azure-for-it-pros-jump-start

Creating ACL’s – PowerShell

https://blogs.technet.com/b/heyscriptingguy/archive/2013/08/31/weekend-scripter-creating-acls-for-windows-azure-endpoints-part-1-of-2.aspx

https://blogs.technet.com/b/heyscriptingguy/archive/2013/09/01/weekend-scripter-creating-acls-for-windows-azure-endpoints-part-2-of-2.aspx

https://blogs.technet.com/b/heyscriptingguy/archive/2013/09/18/creating-acls-for-windows-azure-endpoints.aspx

Good read (blog on Microsoft azure security)

https://blogs.msdn.com/b/cdndevs/archive/2014/03/19/windows-azure-security-privacy-compliance.aspx

Let’s look at few of the steps and considerations.

Migrate from SBS2011 to Essentials 2012 and later transition to server 2012 standard with Exchange 2013 on premises

Phase 1 – SBS Prerequisites.

1. Backup your SBS2011 server ( Full – recommended ) , you can use windows Server backup

2. Install the most recent updates and Service packs for windows and SBS2011

3. Update your Exchange 2010 to Service Pack 3

4. Disable your VPN setup and DHCP on SBS2011, you can use the Console and windows native tools.

5. Evaluate the Health of SBS2011 , you can use SBS BPA

a. Fix all the critical errors and warnings

6. Run the Migration preparation tool on Source server

a. You will need to mount the windows server 2012 ISO / DVD on sbs2011 server, browse to \support\tools folder and run sourcetool.msi file.

b. You may be prompted to restart your sbs2011 server

7. Plan to migrate your LOB applications

Phase 2 – Migrate SBS2011 (Exchange 2010) to Exchange 2013 (on premises)

1. Install windows server 2012 standard and join it to the domain.

2. Exchange 2013 Pre-requisites
Exchange 2013 System Requirements

3. Install below components / software’s in order :-

Other IIS and OS components

.NET Framework 4.5

Windows Management Framework 3.0

Unified Communications Managed API (UCMA) 4.0

4. Install the CU1

NOTE: This will install exchange 2013 with CU1 update, which is recommended for hybrid exchange deployments. This should automatically install server prerequisites for exchange 2013 and prepare AD schema for exchange deployment.

5. Switch primary namespace to Exchange 2013 CAS

a. Exchange 2013 fields all traffic, including traffic from Exchange 2010 users. Reconfigure DNS and/or your reverse proxy infrastructure's publishing rules to have the primary namespace point to CAS 2013.

6. Obtain and deploy certificates on Exchange 2013 Client Access Servers: We recommend utilizing a certificate that supports Subject Alternative Names; however, you can utilize a wildcard certificate as well.

7. Update internal and external DNS to point Mail and Autodiscover records to Exchange 2013.

8. Configure Mail Flow and Client Access: Create Send connector and add Exchange 2013 as the source server & Configure External Url and Internal Url on Exchange 2013.

https://technet.microsoft.com/en-us/library/jj218640(v=exchg.150).aspx

9. Move Exchange 2010 users to Exchange 2013 MBX server: You can use Exchange Admin Center or Exchange Management Shell to create a local move request.

https://technet.microsoft.com/en-us/library/jj150487(v=exchg.150).aspx

10. Migrate Public Folders to Exchange 2013 From Previous Versions:

This article describes all the necessary steps required for migrating Public folders to Exchange 2013. (IF ANY)

https://technet.microsoft.com/en-us/library/jj150486(v=exchg.150).aspx

11. Confirm if mail flow and CAS functionalities are operational from exchange 2013 Server.

Phase 3 – Install Windows Server 2012 Essentials in migration mode

1. Boot the Destination Server from Windows server 2012 DVD / ISO and install the OS.

2. After the OS installation it will restart and ask you to choose options.

a. Server installation mode, select > server migration.

b. Provide the source server and destination server information in the windows.

