PowerInTheShell https://docs.microsoft.com/archive/blogs/daviddasneves/feed.xml Powershell and Windows 10. Coding, Security and many more by David das Neves, PFE MSFT Thu, 26 Jul 2018 19:13:29 GMT en-US hourly 1 ($this.Career.CurrentChapter).Close() https://docs.microsoft.com/archive/blogs/daviddasneves/this-career-currentchapter-close Wed, 09 May 2018 20:55:40 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=2575 Hello together, today is my last day at Microsoft. On the one hand, I am very excited about the upcoming time and my next chapter, but on the other hand I am looking back to 2.5 years full of impressive experiences and learnings.  

The Past

I have been speaking at many conferences, delivered many workshops, discussed complex topics with IT teams, IT managers and even CIOs and it has been such a great experience. Just take a look at my fancy laptop - these are only some of the stickers I gathered over the time. We together travelled probably more than 30.000 miles around the world!

Thank you

I want to say a big 'Thank you' to all the readers of the blog articles. It has been a lot of work putting them together, but seeing all the great feedback and all the mails or LinkedIn messages I retrieved over the years, which encouraged me to continue or just contained a small 'thank you' message, have been payment enough.

What´s next?

In my next chapter I will do a complete reset. My new topics will contain: Cloud, AI, IoT, Big Data and many things more, and I am more than excited to take this new challenge and learn more great things!  

You know - the real knowledge today is the passion to always keep learning!

 

The blog?

The blog will continue to live, but I will not be able to make any changes to it.  

But never forget: IT is just like a small family, and you always meet twice in life! ;)

  All the best, David das Neves
]]> Still struggling with Windows as a Service? https://docs.microsoft.com/archive/blogs/daviddasneves/still-struggling-with-windows-as-a-service Thu, 03 May 2018 08:50:01 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=2585 The complete PowerPoint slides are shared below.
Hello together, I am still seeing a lot of customers who haven´t even started their migration to Windows 10 yet.

Guys! You are too late!

Even if you plan to be ready end of 2019, you will find some exceptions at the very end. This is IT - in IT we always work with buffers. The first 90% are easy and the last 10% will need more than double the time / resources / headaches.
Nowadays, learning just about all the built-in security features and getting an overview on all of them is an extensive task. In addition, I am also seeing a lot of customers having some problems with the continuous updates. Typical errors:
  • Waiting too long
  • Allowing too many different versions in the field (2+)
  • Not planning for the following inplace updates
  • Not having a dedicated process defined for preparing new builds
WaaS is a challenge - I never said that this is an easy task. You need to adopt many principles from the DevOps area. WaaS, actually, has a lot of similarities to Continuous Deployment. So the typical errors, which will bring CD to fail, will also bring WaaS to fail - like having no metrics and not having defined what WaaS means for the teams and your whole company!  

So, let´s give you the most important information - one more time.

 

You need to have an overview on the technical security features and prioritize them.

Take a look here and here (area Security)

Define the tools you want to use in short-term, but also in the long-term perspective!

The Windows 10 Link List contains all the information for you! https://aka.ms/W10Links

Define the processes which you are going to use for the upcoming updates!

Take a read here and here

PowerPoint Slides

And for everything else - like persuading or explaining this topic to your boss and colleagues - I added my complete PowerPoint slides for this topic. They were created with customer feedback and have been improved over the last years. I have customers in different phases working with this approach. From 'just started' up to 'doing the fine-tuning'. The content of the slides is very often held as a theoretical approach - but it isn´t. It works for many customers and I want to quote one of them:

"Working with this approach makes the Feature Update to a just little more complex Quality Update. You prepare it with checklists and start deploying this to your collections with increasing numbers. If something breaks, you stop, fix and finally continue. Easy."

PowerPoint Slides

  Hope this helps. All the best,
David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]> Prioritize all the Security Controls! https://docs.microsoft.com/archive/blogs/daviddasneves/prioritize-all-the-security-controls Wed, 25 Apr 2018 21:14:43 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=2355 Julien Reisdorffer (@JReisdorffer) just after the fantastic PowerShell Conference Europe. Nearly one year passed since I have written a comprehensive summary around PowerShell Security, which you can find here: https://aka.ms/PSSecEnt As you can recognize by only taking a look at the length of this article, there are many security controls which need to be known and configured. But the problem for most admins is 'Where to start and where to end?'. Therefore, Julien and I have been working on this project. You can find the material of our talk in the official Github of the PSConfEU2018 here and the video in the official Youtube channel here (will follow asap).

