CANITPRO

PowerShell Basics: Connecting to Exchange Online Using Multi-Factor Authentication

MVP Thomas Rayner — Wed, 23 Aug 2017 07:00:45 GMT

Using PowerShell to manage your Microsoft cloud services like Exchange Online and using multi-factor authentication (MFA) separately is awesome. Using the two together however, not so much. Microsoft documentation on this topic seems to suggest that all the required administrative tasks needed are to be performed from a shell that launched separately from the PowerShell console. I would rather be able to connect to Exchange Online using MFA via PowerShell through a normal console, or as part of another tool. The following is how this can be accomplished.

The first thing you'll need to do is install the tool at this page. This will give you all the tools and libraries you need to install to connect to Exchange Online using MFA via PowerShell, including that special, magic console. Now that you have the tools installed, you can use this snippet to connect from a normal PowerShell console or from within another PowerShell-based tool.

$modules = @(Get-ChildItem -Path "$($env:LOCALAPPDATA)\Apps\2.0" -Filter "Microsoft.Exchange.Management.ExoPowershellModule.manifest" -Recurse )
$moduleName =  Join-Path $modules[0].Directory.FullName "Microsoft.Exchange.Management.ExoPowershellModule.dll"
Import-Module -FullyQualifiedName $moduleName -Force
$scriptName =  Join-Path $modules[0].Directory.FullName "CreateExoPSSession.ps1"
. $scriptName
$null = Connect-EXOPSSession
$exchangeOnlineSession = (Get-PSSession | Where-Object { ($_.ConfigurationName -eq 'Microsoft.Exchange') -and ($_.State -eq 'Opened') })[0]

Lines 1 and 2 detail the location of the different tools and libraries installed earlier. Once I find the ExoPowerShellModule.dll, I can import it like any other module, except I’m specifying the full path, on line 3. Lines 4 and 5 are where I find and dot source CreateExoPSSession.ps1 which is the script that contains the Connect-EXOPSSession cmdlet (which I’d be remiss if I didn’t mention violates the PowerShell naming standards created by the community and advertised by Microsoft). That cmdlet will trigger a login process that includes MFA, similar to how Login-AzureRmAccount works. Finally on lines 6 and 7, I’m creating a new session and then assigning it to a variable called $exchangeOnlineSession. Then I can import that session and I’ll be away to the races. It’s not as convenient or straightforward as connecting without MFA, but it’s definitely safer.

PowerShell Basics: Azure AD Management Commands

MVP Dishan Francis — Wed, 16 Aug 2017 07:00:25 GMT

Now that we’ve covered the basics in my previous post, Step-By-Step: Intro to Managing Azure AD via PowerShell, we’ll take a look at the commands available to further manage you Azure AD deployment. Some of the commands currently used for on-premises Active Directory Management will also work for Azure Active Directory or differ very little. For example, in an on-premises AD deployment, New-ADUser is used to add user, in Azure AD it becomes New-MsolUser. The following are a list of commands available to manage Azure AD in PowerShell. More information about a command can view using, Get-Help New-MsolUser –Detailed Technical Information about thecommand can view using, Get-Help New-MsolUser –Full Online information about the command can view using, Get-Help New-MsolUser –Online We also can view some example for the command using, Get-Help New-MsolUser –Example We can simply create new user using, New-MsolUser -UserPrincipalName "jeffm@therebeladmin.com" -DisplayName "Jeff Mak" -FirstName "Jeff" -LastName "Mak" -PasswordNeverExpires $true In order to create a user, you need to connect to Azure AD with a user who has “Global Admin” role. In above command UserPrincipalName specify the UPN and user password s set not to expire. It is obvious sometime we need to change password of an existing account. Set-MsolUserPassword -UserPrincipalName "jeffm@therebeladmin.com" -NewPassword "pa$$word" The above command will reset the password for the jeffm@therebeladmin.com in to new password. Instead of specifying password, following command will generate random password and force user to reset it on next login. Set-MsolUserPassword -UserPrincipalName "jeffm@therebeladmin.com" -ForceChangePassword $true Azure Active Directory does have predefined administrative roles with different capabilities. This allows administrators to assign permissions to users to do only certain tasks. More details about these administrative roles and their capabilities can found on https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign-admin-roles We can list down these administrative roles using Get-MsolRole According to requirements, we can add users to these administrative roles. Add-MsolRoleMember -RoleName "User Account Administrator" -RoleMemberObjectId "e74c79ec-250f-4a47-80dd-78022455e383" Above command will add user with object id e74c79ec-250f-4a47-80dd-78022455e383 to the role. In order to view existing members of different administrator roles, we can use command similar to below. $RoleMembers = Get-MsolRole -RoleName "User Account Administrator" Get-MsolRoleMember -RoleObjectId $RoleMembers.ObjectId This will list down the users with User Account Administrator role assigned. Apart from the roles, AD also have security groups. New-MsolGroup -DisplayName "HelpDesk" -Description "Help Desk Users" Above command creates a group called HelpDesk A group contains members. We can add members to group using commands similar to below. Add-MsolGroupMember -GroupObjectId a53cc08c-6ffa-4bd6-8b03-807740e100f1 -GroupMemberType User -GroupMemberObjectId e74c79ec-250f-4a47-80dd-78022455e383 This will add user with object id e74c79ec-250f-4a47-80dd-78022455e383 to group with object id a53cc08c-6ffa-4bd6-8b03-807740e100f1. We can list down the users of the group using Get-MsolGroupMember -GroupObjectId a53cc08c-6ffa-4bd6-8b03-807740e100f1 We can view all the groups and their group ids using Get-MsolGroup In order to remove member from the security group we can use Remove-MsoLGroupMember cmdlet. Remove-MsoLGroupMember -GroupObjectId a53cc08c-6ffa-4bd6-8b03-807740e100f1 -GroupMemberType User -GroupmemberObjectId e74c79ec-250f-4a47-80dd-78022455e383 In order to remove a user from administrator role we can use Remove-MsolRoleMember cmdlet. Remove-MsolRoleMember -RoleName "User Account Administrator" -RoleMemberType User -RoleMemberObjectId "e74c79ec-250f-4a47-80dd-78022455e383" Above command will remove user with object id e74c79ec-250f-4a47-80dd-78022455e383 from the group User Account Administrator