3. Install all the Windows Server 2012 Essentials updates.

4. Check the health of domain controllers

a. DCDIAG

b. NETDIAG

c. REPADMIN

Phase 4 – Move Data to Windows Server 2012 Essentials

1. Move Settings and data from sbs2011 to windows server 2012 essentials

a. Copy data to destination server , you can use robocopy

b. Confirm all the users are migrated to sbs dashboard. If some users are remaining use the powershell to recover them to dashboard

“Import-WssUser –SamAccountName [AD username]”

2. Configure DHCP on Source (optional)

3. Configure network : Anywhere Access

a. Dashboard > Home > Setup. Click Setup Anywhere Access

4. Remove Legacy GPO’s from Group policy management Console.

5. Map Users to computers

a. Dashboard > Users, right click user account properties and click configure access

b. Click Allow Remote Web Access and access to web services applications

c. Select Shared Folders, select Computers, select Homepage links, and then click Apply.

d. Click the Computer access tab, and then click the name of the computer to which you want to allow access.

e. Repeat for all users

NOTE: In Windows Small Business Server 2011, if a user connects to Remote Web Access, all the computers in the network are displayed. This may include computers that the user does not have permission to access. In Windows Server 2012 Essentials, a user must be explicitly assigned to a computer for it to be displayed in Remote Web Access. Each user account that is migrated from Windows Small Business Server 2011 must be mapped to one or more computers.

6. Enable Folder Redirection (optional)

a. Dashboard > Devices > Implement Group policy

b. Enable Folder Redirection > Next > finish

c. You must delete old Folder Redirection Policy from GPMC console.

Phase 5 – Demote and remove source SBS2011 from network

1. Uninstall Exchange 2010 from SBS2011

a. Go to Add or Remove programs

b. Right click exchange 2010 setup

c. Maintenance Page will open > click Next to continue

d. Server Role selection page > select the Exchange roles which are installed including management tools > next

e. Finish

https://technet.microsoft.com/en-us/library/ee332361.aspx

2. Remove AD Certificate Services

a. Server manager > Role summary > remove roles > next > Active Directory Certificate Services > Next > Confirm Removal option > Remove

NOTE: If you want to migrate your AD CS to destination server, procedure will be different and carefully follow the process documented in the link.

b. Restart even if it does not prompt to.

3. Disconnect Printers connected to the Server directly

4. Demote the Server

a. Run gpupdate /force on clients to update newer policies for Windows server 2012 essentials

b. Run > DCPROMO > Next (twice ) > finish

NOTE: Do not select this is the last domain controller in the domain

c. If the SBS2011 computer name still exist in the users and computers or sites and services console, delete it manually.

d. Delete entries pointing to SBS2011 in DNS. Look in forwarders, name servers in forward look up zone and reverse look up zone.

5. Run BPA on Windows Server 2012 Essentials

Phase 6 – Integrate an on-premises Exchange Server 2013 with Windows Server 2012 Essentials

1. Integrate Exchange 2013 with Server Dashboard.

a. Open Dashboard > Home > Connect to my Email Services > Integrate your exchange Server

b. Click Setup up Exchange Server Integration

2. Confirm you can use Dashboard and its features.

a. Check if user and its email functionalities can be managed from dashboard.

b. Install update Rollup 1 for Windows Server 2012 Essentials

c. Confirm if Remote is working.

Phase 7 – Transition windows server 2012 essentials to server 2012 standard.

1. Take a complete backup of Windows Server 2012 Essentials

2. Transition process :-

a. Open powershell > run as administrator

b. Run the command: “dism /online /set-edition:ServerStandard /accepteula /productkey:Product Key”

c. Server will restart to finish transition process.

NOTE: Windows Server® 2012 Essentials supports up to 25 users and 50 devices. When your business needs exceed the limit, you can perform an in-place license transition from Windows Server 2012 Essentials to Windows Server® 2012 Standard, in order to remain license compliant.

After you transition to Windows Server 2012 Standard, the user account and devices limits are removed, but the features that are unique to Windows Server 2012 Essentials (such as the Dashboard, Remote Web Access, and client computer backup), still remain available. However, technical limitations for these features support a maximum of 75 user accounts and 75 devices. If it becomes necessary to add more than 75 user accounts or devices, you should turn off the Windows Server 2012 Essentials features and use the Windows Server 2012 Standard native tools to manage user accounts and devices.