Introduction - the Challenge:

Let us start with a short introduction. Unfortunately, many customer still think of PowerShell as this: Due to this thought we encounter also some other interesting feedback from the field. Here are probably our best catches till today: * Bundesamt für Sicherheit, Federation of Information Security (Germany) Someone could call this funny, though professionally speaking this is more than sad. Sure - there are some challenges which come around PowerShell Security: There is an extreme high number of technical security controls, which need to be validated. They itself have a lot of dependencies to each other or some to other technical implementations. In addition, with Windows as a Service, there is also a continuous movement in these security controls - speaking of frequently adjusted or new technical security controls arriving every half a year and raising the whole complexity. This complexity is also combined with the following challenges on-site:

And - What is the final result of this?

Well - what do you think? Customers are facing this problems on top of the Windows 10 migration, which in addition comes along with Windows as a Service. Therefore, most of our customers completely ignore the topics around PowerShell Security. But this is not only true for the topic PowerShell Security. Customers are also very often misled into complete wrong directions like pushing all their resources into centralized logging without really taking value out of it. The idea is simple - we need a tool to give the customer a recommendation, where they should invest time, resources and money in. In detail - on what should you focus first, because it is
  • of a very high importance
  • brings a good mitigation and can be implemented fast
  • is a preleminary, necessary requirement for other controls
As with every very complex topic you start simple and make sure that your solution is dynamically extendable. We will need to add more and more complexity to it. Therefore, the initial steps are of very high importance, and sometimes you have even to just restart your idea from scratch. Did this also happen to us? Sure it did. We started first with an idea: The first challenge were Technical Security controls. As going forward we decided to do a brainstorming and clustering into topics and adding dependencies to it. We started simple with the following first three topics:
  • PowerShell
  • Moderizing Environment
  • Securing Privileged Access 
Next, we added all the Technical Security Controls to it. This was easy by using a SmartArt and resulted for the first shot in this graph:   Good - this kind of graphs we had actually also before in my blog article from past year. Now it was time to extend the security controls with additional properties to finally make them filterable by any mean.

Classification of the Technical Security Controls

So, we created a high-level specification, what properties could be relevant in the long-term perspective and ended up with this smart-art. Here we added three important properties:
  • Costs - How many sales costs in Dollar does the project or technology cost.
    • between 1 - 100; 100 is very expensive
  • Effort - How many time and resources will it consume.
    • between 1 - 100; 100 is a high resource and time consumption
  • Mitigation - What is the mitigation value
    • between 1-100; 100 is a very good mitigation or benefit
Out of these three values we can now easily calculate a priority factor:
  • Costs * Effort * (101-Mitigation) = Priority
    • between 1-1000000; 1 is the highest priority
  Looks good? Not bad - yes. But we thought that this is a very subjective validation. First, we wanted to visualize the data in a graph and make some calculations with it. As you can see in the table, we also just added the property 'done' with Boolean values.

Working with the Graph

We made use of Neo4j and worked together with the PowerShell module ImportExcel (https://github.com/dfinke/ImportExcel) and PSNeo4j (https://github.com/RamblingCookieMonster/PSNeo4j). We also created a very small function to retrieve the data from the excel tables, which are included in different worksheets. Out of this data, we created new nodes in the Neo4j of type 'Topic' and 'TechnicalSecurityControl' and also the regarding relationships between these nodes. In addition, we added the types (Prevention, Detection, Respond) to the graph and their relationships: After finishing these easy tasks, we had our first visualisation ready and going:

What can you now do with our first implementation?

You can fill up your implemented technical security controls and filling also  the 'done' property and afterwards use the following filters to retrieve your personal prioritization list: As a result, you will get a similar list as this one, which is sorted on the CalculatedValue attribute: So far - not bad, but we have just started this project. We now recognized that the graph has much more potential and therefore we will need to completely restructure our data.

And what are our next goals?

We want to clean up the data a little bit more and extend it with complexity - adding network and forensic analysis etc. In addition, we will add some more models to it, making the connections between them and adding algorithms underneath to make this prioritization list a little more objective. But we also plan to add more automation into the graph itself and possibly work with some models out of the Machine Learning area to retrieve more information and use-cases for it. We have some great plans - don´t miss it!

Call to Action!

Here is now what you have to do. Yes - exactly - you! Try to prioritize your current security controls and if you missed some of the high prioritized controls, implement them asap.