Step-By-Step: Intro to Managing Azure AD via PowerShell

MVP Dishan Francis — Wed, 09 Aug 2017 07:00:22 GMT

As IT Professionals know, time is never on our side. Hence the reason PowerShell is so important. It provides a quicker way of completing tasks and can even provide some automation if harnessed correctly. This Step-By-Step will detail how to get started in harnessing PowerShell to manage an Azure Active Directory instance and detail day to day operation related commands to get you started. In order to use PowerShell with Azure AD, first we need to install Azure Active Directory Module in local computer. there is two version of Azure active directory PowerShell module. One was made for the Public Preview and the latest one released after announces Azure AD GA. You can download module from http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx It is highly recommended to replace it with the new version should you have already installed an older version. Once installed let’s check its status. Get-Module MSOnline In order to list down all the commands associate cmdlets with the module we can use Get-Command -Module MSOnline Next step is to connect to Azure AD Instance. In order to do that we can use, Connect-MsolService It will prompt for the login details. Please use your Azure DC Admin account details. Please note login via Microsoft account not supported. First, we can list down all the domain under the given subscription. To do that we can use, Get-MsolDomain As next steps I like to list down all the users in Azure AD Setup. Get-MsolUser It will list down all the Users in the Azure AD. I also can search for a specific user based on text patterns. In below example I am searching users with Name which match text “Dishan” Get-MsolUser -SearchString "Dishan" Idea of my search is to find some object values for this user. I can combine above command to return all the object value. Get-MsolUser -SearchString "Dishan" | Select-Object * Now we know what are the objects been use and I can make more unique search. Get-MsolUser | Select-Object DisplayName,whenCreated,LastPasswordChangeTimestamp Above command will list me all the users with Display Name, Date and Time It was created, and Date and Time of Last Password Change Action. Get-MsolUserRole another handy cmdlet. It can use to check the role of a user account. Get-MsolUserRole -UserPrincipalName "dcadmin@REBELADMIN.onmicrosoft.com" | fl The above command will find the role for the given user account. Get-MsolGroup cmdlet can use to list, filter Groups in the Azure AD. Using searchstring can search for the groups based on text patterns. Get-MsolGroup -SearchString "AAD" Get-MsolGroupMember can use to list down the members in the group. Get-MsolGroupMember -GroupObjectId "77a76005-02df-48d5-af63-91a19ed55a82" Remove-MsolUser cmdlet can use to remove the user object from the Azure AD. This can combine with searchstring to search for user and then remove the object same time. Get-MsolUser -SearchString "user2" | Remove-MsolUser Above command will search for the user object which have display name similar to user2 and then delete it.

Step-by-Step: First steps with Azure Container Instances

Pierre Roman — Wed, 02 Aug 2017 05:18:45 GMT

Hello Folks, It’s been a while since I last posted but it’s not because there has not been developments in the Microsoft Azure world. One in particular I wanted to talk about is Azure Container Instances or ACI for short. That capability was announced on July 26, 2017. An Azure Container Instance is a single container is extremely quick to deploy and start. And it’s also billed by the second. These ACI allow you to specify sizing allowing you to match the requirements of your application perfectly. There is no VM management you need to think about or cluster orchestration to setup. As Corey Sanders put it…. “It is simply your code, in a container, running in the cloud.” In this post to show you how easy it is to get started, I will create a container in Azure and expose it to the internet with a public IP address in only two commands without any dependencies needed to be installed. All I need is a browser and an Azure Subscription.

Step 1 – Access the Cloud Shell Interface

The Cloud Shell enables access to a browser-based Bash command-line experience built-in the Azure portal. The Cloud Shell comes pre-installed with popular command-line tools and language support so you you can get right to it and not worry about installing/updating packages.