Important

Windows Server 2012 Standard requires a Client Access License (CAL) for each user or device in your environment. This is different from Windows Server 2012 Essentials, which does not use the CAL model and does not come with any CALs. When transitioning from Windows Server 2012 Essentials to Windows Server 2012 Standard, you will need to purchase the appropriate number and type of CALs for your environment (most customers purchase user CALs).

How Domain Controller Cloning Works in Windows Server 2012

Flexible Workstyle (Windows 8)

Chalk Talk for Competitive Advantages of Windows Server 2012 Hyper-V over VMware vSphere 5.1

Hello Everyone!

This is in interest to 1:Many workshop Sessions planned for FY13. Please consider this a warm invite to come and join the sessions and get to know the latest technologies and features of Microsoft product line.

Watch this space for more info .. or follow on Twitter @amansingh_19

Hope you see you all !

Happy Learning!

Welcome everyone for today’s session on Virtual Domain Controller Cloning in Server 2012.

As we know cloning, copying, snapshots or anything but reinstalling a virtual domain controller wasn’t the best for your Active Directory, instead it would most likely make your existing directory from bad to worse. USN rollbacks, lingering objects, time mismatch and ultimately risking AD corruption.

Starting with Server 2012 DC cloning and Snapshot restoration is supported.

In Server 2012, a new VM-Generation-ID unique Identifier is incorporated as an additional attribute of a Domain Controller’s Computer object in AD as well as of VM host (VM container) which is running Virtual DC instance.

When a Virtual DC running Server 2012 boots up, Server 2012 looks for mismatch between VM-Generation-ID recorded on VM instance and VM-Generation-ID on DC’s computer object in AD. If there is a mismatch windows Server knows of the possible snapshot or cloning event which has occurred, and it pushes the latest RID pool and USN for updated information. This safeguards AD health.

Note:

· VM-Generation-ID attribute must be supported on your host hypervisor. VM-Generation-ID support is included in Hyper-V v3 (Server 2012). Other Hypervisor vendors may have the ability but please confirm the version with your vendor support group.

· Source DC must be Server 2012

· PDC role holder must be available to cloned DC and ensure its running Server 2012.

How to Clone your Virtual Domain Controller in Server 2012

Ø Authorize the Source Domain Controller

You will add the source DC, which you will use to close other DC’s to a special Active Directory group called “Cloneable Domain Controllers”. You can find it under Users container.

Best practice is to remove the cloneable DC from this group after completing your task. As cloned DC will also be added to this group. So best you clean it at the end.

Ø Compatible Services to Clone

You need to ensure the services running on your server, if they are compatible with DC cloning. Since certain Software components will be affected after a change in computer name and Security Identifier. You must remove all incompatible software’s prior to cloning; else the process can fail.

Command to list services running on your DC: Get-ADDCCloningExcludedApplicationList

For all incompatible software, you will update them in the Exclude list.

Command to update the list on your DC: Get-ADDCCloningExcludedApplicationList –GenerateXml

And this is how the XML file will look like, found at c:\windows\NTDS:

Ø Configure Source DC to setup new clone DC – DCCloneConfig.xml

You can configure the source DC with set of instructions to clone new DC with specific settings as Network Settings, DNS, WINS, AD Site name, Computer Name etc.

New Clone DC will read the DCCloneConfig.xml file and use these settings while booting up the new Clone DC.

Here is how you will create the DCCloneConfig.xml in powershell

New-ADDCCloneConfigFile -IPv4Address 192.168.1.15 -IPv4DefaultGateway 192.168.1.10 -IPv4SubnetMask 255.255.255.0 -IPv4DNSResolver 192.168.1.20 -Static -SiteName London -CloneComputerName DC2

You can view your DCCloneConfig.xml file from c:\windows\NTDS:

Since I have configured the source DC for cloning and there is not unsupported service and I’m ready to start the cloning process.

Ø Shut down the VM

Shut down the Virtual machine of Source Domain Controller to prepare it for cloning.

You can simply shut down your virtual machine (DC1) or shoot the power shell command let

Stop-VM –Name server2012 –ComputerName AMAN-LAB1

Ø Export the Virtual Machine

Export the Virtual Machine of Source Domain Controller to a Folder Path

Export-VM –Name server2012 –ComputerName AMAN-LAB1 –Path E:\CloneDATA

This usually takes around 5 Minutes to complete but may differ on every environment.