General Recommendation

And last, but not least - here are some recommendations, which you should always implement: Thank you very much for reading. We will continue to work on this project with high ambition and stay tuned.   All the best,
David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security    
Julien Reisdorffer Sr. Consultant, EMEA, Germany Global Cybersecurity Practice  ]]> The Windows 10 Link List https://docs.microsoft.com/archive/blogs/daviddasneves/w10links Thu, 01 Feb 2018 18:11:16 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=1976 This page can be called with the short link:  https://aka.ms/w10links

Blue marked links are very important.

Green marked links are very new or contain new content.

  edited: 25.07.2018 - added links
  Hi all, I created some time ago a link list of the most interesting links around Windows 10, which I also gave out to my customers as a Word-document. As you might think, this list needed continuous updates. Therefore, I am now sharing this list here to keep it continuously up to date and share it with everyone.  

Everything in here is a must-read or must-know reference. 

  Information for next releases - you should keep an eye on these links with the upcoming Feature Updates. Here you will find the most important information for the next Feature Updates and  Quality Updates in a consolidated way:   Microsoft FastTrack We’re a team designed to help IT professionals and partners get the tools, resources, and guidance needed to move to Microsoft 365, Azure, and Dynamics 365 with confidence. That means helping you discover what’s possible, create a plan for success, and onboard new users and capabilities at a flexible pace. https://fasttrack.microsoft.com/ Windows 10 Lifecycle (end of services) https://aka.ms/w10lifecycle Windows 10 Roadmap https://aka.ms/win10rm/ Michael Niehaus Blog https://blogs.technet.microsoft.com/mniehaus/ Microsoft Edge Blog https://blogs.windows.com/msedgedev/ Configuration Manager Blog https://aka.ms/cmblog/

Configuration Manager OSD Support Team Blog https://aka.ms/osdsupportteam

Changes to Office and Windows servicing and support https://aka.ms/win10supplemental/ Windows 10 Deployment (Download also the deployment resources from this page.) https://aka.ms/win10deployment/ Windows Features List - Pro vs. E3 vs. E5 https://www.microsoft.com/en-us/WindowsForBusiness/Compare  

Windows as a Service

Windows as a Service - IT Pro resources https://aka.ms/WaaSITPro/  

Technical

Overview of flighting rings https://docs.microsoft.com/en-us/windows-insider/flight-hub/

Top ten reasons to use Windows 10 Current Branch (now SAC) vs. Long Term Servicing Branch (now LTSC) https://myignite.microsoft.com/sessions/56635

Official Documentation https://aka.ms/WaaS/ Insider Preview https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewadvanced Manage WaaS using SCCM https://docs.microsoft.com/en-us/sccm/osd/deploy-use/manage-windows-as-a-service Branch Cache vs Peer Cache https://blogs.technet.microsoft.com/swisspfe/2018/01/25/branch-cache-vs-peer-cache/ Delivery Optimization https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization

Use Delivery Optimization with DHCP Option on Pre-Windows 10 version 1803 https://oliverkieselbach.com/2018/02/24/use-delivery-optimization-with-dhcp-option-on-pre-windows-10-version-1803/

Optimize Windows 10 update delivery https://docs.microsoft.com/en-us/windows/deployment/update/waas-optimize-windows-10-updates

Configure Delivery Optimization in SCCM Task Sequence https://www.systemcenterdudes.com/configure-delivery-optimization-in-sccm-task-sequence/

Demystifying “Dual Scan” https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/

Dual Scan disabled - SUP WSUS https://blogs.technet.microsoft.com/swisspfe/2018/04/13/win10-updates-store-gpos-dualscandisabled-sup-wsus/

Improving Dual Scan on 1607 https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/

Using ConfigMgr With Windows 10 WUfB Deferral Policies https://blogs.technet.microsoft.com/configurationmgr/2017/10/10/using-configmgr-with-windows-10-wufb-deferral-policies/

SCCM Support-matrix for 1709: https://docs.microsoft.com/en-us/sccm/core/plan-design/configs/support-for-windows-10#windows-10-as-a-client WSUS Maintenance https://blogs.technet.microsoft.com/configurationmgr/2016/01/26/the-complete-guide-to-microsoft-wsus-and-configuration-manager-sup-maintenance/ Proxy Requirement for Windows Update https://support.microsoft.com/en-us/help/3175743/proxy-requirements-for-windows-update

About the service connection point in System Center Configuration Manager https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/about-the-service-connection-point

Use the Service Connection Tool for System Center Configuration Manager https://docs.microsoft.com/en-us/sccm/core/servers/manage/use-the-service-connection-tool

Windows 10 Compatibility Check Using SCCM and Report https://www.systemcenterdudes.com/sccm-windows-10-compatibility-check/