Step 2 - Create a resource group

Azure Container Instances are Azure resources and therefore must reside in an Azure resource group, so our next step is to create a resource group with the az group create command.

az group create --name ACI-test --location eastus

Step 3 – Create a container

Now that we have the Resource Group, we will create a container by providing a name, a Docker image, and the Azure resource group we created in the last step. You can optionally expose the container to the internet with a public IP address.

az container create --name myfirstaci --image microsoft/aci-helloworld --resource-group ACI-test --ip-address public

Within a few seconds, you will get a response to your request. Initially, the container will be in a Creating state, but it should start within a few seconds. You can check the status using the following command.

az container show --name myfirstaci --resource-group ACI-test

and you will get the new provisioning state which should change to “Succeeded”. You will also notice the public IP address of the conatainer.

Step 4 – Test Access to the Container

To test the instance I opened a web browser and navigated to the IP address found above. That’s it! Our container is up and running. When you are done testing you can delete the container with the following command.

az container delete --name myfirstaci --resource-group ACI-test<

There you go! Cheers! Pierre Roman Pierre Roman @pierreroman

PowerShell Basics: Retrieving Azure Key Vault Certificate

MVP Thomas Rayner — Wed, 26 Jul 2017 07:01:16 GMT

Microsoft's Azure Key Vault manages cryptographic keys and certificates used by cloud applications and services. Some instances may require the use of said certificate stored in Azure Key Vault on a computer, or some hosted service. Use of PowerShell is the quickest way to accomplish this via the following steps: With the Azure PowerShell tools installed and logged into Azure enter the following:

Install-Module -Name AzureRm -Repository PSGallery -Scope CurrentUser -Force
Import-Module AzureRm
Login-AzureRmAccount

Next step is to download the certificate. Enter the following:

$cert = Get-AzureKeyVaultSecret -VaultName 'My-Vault' -Name 'My-Cert'

Once downloaded, the SecretValueText property needs to be converted into a certificate. Enter the following to complete this:

$certBytes = [System.Convert]::FromBase64String($cert.SecretValueText)
$certCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$certCollection.Import($certBytes,$null,[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)

The SecretValueText can be converted into bytes and can utilize the X509Certificate2Collection class to convert those bytes to a certificate. Next, we want to write the certificate to a pfx file on a disk somewhere (preferably to a temp location you can clean up later in the script).

$protectedCertificateBytes = $certCollection.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12, $password)
$pfxPath = "D:\a\1\temp\ThomasRayner-export.pfx"
[System.IO.File]::WriteAllBytes($pfxPath, $protectedCertificateBytes)

The first line here exports the certificate and protects it with a password. Then it writes the protected bytes to a path on the file system. So where did that password come from? I’m actually storing that in the Azure Key Vault.

$password = (Get-AzureKeyVaultSecret -VaultName 'My-Vault' -Name 'My-PW').SecretValueText
$secure = ConvertTo-SecureString -String $password -AsPlainText -Force

Now, I can either refer to that pfx file, or I can import it like this.

Import-PfxCertificate -FilePath "D:\a\1\temp\ThomasRayner-export.pfx" Cert:\CurrentUser\My -Password $secure

Be sure to clean up your certificates when completed.

Build Intelligent Robots with EZ-Robot and Microsoft Cognitive Services

Sergiy Baydachnyy — Wed, 12 Jul 2017 07:00:35 GMT

What if a robot could tell how you are feeling?

Microsoft Cognitive Services is a set of APIs and SDK services that can enable developers to easily add features that can detect emotion, identify objects and understand language understanding into their applications. Imagine utilizing that same set of features in a robot.

Enter Calgary based EZ-Robot who has created a solution to allow those interested in building robots to create applications for their robots using different SDKs. Their core product called EZ-Builder allows anybody, regardless of programming knowledge, to bring robots to life. The software is available from Windows Store and is able to incorporate Microsoft Cognitive Services to allow for further depth to the EZ-Robot's capabilities..

This post will cover is the use of three plugins compatible with EZ-Builder that are based on Microsoft Cognitive Services. The following are a list of these plugins:

Bing Speech Recognition: based on Bing Speech API and allows your robots to understand voice commands;
Microsoft Cognitive Emotion: uses Emotion API to understand your primary (with the most confidence) emotion and it’s confidence. Thanks to that you can program different behavior for your robots depends on your emotions;
Microsoft Cognitive Vision: based on Computer Vision API and allows you to grab image frames from input video stream to describe them and find some tags that are associated with the frames;

To setup any of these plugins you simple need to install them on your computer and add to your EZ-Builder project. Once you have these plugins in your project, it’s easy to setup each of them. For example, if you want to use voice commands in your project, you need to provide some parameters using Config window below:

Working with the configuration for the plugin you will be able to invoke Script Editor to define robot actions based on input. Access to recognized text based on input voice command will be stored in BingSpeech variable, but you can rename it any time. Finally, you have to provide API Key to get access to Microsoft service. It’s just one place where you need to deal with the service directly. Just visit https://azure.microsoft.com/en-us/services/cognitive-services/ and create a free account to generate a key. The plugin will do all other things for you automatically and you can program robot’s behavior just imagine that the robots is getting text commands rather than voice commands.

The same situation for Cognitive Emotion and Cognitive Vision plugins. You need to provide API Key and after that you will be able to go ahead and start using the plugins just working with some predefined variables. In the case of the Emotion plugin, you can use EmotionDescription and EmotionConfidence variables. In the case of the Vision plugin, you can get access to image description and tags using VisionDescription, VisionConfidence and VisionReadText variable.