Ø Import the VM

$NewCloneDC = Import-VM -Path "E:\CloneDATE\server2012\Virtual Machines\xyz.xml" -Copy –GenerateNewId –VhdDestinationPath E:\Hyper-V\VirtualHardDisks\DC2

We use a variable ($NewCloneDC) to store the information in it. With the Import-VM switch we point it to path of the xml file and use –copy for copying the vhd data and –GenerateNewID to specify a new generation ID different to source exported VM and this completes the task.

If we are importing it to the same Hyper-V host, it’s important you create a new folder in the hierarchy and import it there. Since the name is same of exported VM you will need to rename it

This takes about 5 minutes again to complete

Ø Rename the New cloned VM

Rename-VM -VM $NewCloneDC -New-Name "DC2"

Ø Power ON new DC

After the renaming step lets power on the source and new VM. New VM will read information from DCCloneConfig.xml and assign itself a new computer name and IP settings.

This should bring up the new DC2 with specified settings.

Hope this was informative and a good experience.

Don’t we all love to know what’s new in AD DS? Here’s a quick peek

The New Stuff in AD DS Server 2012 can merely be categorized into two types “new” and “improved”. Either way both are Eye Catching.

1. Virtualization Improvements

Server 2012 is powered with great Virtualization improvements which are much needed in Day today’s domain management not only in high scale environments but also for the ease of management.

• CLONING

You can now clone your Domain Controller. Yes you heard me right “Cloning” is the new feature which allows you to deploy replicas of your single domain controller across your environment.

Process of Cloning involves creating a copy of your exiting virtual DC after authorizing the source DC to be cloned in AD DS. Then Creating a configuration file that contains detailed information (hostname, IP address, DNS servers, etc.) or you have an option to leave it blank by allowing the system to fill that for you. This process not only reduces the steps and time involved but allows you to fully deploy Additional DC’s which are authorized for cloning by Domain administrator.

• SAFE GUARDING

AD DS is not new to virtualization, however the features present in most hypervisors can sometimes just not work right with AD replication algorithms (For example logical clocks). In server 2012, a virtualized DC uses a unique identifier which is exposed by Hypervisor called the Virtual machine GenerationID. Virtual machine GenerationID changes whenever there is a change in virtual machine state (for example during boot or before completing any transaction). Virtual machine running DC will compare its Virtual machine GenerationID against the value store in Directory. Mismatch in the ID can event for a rollback and AD DS would allow DC to talk on other DC’s in the environment to give it its current state of information and prevent it from creating duplicate SID’s. This will only work if your hypervisor is Virtual machine GenerationID aware.

Visit the link for detailed information: AD DS Virtualization

Also Read: How to Cloning Virtual Domain Controller In Server 2012

2. Easy Deployments and Upgrades

AD DS in Server 2012 brings together all the steps required to deploy a new DC into One single Graphical Interface. It can do all the good things together saving the additional task which Domain Administrators have it written in the check list. It is built on windows PowerShell in line with Server Manager to target multiple server and remotely deploy DC’s , bringing in smile on end user experience.

Few task that can be automated through the GUI - We can preparing the Domain for DC promotion as adprep.exe in included in the GUI, we can install AD DS server roles remotely, when deploying multiple DC’s across wide geographical locations. This would also correct any prerequisites which are necessary. Below is a sample of how the GUI looks like.

You can also view Scripts to look at the power shell commands.

3. Simplified Management

• Dynamic Access Control

DAC brings the next level of Access Control which allows Administrators more express more based on modern day challenges in regulatory and business requirements. It enhances the existing model by introducing user – claims, device -claims or User + device claims (AKA Compound identity). Authorization decisions can be made based on new central access policies (CAP) model and File-Classification.

You try accessing a file share and get an ACCESS DENIED. As a user, you’d be glad if someone explains to you why you do not have necessary permissions on the share and also gives you an opportunity to report it to the authorized controller with a dialog box.

Auditing has been made more granular and same time more flexible and simpler.