Windows 10 Updates – Order from the Chaos https://sunbehindtheclouds.com/2018/03/27/windows-10-updates-order-from-the-chaos/ SetupDiag.exe is a standalone diagnostic tool to debug Windows 10 upgrades. https://docs.microsoft.com/en-us/windows/deployment/upgrade/setupdiag Stop hurting yourself by: Not updating the drivers and firmware in Windows and Windows Server. https://blogs.technet.microsoft.com/yongrhee/2018/03/20/stop-hurting-yourself-by-not-updating-the-drivers-and-firmwares-in-windows-and-windows-server/  

Procedural

My very long blog articles: https://blogs.msdn.microsoft.com/daviddasneves/2017/12/05/stability-and-change-why-waas/ https://blogs.msdn.microsoft.com/daviddasneves/2017/08/12/automating-windows-as-a-service/ https://blogs.msdn.microsoft.com/daviddasneves/2017/06/18/demystifying-windows-as-a-service-wake-up-please/ Moving from project to process: digital transformation with Windows as a service Moving from project to process  

Windows 10 Technical

Hardware

Standards for a highly secure Windows 10 device https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure Secure Boot Requirements https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot UEFI Requirements https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-uefi Virtualization Based Security https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs CPU Requirements: https://docs.microsoft.com/en-us/windows-hardware/design/minimum/windows-processor-requirements  

Telemetry

Configure Windows diagnostic data in your organization https://docs.microsoft.com/en-us/windows/configuration/configure-windows-diagnostic-data-in-your-organization

Windows 10, version 1709 basic level Windows diagnostic events and fields https://docs.microsoft.com/en-us/windows/configuration/basic-level-windows-diagnostic-events-and-fields Telemetry in Detail https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services Blog Telemetry https://blogs.windows.com/windowsexperience/2017/04/05/windows-10-privacy-journey-continues-more-transparency-and-controls-for-you/ Diagnostic Data Viewer https://docs.microsoft.com/en-us/windows/configuration/diagnostic-data-viewer-overview Windows 10 diagnostic data for the Full diagnostic data level https://docs.microsoft.com/en-us/windows/configuration/windows-diagnostic-data-1703 Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics https://docs.microsoft.com/en-us/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields Privacy Dashboard https://account.microsoft.com/account/privacy

Safeguard individual privacy with the Microsoft Cloud https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/default.aspx

Beginning your General Data Protection Regulation (GDPR) journey for Windows 10 https://docs.microsoft.com/en-us/windows/configuration/gdpr-win10-whitepaper

 

Internals and GPOs

Inplace Upgrade Troubleshooting https://technet.microsoft.com/en-us/itpro/windows/deploy/resolve-windows-10-upgrade-errors Understand the different apps included in Windows 10 (which ones can be deleted and whoch ones should NOT) https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10

Removing Windows 10 in-box apps during a task sequence https://aka.ms/removeapps/

Known issues managing a Windows 10 Group Policy client in Windows Server 2012 R2 https://support.microsoft.com/en-us/help/4015786/known-issues-managing-a-windows-10-group-policy-client-in-windows-serv

Group Policy settings that apply only to Windows 10 Enterprise and Education Editions https://docs.microsoft.com/en-us/windows/client-management/group-policies-for-enterprise-and-education-editions

Group Policy settings that apply only to Windows 10 Enterprise and Education Editions https://aka.ms/enterpriseonly/

Customize Windows 10 Start and taskbar with Group Policy https://docs.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-group-policy

Download and install the Windows ADK https://aka.ms/win10adk/

Windows ADK for Windows 10 scenarios for IT Pros https://docs.microsoft.com/en-us/windows/deployment/windows-adk-scenarios-for-it-pros

Recovery components https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/recovery-strategy-for-common-customizations

Introduction to UWP app design https://docs.microsoft.com/en-us/windows/uwp/design/basics/design-and-ui-intro

The Ultimate Browser Strategy on Windows 10 https://aka.ms/edgevsie/

ADMX Version History https://blogs.technet.microsoft.com/grouppolicy/2016/10/12/admx-version-history/

Making file type associations enterprise ready https://blogs.msdn.microsoft.com/hewagen/making-file-type-associations-enterprise-ready/

Windows 10 Customization using Task Sequences https://www.systemcenterdudes.com/sccm-windows-10-customization/

How to use the Windows 10 Security Baseline https://www.systemcenterdudes.com/how-to-use-the-windows-10-security-baseline/

 