Therefore, it’s really easy to start using cognitive services in your EZ-Robot applications and I can promise some fun.

If you want to know more and watch some videos, EZ-Robot has begun publishing their lessons on YouTube and videos about Emotion and Vision services are already published.

Start using these plugins now and add some intelligence to your robots!

Step-By-Step: Configuring a site-to-site VPN Gateway between Azure and On-Premise

MVP Dishan Francis — Wed, 28 Jun 2017 11:13:54 GMT

Using site-to-site VPN gateway can provide better continuity for your workloads in hybrid cloud setup with Azure. This post will demonstrate how to set up site-to-site VPN Gateway to enable this. Requirements Before start make sure you have following in place. 1) VPN device: A VPN device is needed on-premise to create the VPN connection with Azure. A list of supported list of devices can found here. 2) Static Public IP address: The VPN device should have external public IP address and it shouldn't be NAT. 3) Valid Azure Subscription Create Virtual Network If you already have virtual network setup in your azure subscription, you will not need to do this step but make sure the settings are correct. 1) Log in to the azure portal. 2) Go to New > Networking > Virtual Network

3) Then click on create

4) In next page, it will open up the wizard with the VNet information. In their fill the information to match with your configuration.

Name: Name for the VNet

Address Space: IP range for the VNet. If you have multiple Address ranges, it can add later

Subnet name: Name for the subnet you like to add

Subnet Address range: Subnet IP range (it must be within the Address Space listed before)

Resource Group: Can create new group or select existing group

Location: location of the VNet

After that click on create to continue

5) Once VNet created, can modify the address ranges and subnets

Create Gateway Subnet

Next step is to create gateway subnet for the VNet. It is recommended to use /28 or /27 for gateway subnet. This need to be done before connecting VNet to the gateway.

1) Log in to the Azure Portal

2) Then go to More Services > Virtual Networks

3) Then click on the VNet, created on previous step and click on subnets. Then click on gateway subnet

4) In the next window define the subnet for the gateway and click OK

Create Virtual Network Gateway

Next step is to create virtual network gateway.

1) Log in to azure portal

2) Go to New > Networking > Virtual Network Gateway

3) In next window fill the relevant information and click on Create

Name: Name for the virtual network gateway

Gateway Type: For our VPN it will be VPN

VPN Type: Type of the VPN and regular VPN will be route-based

SKU: SKU for the VPN type

Virtual Network: Select the VNet you have created following previous step

Public IP Address: VPN need to have public IP address. Select public IP from here or if you don't have, once you click on the option it will allow you to add new one

Location: Select the correct region to match with VNet region

4) It can take up to 45 minutes to complete the task. Once it's done can see the public IP address details. You need this to configure the VPN device in yours on premises device

Create Local Network Gateway

The next step is to create local gateway which represent your local network. To create it,

1) Log in to azure portal

2) Go to New > Networking > Local network gateway

3) Then it will open new wizard and fill the relevant information. After that click on create to proceed

Name: Name for the local gateway

IP Address: Public IP address to represent your VPN device. It should not behind NAT

Address Space: This is yours on premises address ranges. You can add multiple ranges.

Resource Group: Create new resource group or use the same one you were using

Create Site-to-Site VPN

Then next step is to create Site-to-Site VPN connection between your VPN device and the virtual network gateway. To create it,

1) Log in to azure portal

2) Go to More Services > Virtual network gateways

3) Then click on the virtual network gateway you created and, under the settings tab, click on connection

4) Then click on add

5) In the wizard fill the relevant information and click ok.

Name: Name of the connection

Connection Type: Type of the VPN. Most of the time its site-to-site

Virtual Network Gateway: Select the relevant virtual network gateway

Local Network Gateway: Select the relevant local network gateway for your connection

Shared Key: This is the pre-shared key you going to use for the VPN configuration

6) Once created its all about configuring the VPN in your VPN device

7) Once connected you can see the status in same page by clicking on connection

Tackling the Dragon – Converting a Java Based Game to Universal Windows Platform

Anthony Bartolo — Wed, 21 Jun 2017 07:00:53 GMT

Ragnarök is Nigh. Hamilton Ontario based Thrive games have been working on their lead game, Dragon of Legends for sometime with aspirations of delivering their game to the Steam platform. The game uncovers countless mysteries of the past as players battle across platforms in a vibrant 2D world inspired by Celtic and Norse mythology. Our team recently met with the team at Thrive games as they also had expressed interest in having their proprietary game engine utilized on multiple platforms (PC, OSX, Linux, iOS and Android) in order to stay committed to making our game accessible to everyone. The Java app platform has been the platform of choice for the team at Thrive Games to architect their Norse tale to share with the world. While Java games could easily be deployed on Steam, the team was looking for a way to offer Dragon of Legends on other platforms without incurring long development cycles. Being a Kickstarter funded start-up, Thrive Games needed a cost-effective way to reach gamers on other platforms like Windows. In a collaborative effort, our teams came together to futher the time Thrive games had invested building the proprietary game engine and graphics on Java to be enjoyed on the Universal Windows Platform via a multitude of Windows based devices. The following was required to be completed to accomplish this:

Convert the JAR file to a non-dependant package file to be converted
Convert the created Win32 application to a UWP app
Submit the completed UWP game to the Windows Marketplace

In addition to the above core goals, the team's stretch goal was to complete the conversation of the Dragon of Legends UWP game in a span of 1 day. Led by Technical Evangelist Mickey MacDonald, the team's 1st task was to build the JAR package file from the libGDX game engine's output using Gradle. To do this the team ran Gradle from the command line with the command: gradlew desktop:dist Next the team preformed a few steps to obfuscate the project to help protect the game assets and code from being extracted from the final release. This was accomplished by using ProGuard, and performing the following steps:

Construct a config file (config.pro) file. This file lists all the classes, fields, and methods, that need to be kept and/or that their names need to be keptNOTE: Refer to https://www.guardsquare.com/en/proguard/manual/ for more details on how this is accomplished
Once the config file is created, the team ran ProGuard from the command line, using the command: java -jar proguard.jar @config.pro

Once the obfuscating process had completed we then had a JAR package that could be used for release. The next step was to the create a Win32 executable application. This was completed by using cross-platform Java executable wrapper Launch4j. This wrapper allows a packaged Java application to be run just like a native Win32 application, packaging all dependencies with it, including the JRE (Java Runtime Environment) needed. Image source: http://launch4j.sourceforge.net The steps taken to create the executable in Launch4j are as follows:

Launch Launch4J and make sure you are on the Basic tab
On the Output File* input: Browse for the destination where you want your EXE file to be name via this "desktop/...../ProjectName.exe"
On the Jar* input: Browse and locate the jar file you want to convert in your PC
On the Icon input: Locate your ico file for the icon
Go to the JRE tab
On the Min JRE version input: type in: 1.4.0
Click on the gear icon on the top and press save (destination preferably in output file destination, name - "ProjectName")
Press the Play button next to and the Jar file should be converted to EXE

Once completed, the newly created Win32 executable could now be converted to a UWP application using the Desktop Bridge kit. The conversion process itself was done manually due to the game's lack of installer and the developer’s knowledge of the files needed to operate the game. The following steps were completed to convert the Win32 app to a UWP app manually:

Download and installed the Window 10 Software Development Kit
Create the appxmanifest.xml manually NOTE: detailed steps found here: https://docs.microsoft.com/en-us/windows/uwp/porting/desktop-to-uwp-manual-conversion
Open the Command Prompt in administrator mode
Navigate to C:\Program Files (x86)\Windows Kits\10\bin\x86
Entered the following command: MakeAppx pack /d "Path to Files" /p "Application Name".appx

Creation of the appx package of the game is now completed. The following steps were then completed to certificate sign and install the application on the local machine for testing.

Opened the Command Prompt in administrator mode
Navigate to C:\Program Files (x86)\Windows Kits\10\bin\x86
Create a certificate to sign the appx NOTE: detailed steps found here https://msdn.microsoft.com/en-us/library/windows/desktop/jj835832(v=vs.85).aspx
Use the SignTool to sign the application with the created certificate NOTE: detailed steps found here https://msdn.microsoft.com/en-us/library/windows/desktop/jj835835(v=vs.85).aspx
The certificate is then installed on the testing computer
Double click the appx and install the application

The process of embedding the dependencies, like the JRE in the final build were a challenge. After some careful consideration and research, the team decided on using Launch4j to address this. Launch4j allowed the team to create a lightweight Windows native executable which allowed bundling of the JRE and any other libraries or dependencies without the need to modify any existing code or infrastructure. The team at Thrive is now working on finalizing the game and adding the much-anticipated multi-player features. The plan is conduct a worldwide launch on all platforms in the next few months allowing Norse gods to battle it out on multiple devices. Checkout the Dragon of Legend demo currently live on the Windows Store here: https://www.microsoft.com/store/apps/9plhr65j1pr9

Powershell Basics: Using Variables In ActiveDirectory Filters

MVP Thomas Rayner — Wed, 14 Jun 2017 07:00:11 GMT

When working with the ActiveDirectory PowerShell module, the -filter parameter is sometimes required to search for accounts or objects in Active Directory. Utilization of variables in those filters may also be required to return a needed value. As an example, running the following command from the remote Exchange management shell returns an object that includes a username (called Alias in this example).

$person = (Get-Mailbox ThmsRynr).Alias

While this value was easy to find (as it currently the only entry in the test directory) the next example will show how to pull the value using a filter.

Get-AdUser -Filter "SamAccountName -eq $person"

However this method would result in the following error:

Get-AdUser : Error parsing query: 'SamAccountName -eq ThmsRynr' Error Message: 'syntax error' at position: '20'.
At line:1 char:1
+ Get-AdUser -Filter "SamAccountName -eq $person"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : ParserError: (:) [Get-ADUser], ADFilterParsingException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingException,Microsoft.ActiveDirectory.Management.Commands.GetADUser

This is because the filter can’t handle the variable in that context. The filter needs to be wrapped in curly braces in order to use a variable in an ActiveDirectory cmdlet filter.