Visit the link for Scenario Overview: Dynamic Access Control

• Direct Access Offline Domain Join

DirectAccess offline domain join is a process that computers running Windows Server 2012 and Windows 8 can use to join a domain without being physically joined to the corporate network, or connected through VPN. Offline domain join for DirectAccess provides DirectAccess policies to clients to allow remote provisioning.

In short, just join the computer over the internet. (You will need DirectAccess for this)

Visit the link for detailed information: DirectAccess Offline Domain Join

• Active Directory Recycle Bin User Interface

AD Recycle bin was introduced in 2008 R2, but was limited to PowerShell only, now you a GUI

Visit the link for Details: Active Directory Recycle Bin

• Active Directory Federation Services (AD FS)

AD FS now does not need to be installed separately and has multiple improvement. Watch out the space for an upcoming blog on AD FS

Visit the link for Details: AD FS

• Windows PowerShell History Viewer

Since PowerShell is the way forward we look to increase the learning experience. Every UI action can be viewed into PowerShell cmdlets.

• Active Directory Replication and Topology windows PowerShell cmdlets

When an Administrator hears about an AD Replication issue, First thing he would look for are the AD tools to view the result of the replication state such as repadmin, ntdsutil & AD sites and services.

Using PowerShell all of the tools can be incorporated in easy and powerful scripting experience. It’s consistent and compatible with other windows PowerShell cmdlets.

Visit the link for Details: AD Replication and Topology PowerShell cmdlets

• Fine Grained Password Policy User Interface

In order to leverage on the 2008 FGPP with more precise management, UI has been introduced which allows administrators to create, edit and assign which much minimum trial and error administration.

Visit the link for Details: FGPP

• Active Directory Based Activation (AD BA)

We all know how windows activation worked in the past or even in 2008. Using the AD BA, You can activate your clients using Active Directory Infrastructure. However please be noted only windows 8 clients can leverage the feature.

Visit the link for Details: AD BA

• Group Managed Service Accounts (gMSA)

Managed Service Accounts were introduced in 2008 R2 and Win 7, these are managed domain accounts which provided password management to run a service or any related administrative task. GMSA extends the same functionality to multiple servers in the domain. This can be helpful while connecting to a service hosted on a server farm or NLB.

Visit the link for Details: gMSA

4. AD DS Platform Changes

Some of the enhancements may not be common to an administrative point but surely it’s a way forward.

• AD DS claims in AD FS
• Relative ID (RID) Improvements
• Deferred Index Creation
• Kerberos Enhancements.

There is tremendous effort put in Server 2012 AD DS platform architecture, which is enhanced to improve the Design and scalability. This altogether benefits the performance which an Administrator would love to see.

Hope you find this Informative.

Happy Reading!

1. Import the AD module

Import-Module -Name ActiveDirectory

2. Check the Forest Functional level of your Active Directory

Get-ADForest | Format-Table Name , ForestMode

You can also check it by going to AD Domain and services.

3. Lower the Forest Functional Level and then the Domain Functional Level

Set-ADForestMode –Identity “woodgrovebank.com” –ForestMode Windows2008Forest

Set-ADDomainMode –Identity “woodgrovebank.com” –DomainMode Windows2008Domain

4. To Confirm your Forest Functional level of your Active Directory

Get-ADForest | Format-Table Name , ForestMode

The only thing that you want to keep in mind is your recycle bin functionality which should not be enabled. (Its disabled by default).

Hope this helps. Happy reading!

Hello Everyone!! It gives me immense pleasure to welcome you all to my blog site. I will be looking forward to BLOG all of my most interesting case work and research. Having started my journey in Small business server team with MS, the first steps have been fab ! and if you ask me I can reiterate each day I spent with SBS, it’s an absolute joyride! My current role with MS is consulting Microsoft Partners with planning designing and deploying windows platform solutions also advising on product sales.

Personally I love travelling , exploring new places and I am a huge soccer fan. My team is Chelseafc in English Premier League, favorite player Fernando Torres and D Drogba.

All said; I am really excited to get on the show and be part of the NEXT BIG Thing!

Once again Welcome everyone and enjoy the ride.