Security

Security Features Overview https://technet.microsoft.com/en-us/itpro/windows/keep-secure/overview-of-threat-mitigations-in-windows-10 Powershell Security https://blogs.msdn.microsoft.com/daviddasneves/2017/05/25/powershell-security-at-enterprise-customers/ Credential Guard https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard#how-it-works Device Guard & Credential Guard Tool https://aka.ms/dgcgtool/ Exploit Guard https://blogs.technet.microsoft.com/mmpc/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ Windows Defender Advanced Threat Protection https://www.microsoft.com/en-us/windowsforbusiness/windows-atp In-Memory Protection https://blogs.technet.microsoft.com/askpfeplat/2017/04/24/windows-10-memory-protection-features/

Types of attacks for volume encryption keys https://docs.microsoft.com/en-us/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys

Microsoft Security Compliance Toolkit https://www.microsoft.com/en-us/download/details.aspx?WT.mc_id=rss_alldownloads_all&id=55319 Pass the Hash Whitepapers https://technet.microsoft.com/en-us/security/dn785092 Detecting Lateral Movement through Tracking Event Logs (must see) https://www.jpcert.or.jp/english/pub/sr/ir_research.html

Choose the right BitLocker countermeasure https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure

Windows 10 and Windows Server 2016 security auditing and monitoring reference https://www.microsoft.com/en-us/download/details.aspx?id=52630

Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI https://aka.ms/weffles

Windows Defender System Guard https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/
 

Modern IT

Microsoft 365 powered device lab kit https://technet.microsoft.com/en-us/windows/mt604890.aspx

Windows AutoPilot https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-10-autopilot https://www.youtube.com/watch?v=4K4hC5NchbE https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-10-autopilot-demo-vm https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-10-autopilot#device-registration-and-oobe-customization https://docs.microsoft.com/en-us/intune/enrollment-autopilot

Windows Information Protection https://blogs.technet.microsoft.com/cbernier/2017/05/19/windows-information-protection-explained-windows-10-creators-update/ https://blogs.technet.microsoft.com/windowsitpro/2016/06/29/introducing-windows-information-protection/ https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure Azure Information Protection https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-information-protection https://www.youtube.com/watch?v=GPe6o0Z2fBM Co-Management for Windows 10 devices https://docs.microsoft.com/en-us/sccm/core/clients/manage/co-management-overview Ignite 2017 – Modern IT with Windows 10 Sessions https://blogs.technet.microsoft.com/ausoemteam/2017/09/10/ignite-2017-modern-it-with-windows-10-sessions/ Store for Business - Landing Page https://aka.ms/msfb/ Windows Store for Business with SCCM https://www.youtube.com/watch?v=VJs-475rfaI

Intune policy settings for Windows 10 devices in Microsoft Intune https://aka.ms/win10uri

 

Microsoft IoT

Windows IoT Developer Site https://windowsondevices.com Windows IoT Core Developer Documentation https://docs.microsoft.com/en-us/windows/iot-core/ Windows IoT Enterprise Developer Documentation https://docs.microsoft.com/en-us/windows/iot-core/windows-iot-enterprise Windows IoT Business Decision Maker (BDM) site https://www.microsoft.com/en-us/WindowsForBusiness/windows-iot  

AppCompat

Windows 10 App Compat Strategy https://blogs.msdn.microsoft.com/cjacks/2016/09/12/windows-10-app-compat-strategy/

Get started with Upgrade Readiness https://docs.microsoft.com/en-us/windows/deployment/upgrade/upgrade-readiness-get-started https://blogs.technet.microsoft.com/UpgradeAnalytics/ https://aka.ms/WinAnalytics

Azure Log Analytics Demo https://portal.loganalytics.io/demo#/discover/home Ready for Windows https://www.readyforwindows.com/
Upgrade Readiness Deployment Script https://aka.ms/uads/
Enterprise Mode SiteList https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list https://www.microsoft.com/en-us/download/details.aspx?id=42501 https://www.systemcenterdudes.com/how-to-use-enterprise-mode-internet-explorer-11/ Windows App Certification Kit https://developer.microsoft.com/en-us/windows/develop/app-certification-kit https://docs.microsoft.com/en-us/windows/uwp/debug-test-perf/windows-app-certification-kit Windows Analytics - New technical content available; decks, draft SDK and device configuration topic https://blogs.technet.microsoft.com/upgradeanalytics/2018/04/03/new-technical-content-available-decks-draft-sdk-and-device-configuration-topic/  

O365 / Office 2016 & AAD

  O365 Roadmap https://products.office.com/en-us/business/office-365-roadmap Alignment of Win10 / Office und SCCM updates https://blogs.windows.com/business/2017/04/20/windows-office-align-feature-release-schedules-benefit-customers/