Get-AdUser -Filter {SamAccountName -eq $person}

This will provide the following results:

DistinguishedName : CN=Thomas Rayner,OU=Users,DC=lab,DC=workingsysadmin,DC=com
Enabled           : True
GivenName         : Thomas
Name              : Thomas Rayner
ObjectClass       : user
ObjectGUID        : 
SamAccountName    : TFRayner
SID               : 
Surname           : Rayner
UserPrincipalName : ThmsRynr@outlook.com

Adding the curly braces will now allow the filter to operate as needed.

Augmenting Image Metadata with Cognitive Services

Anthony Bartolo — Wed, 07 Jun 2017 11:00:00 GMT

Hello Folks, This week, the team from Microsoft Canada has partnered with 4 startup teams at Communitech, an industry-led Waterloo Ontario based innovation centre that supports and fosters a community of nearly 1,000 tech companies, to incorporate Microsoft Cognitive Services into their offerings. While I am unfortunately unable to be there, I wanted to share my experience in helping another startup do the same. Last Month we partnered with a local startup to create a solution to address the ever-growing problem we all have. How do we categorize and index all our digital pictures in such a way that we can search and retrieve based on picture content and not just based on date taken or location. The Kwilt team is based out of Invest Ottawa. They are a startup with high-level goals for their applications, they currently have several apps to manage how people interact with their photos. Their products are:

They’ve created an application that helps navigate the sea of photos located in social, cloud and messaging accounts. This is completed in a manner that is seamless to the end user as all the search work is completed through the Kwilt app. In a Mobile App and on the web. During the project, we leveraged Azure Cognitive Services to augment the capabilities of the app. We introduced capabilities that will assist users facing the challenge of “tagging” all their photos to allow for more accurate searches. Capabilities that will address users mistyping tags that would result in no or wrong photos found. Address accents and special characters for search. i.e.: Montreal ≠ Montréal and more… Technologies used in this project:

Azure Storage
Azure Functions
Microsoft Cognitive Services
Computer Vision API
Azure Cosmos DB (formerly DocumentDB)
Azure Search

Here is how we get this done! And by the way the code we used is available here.

Ingest and Analyze

Ingesting all the data from Kwilt database in Azure Cognitive Services allows the service to automatically tag photos, and eliminating the need for manual user input. We started by building a robust/efficient workflow to push data from the Kwilt backend database to Azure in order to facilitate analysis by leveraging Cognitive Services. You can test the capabilities of the service yourselves. First the data is received from the Kwilt backend into an Azure Storage Queue. The process to feed the queue is a proprietary PHP script/process that extract new entries in the Kwilt database, converts them into a JSON format and sends them to the Azure Storage Queue using the Azure Storage PHP SDK to send messages to the configured Storage Account & Key. Here is a sample message that is being stored in the queues.

{
    "sorting_time": "2015-06-07 22:50:36",
    "type": "image",
    "id": 68682364,
    "name": "010309_0800_6154_nals",
    "created_time": "2015-06-08 05:50:36",
    "width": 919,
    "height": 602,
    "mime_type": "image/jpeg",
    "size": 576761,
    "time_taken": "2015-06-07 22:50:36",
    "modified_time": "2015-06-08 05:50:38",
    "source_url": "https://farm1.staticflickr.com/333/18585231402_798c4247fe_o.jpg",
    "recent_time": "2015-06-07 22:50:36",
    "thumbnail_url": "https://farm1.staticflickr.com/333/18585231402_eac0b3fe77_z.jpg"
}

Once the Message is in the queue it triggered the Azure function. (below is a screen capture of the Azure Function configuration.) Once the data is in the queue for analysis, we leverage Azure Functions to send the info to Cognitive Services to analyze the image. Of course, since we want to utilize proper DevOps practices we have configured Azure Functions for continuous integration from a Github repository setup for the various functions.

var https = require('https');

module.exports = function (context, message) {
  logInfo(context, 'Analyzing Image Id: ' + message.id)
  logVerbose(context, 'Queue Message:\n' + JSON.stringify(message));

  // Validate Configuration
  if (!process.env.OcpApimSubscriptionKey) {
    throwError(context, 'Missing Configuration, OcpApimSubscriptionKey not configured in Application Settings.');
  }

  // Validate Message
  if (!message.thumbnail_url) {
    throwError(context, 'Invalid Message, thumbnail_url missing.');
  }

  // Define Vision API options
  var options = {
    host: 'westus.api.cognitive.microsoft.com',
    port: 443,
    path: '/vision/v1.0/analyze?visualFeatures=Categories,Tags,Description,Faces,ImageType,Color,Adult&details=&language=en',
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'Ocp-Apim-Subscription-Key': process.env.OcpApimSubscriptionKey
    }
  };

  logVerbose(context, 'Thumbnail Url: ' + message.thumbnail_url);

  var req = https.request(options, function (res) {
    res.setEncoding('utf8');

    res.on('data', function (data) {
      logVerbose(context, 'Vision API Response\n' + data);

      var visionData = JSON.parse(data);