Overview of the Office 2016 Deployment Tool https://docs.microsoft.com/en-us/DeployOffice/overview-of-the-office-2016-deployment-tool

Azure AD Connect sync: Attributes synchronized to Azure Active Directory https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized

How to setup the Telemetry Dashboard for Office 2016 https://www.systemcenterdudes.com/how-to-setup-telemetry-dashboard-for-office-2016/

Use the Readiness Toolkit to assess application compatibility for Office 365 ProPlus https://docs.microsoft.com/en-us/deployoffice/use-the-readiness-toolkit-to-assess-application-compatibility-for-office-365-pro

Learning

Microsoft Virtual Academy https://mva.microsoft.com/ Free eBooks from Microsoft Press https://mva.microsoft.com/ebooks Microsoft Mechanics Videos (short and very informational videos) https://channel9.msdn.com/Shows/Mechanics Channel 9 DefragTools Videos (Deep Dive Troubleshooting like WinDBG) https://channel9.msdn.com/Shows/Defrag-Tools Hands-On Labs https://www.microsoft.com/handsonlabs/SelfPacedLabs  

Microsoft IT (MSIT) IT showcase whitepapers / technical case studies

Streamlining application compatibility testing at Microsoft https://www.microsoft.com/itshowcase/Article/Content/850/Streamlining-application-compatibility-testing-at-Microsoft Microsoft IT improves LOB application testing, ensuring readiness for Windows (Business case study)  https://www.microsoft.com/itshowcase/Article/Content/519 Microsoft IT prepares LOB apps for Windows (Technical case study)  https://www.microsoft.com/itshowcase/Article/Content/520 Case study at Microsoft IT https://www.microsoft.com/itshowcase/Article/Content/668/Deploying-Windows-10-at-Microsoft-as-an-inplace-upgrade Adopting Windows as a service at Microsoft https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft Deploying Windows 10 at Microsoft as an in-place upgrade https://www.microsoft.com/itshowcase/Article/Content/668/Deploying-Windows-10-at-Microsoft-as-an-inplace-upgrade Managing modern mobile productivity with Enterprise Mobility + Security (EMS) https://www.microsoft.com/itshowcase/Article/Content/972/Managing-modern-mobile-productivity-with-Enterprise-Mobility--Security Implementing strong user authentication with Windows Hello for Business https://www.microsoft.com/itshowcase/Article/Content/756/Implementing-strong-user-authentication-with-Windows-Hello-for-Business Insights in Upgrade Readiness accelerate Windows 10 upgrades https://www.microsoft.com/itshowcase/Article/Content/962/Insights-in-Upgrade-Readiness-accelerate-Windows-10-upgrades Improving reliability with Windows Analytics Device Health https://www.microsoft.com/itshowcase/Article/Content/961/Improving-reliability-with-Windows-Analytics-Device-Health  
Thank you very much for reading / clicking!
    Please share any feedback, if you find dead links or want other important links on the list.   All the best,
    David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>         Stability and Change - Why and How to adopt WaaS. https://docs.microsoft.com/archive/blogs/daviddasneves/stability-and-change-why-waas Tue, 05 Dec 2017 23:28:59 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=1725 current changes in IT, which you really should be aware of:
    • Why is Windows 10 not just a simple operating system as the previous one and why you really should be aware of this.
    • What does Digital Transformation mean and how does Windows 10 come into play?
    • How does Windows as a Service and Modern IT come into play here?
    • How can you adopt Windows as a Service and Windows 10 in a long-term perspective?

    IT Measurement:

    First of all let us think about, how IT performance can be measured. For this I quote the current 'State of DevOps report 2017' (left), as well the report from Forrester 'The Digital Business Imperative' (right):
    Okay let us recap - the left statement surely is directed completely into the DevOps area - especially when building your own tools. The quintessence of the right statement is definitely:"Digitize Your Business Strategy" and not just "to add an app here or a site there". Both statements can be concluded to two very essential points: "Stability" is always tied to IT-performance, because it has ever been one of the most important requirements to IT. You know the sentences like "never touch a running system".  IT just needs to work. But then - why "Change", and what is actually meant with "Change"? When doing your Digital Transformation you want to digitize your business strategy and bring in an effective business value. In a sentence: You want to leverage IT not to just being a cost factor, but to make value out of it.  This is led by bringing in these "Changes" to adopt Modern IT, DevOps, Modern Apps, Everything as a Service and many more. "Change" includes to being up to date, having the most current applications, drivers and OS; to have the possibility to adopt new technologies and services just as they arrive. "Change" also ensures a very secure environment, because you regularly apply patches and updates and also use the current security features. "Change" in this slide is a requirement for all, what it takes to place in the value-leveraging technologies, features and services.  Therefore, the IT gets the requirement to adopt an increasing amount of changes in faster paces, but still ensuring the stability. But what does "stability" actually mean? Historically, it means that you don´t encounter any issues at any time. But in DevOps we know that you have to bring also some additional other aspects into play - like "remediation time". It´s not only about preventing any issues, but being able to remediate occuring issues very fast.