      // Was the image successfully processed
      switch (res.statusCode) {
        case 200: // Sucess
          updateFileMetaData(message, visionData);
          break;
        case 400: // Error processing image
          var errorMessage = visionData.message ? visionData.message : "Unknown error processing image";
          logInfo(context, errorMessage);
          updateFileMetaData(message, null, visionData);
          break;
        case 403: // Out of call volume quota
          context.done(new Error('Out of cal volume quota'));
          return;
        case 429: // Rate limit is exceeded
          context.done(new Error('Rate limit is exceeded'));
          return;
      }

      // Set the object to be stored in Document DB
      context.bindings.outputDocument = JSON.stringify(message);

      context.done();
    });
  });

  req.on('error', function (e) {
    logVerbose(context, 'Vision API Error\n' + JSON.stringify(e));
    throwError(context, e.message);
  });

  // write data to request body
  var data = {
    url: message.thumbnail_url
  };

  req.write(JSON.stringify(data));
  req.end();
};


function updateFileMetaData(message, visionData, error) {
  // Document DB requires ID to be a string
  // Convert message id to string
  message.id = message.id + '';

  // Keep a record of the raw/unedited Vision data
  message['azure_vision_data'] = {
    timestamp: new Date().toISOString().replace(/T/, ' ').replace(/\..+/, ''),
    data: visionData,
    error: error
  };

  if (visionData) {
    // Flatten/append vision data to the file object
    message['isAdultContent'] = visionData.adult.isAdultContent;
    message['isRacyContent'] = visionData.adult.isRacyContent;
    message['auto_tags'] = extractConfidenceList(visionData.tags, 'name', 0.1);
    message['auto_categories'] = visionData.categories ? extractConfidenceList(visionData.categories, 'name', 0.1) : [];
    message['auto_captions'] = extractConfidenceList(visionData.description.captions, 'text', 0.1);
    message['auto_description_tags'] = visionData.description.tags;
    message['auto_dominantColorForeground'] = visionData.color.dominantColorForeground;
    message['auto_dominantColorBackground'] = visionData.color.dominantColorBackground;
    message['auto_accentColor'] = visionData.color.accentColor;
    message['auto_isBWImg'] = visionData.color.isBWImg;
    message['auto_clipArtType'] = visionData.imageType.clipArtType;
    message['auto_lineDrawingType'] = visionData.imageType.lineDrawingType;
  }

  // Convert existing tags field from comma seperated string to array
  if (message.tags && typeof message.tags === 'string') {
    message.tags = message.tags.split(',');
  } else {
    message.tags = [];
  }

  // Azure Search requires location to be a single field
  if (message.latitude && typeof message.latitude === 'number') {
    message['location'] = {
      type: 'Point',
      coordinates: [message.longitude, message.latitude]
    }
  }
}

function throwError(context, message) {
  logVerbose(context, 'Error: ' + message);
  throw new Error(message);
}

function logInfo(context, message) {
  context.log('+[Info] ' + message);

}

function logVerbose(context, message) {
  if (process.env.VerboseLogging) {
    context.log('![Verbose] ' + message);
  }
}

// Extracts a list of values by field from an array of objects
// where the confidence value is greater than or equal to the
// optional minConfidenceValue.
function extractConfidenceList(objArray, field, minConfidenceValue) {
  if (Object.prototype.toString.call(objArray) !== '[object Array]') {
    throw new Error("objArray (type: " + Object.prototype.toString.call(objArray) + ") in extractConfidenceList is not an array.");
  }

  if (!field || typeof field !== 'string') {
    throw new Error("field in extractConfidenceList is missing or not an string.");
  }

  // If not min confidence value specified or value is undefined set to 0
  if (!minConfidenceValue) { minConfidenceValue = 0; }

  var list = new Array();

  objArray.forEach(function (obj) {
    // Do we need to do a confidence check?
    if (minConfidenceValue > 0 && typeof obj['confidence'] === 'number') {
      // Is confidence >= min required?
      if (obj['confidence'] >= minConfidenceValue) {
        list.push(obj[field]);
      }
    }
    else {
      // No check needed push field into array
      list.push(obj[field]);
    }
  });

  return list;
}

Analysis of the images (visual features & details) is configured in the function when the Vision API HTTP API call options are defined.

// Define Vision API options
  var options = {
    host: 'westus.api.cognitive.microsoft.com',
    port: 443,
    path: '/vision/v1.0/analyze?visualFeatures=Categories,Tags,Description,Faces,ImageType,Color,Adult&details=&language=en',
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'Ocp-Apim-Subscription-Key': process.env.OcpApimSubscriptionKey
    }
  };

In this case the following features were configured in English (only English and Chinese are available for the API):

Categories- categorizes image content according to a taxonomy defined in documentation.
Tags- tags the image with a detailed list of words related to the image content.
Description- describes the image content with a complete English sentence.
Faces- detects if faces are present. If present, generate coordinates, gender and age.
ImageType- detects if image is clipart or a line drawing.
Color- determines the accent color, dominant color, and whether an image is black&white.
Adult- detects if the image is pornographic in nature (depicts nudity or a sex act). Sexually suggestive content is also detected.

Once the analysis is complete the resulting JSON message is stored in Cosmos DB. Here is the result the processing of the following image: The following is the result of the analysis:

{
	"sorting_time": "2016-06-19 15:59:58",
	"type": "image",
	"id": "68772289",
	"name": "Photo Jun 19, 15 59 58.jpg",
	"created_time": "2016-07-28 15:54:59",
	"modified_time": "2016-07-28 15:55:16",
	"size": 2289041,
	"mime_type": "image/jpeg",
	"latitude": 46.8124,
	"longitude": -71.2038,
	"geoname_id": 6325494,
	"city": "Québec",
	"state": "Quebec",
	"state_code": "QC",
	"country": "Canada",
	"country_code": "CA",
	"time_taken": "2016-06-19 15:59:58",
	"height": 3264,
	"width": 2448,
	"thumbnail_url": "",
	"recent_time": "2016-06-19 15:59:58",
	"tags": [
		"town",
		"property",
		"road",
		"neighbourhood",
		"residential area",
		"street"
	],
	"account_id": 111193,
	"storage_provider_id": 105156,
	"altitude": 53,
	"camera_make": "Apple",
	"camera_model": "iPhone 6",
	"azure_vision_data": {
		"timestamp": "2017-03-29 15:59:55",
		"data": {
			"categories": [
				{
					"name": "outdoor_street",
					"score": 0.96484375
				}
			],
			"adult": {
				"isAdultContent": false,
				"isRacyContent": false,
				"adultScore": 0.007973744533956051,
				"racyScore": 0.010262854397296906
			},
			"tags": [
				{
					"name": "outdoor",
					"confidence": 0.9993922710418701
				},
				{
					"name": "sky",
					"confidence": 0.9988007545471191
				},
				{
					"name": "building",
					"confidence": 0.9975806474685669
				},
				{
					"name": "street",
					"confidence": 0.9493720531463623
				},
				{
					"name": "walking",
					"confidence": 0.9154794812202454
				},
				{
					"name": "sidewalk",
					"confidence": 0.8519290685653687
				},
				{
					"name": "people",
					"confidence": 0.7953380942344666
				},
				{
					"name": "way",
					"confidence": 0.7908639311790466
				},
				{
					"name": "scene",
					"confidence": 0.7276134490966797
				},
				{
					"name": "city",
					"confidence": 0.624116063117981
				}
			],
			"description": {
				"tags": [
					"outdoor",
					"building",
					"street",
					"walking",
					"sidewalk",
					"people",
					"road",
					"city",
					"narrow",
					"bicycle",
					"man",
					"group",
					"woman",
					"standing",
					"old",
					"pedestrians",
					"holding",
					"platform",
					"parked",
					"carriage",
					"riding",
					"train",
					"clock"
				],
				"captions": [
					{
						"text": "a group of people walking down a narrow street",
						"confidence": 0.8872056096672615
					}
				]
			},
			"requestId": "38fa30e6-2a50-4a7f-b780-e6472c6d1a52",
			"metadata": {
				"width": 600,
				"height": 800,
				"format": "Jpeg"
			},
			"faces": [],
			"color": {
				"dominantColorForeground": "Grey",
				"dominantColorBackground": "Grey",
				"dominantColors": [
					"Grey",
					"White"
				],
				"accentColor": "2C759F",
				"isBWImg": false
			},
			"imageType": {
				"clipArtType": 0,
				"lineDrawingType": 0
			}
		}
	},
	"isAdultContent": false,
	"isRacyContent": false,
	"auto_tags": [
		"outdoor",
		"sky",
		"building",
		"street",
		"walking",
		"sidewalk",
		"people",
		"way",
		"scene",
		"city"
	],
	"auto_categories": [
		"outdoor_street"
	],
	"auto_captions": [
		"a group of people walking down a narrow street"
	],
	"auto_description_tags": [
		"outdoor",
		"building",
		"street",
		"walking",
		"sidewalk",
		"people",
		"road",
		"city",
		"narrow",
		"bicycle",
		"man",
		"group",
		"woman",
		"standing",
		"old",
		"pedestrians",
		"holding",
		"platform",
		"parked",
		"carriage",
		"riding",
		"train",
		"clock"
	],
	"auto_dominantColorForeground": "Grey",
	"auto_dominantColorBackground": "Grey",
	"auto_accentColor": "2C759F",
	"auto_isBWImg": false,
	"auto_clipArtType": 0,
	"auto_lineDrawingType": 0,
	"location": {
		"type": "Point",
		"coordinates": [
			-71.2038,
			46.8124
		]
	}
}

Once this analysis is stored in the Cosmos DB it can be indexed and searched using Azure Search. as you can see in the following screen captures The Kwilt Team was able to digest the analysis and with Azure Search to build an extremely user friendly search proposition for their users. In the project beta client we were able to search by keywords (Food, Plates, Fireworks…) and by location (Gatineau) without any manual tagging of the pictures. All I can say is that i cannot wait to process my own photo streams through this service. I’ve already installed the app on my phone. Take the opportunity to test out Microsoft Cognitive Services in your own initiatives by visiting: https://azure.microsoft.com/en-ca/services/cognitive-services/ Cheers!! Pierre Roman @pierreroman