    Windows as a Service

    Now, having this information - let us take the turn over to Windows as a Service, which exactly addresses this all: Windows 10 with its releasing pace of two times per year ensures the most current and completely patched system, which therefore results in an increased security level. In addition, it is continuously delivering new features in terms for security and administration, but is also allowing to adopt new CPU architectures with their features, and leveraging performance and security on a hardware layer. With Edge, the UWP, MDM and MFA Windows  is addressing modern websites, applications and services, which ensures secure authentication and being manageable anywhere on the world just over the Internet. And, because of having a current OS with current technologies in place, you have always the possibility and agility to jump on the Emerging Technologies without long introduction times. In a sentence: Windows 10 is the operating system for Modern IT. 

    Why is Microsoft doing this?

    I have been very often confronted with sentences like 'Why is Microsoft doing this?'. But - is it actually 'us' making the change? Take a look at IT: Development has moved to agile approaches 10 years ago. Every other operating system is having the same approaches some years now, or even since the beginning. We are speaking about DevOps, NoOps, serverless applications and many more. Hackers are improving day by day, leveraging their attacking frameworks with artificial intelligence, and - in fact - as we can see with all the Ransomware attacks going on and being much too successful, the adoption of "Evergreen" seems to be still very bad at our customers. In the same time now, GDPR is getting ready to becoming active and many customers are still figuring out, what GDPR actually means. In fact, we are the very last ones moving our OS on the train of continuously"Change" and it needs to be there, because IT is moving there.

    Long-term aspects for Windows as a Service

    One of the challenges, which you might have read in my previous articles but you definitely encountered by yourself, is the adoption of the two Feature Updates per year and transforming your processes and technologies to reduce the recurring amount of work to an absolute minimum. I will show you here, how this can be achieved: In this slide you can find three main areas:
    • Information-based Analysis
    • Proactive Testing
    • Reactive Testing
    -> Information-based Analysis gives you safeness and control with a high certainty. By continuously having the insights for your environment, you know about errors, before you encounter them. You should use this approach to find and fix the biggest issues and to always being in control of your environment. -> Proactive Testing gives you safeness and control with a high certainty. Manual testing can be even better than just working with the information from Upgrade Readiness, because you can walk through check-lists and ensuring stability. But in an testing environment applications can behave differently and you have to invest a lot of resources. Many customers find also automated testing very promising, but remind yourself that many errors cannot be even found by automated testing. You should use proactive tests for LOB applications, Upgrade tests and (may be) applications, which are known to be problematic or self-developed. -> Reactive Testing returns the most accurate results by creating the less effort. Reactive testing is very unconvential in IT today. Why? Because the impression for stability has been completely different in the past 20 years. Though, with the previous provided information, and speaking about Windows 10 - reactive testing creates only very small and controlled downtimes. You define the impacted computer collections and after encountering an issue, you can just retrieve the information of the blocking application/s and roll back your Windows environment for the dedicated users to the previous version. Afterwards you can just pause the deployment of the upgrade, fix the error, and then just turn the deployment on again. Many of my customers start here: Cloud services - or in detail - Upgrade Readiness is not adopted and reactive testing is just not allowed. But as you can see the arrow, the intention needs to be to push the higher percentage numbers in a long-term perspective to the right down corner. You could achieve this by focusing the proactive testing approach only on the most important and focused applications, and in the same space enabling Upgrade Readiness and establishing a slight approach for reactive testing. (just in case) You will need to tune your recurring processes and manual steps as I described in my previous articles. Then, the next step could look like this: At this point you still continue to work on your processes and try to automate every task, which needs to take place every release, and therefore reducing the human workload. With the coming releases you will see that the problems with the Feature Updates aren´t that painful and you can continue moving to the reactive approach and just focus the manual workload for the important and necessary things: This will reduce your effective resource costs and allows you to push the tranformation in your environment. Though, keep in mind that there are no "Best Practices". Something that worked for one customer, can be completely uneffective for the other ones. You have to find a layout, which works well for you and you should never stop improving it. In addition, if you are not allowed to use Upgrade Readiness by any mean, this circumstance would increase the amount of needed human resources a lot, because the percentages need to be split off to the two other areas. The same applies for Reactive Testing. Keep in mind that Proactive Testing in terms of resources is the worst area to invest the percentages in. Before finishing now, I hope that you find this information useful and would be very happy, if you could share your thoughts and improvements. How is WaaS beeing adopted in your company and how well (or bad) are you doing? And yes - I know that it is hard. In a transformation, the easiest way to fail is, to handle it as an incremental change. And - the transformation will come. Either you will bring the transformation, or the transformation will come to you. (Trust me - the last part will come with a lot of pain in its backpack.)   All the best,
    David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>         LogFileParser with PowerShell https://docs.microsoft.com/archive/blogs/daviddasneves/logfileparser-with-powershell Fri, 27 Oct 2017 10:10:00 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=1735 PowerShell Classes and its possible benefit. The project 'LogFileParser' by itself can be quiet useful and is completely extendable by capabilities in terms of log file types and filtering functions and therefore I wanted to share it with you. The idea, which I used primarily for this, was filtering with RegEx as I have described in detail here.   You can find it in my Github and download it directly here.
    Structure:
    Examples: Supported Types for now: Loaded LogFileTypeClasses CBS DISM Robocopy Output All System Center Configuration Manager log files Upgrade Logs: setupact.log & setuperr.log WindowsUpdate.log It is dynamically extendable and you can easily add your own LogClassFileTypes based on RegEx or add additional functions to LogFileTypes or even overwrite the parsing mechanism: LogFileTypeClass with RegEx Additional functions for a defined log file type - here WindowsUpdateLog: You can just inherit the default class 'ParsedLogFile' and just add your functions for this particular log file types - example: GetWindowsUpdates in the WindowsUpdate.log: I hope you like it. All the best,
    David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>         Some Tools of a PFE https://docs.microsoft.com/archive/blogs/daviddasneves/some-tools-of-a-pfe Sun, 15 Oct 2017 19:17:13 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=1265 Updated 10/16/2017   Hi all, I hope you are all well! Today I will give you a brief overview of the tools I need to use on a regular base. Chrissy LeMaire, one of the best SQL MVPs in the world, asked me directly via Twitter and also publicly via a Tweet to write down some of the tools a PFE uses and I surely couldn´t deny: https://twitter.com/cl/status/917361440041947136 David Peter Hansen started with a fantastic list of tools regarding SQL, which can be found as follows: https://davidpeterhansen.com/2017/10/09/sql-server-performance-troubleshooting-free-scripts-and-tools-list/ My technological specialties are little different though, because I am mainly focused in Windows Client, PowerShell and Security. I hope that this list will be of help for some of you and I wish you all a lot of fun testing and using the tools!

    Client & Debugging:

    First of all I start with the typical troubleshooting tools without any order. This is only a small subset of all the tools I sometimes need to use, but you really should be aware of these ones!
    DefragTools and Lightsaber One of the best materials regarding debugging are the DefragTools - Channel 9 video sessions by Andrew Richards, Chad Beeder and Larry Larsen showing some deep dive troublehooting tools and techniques. In this sessions a so called Lightsaber is explained, which is a dedicated USB-Stick / OneNote-Folder containing the most important debugging tools (the holy grail for every toubleshooter): Session 131 Lightsabre Windows 10

    WinDBG

    WinDBG is one of the most important tools debugging memory dumps and many more: A good way to start here is taking a look at the videos from the DefragTools and using cheat sheets as the following one: here

    WinDBG Preview

    This year the new WinDBG Preview was announced. You can see the videos in the DefragTools: here and here

    WinDBG - Time Travel Debugging

    A cool feature inside the new Preview WinDBG is Time Travel Debugging. "Time Travel Debugging (TTD) is a reverse debugging solution that allows you to record the execution of an app or process, replay it both forwards and backwards and use queries to search through the entire trace. Today’s debuggers typically allow you to start at a specific point in time and only go forward. TTD improves debugging since you can go back in time to better understand the conditions that lead up to the bug. You can also replay it multiple times to learn how best to fix the problem." Find further information here: https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-185-Time-Travel-Debugging-Introduction https://blogs.windows.com/buildingapps/2017/09/27/time-travel-debugging-now-available-windbg-preview/

    Wireshark

    "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is one of the standard across many commercial and non-profit enterprises, government agencies, and educational institutions."

    Windows Message Analyzer

    "Microsoft Message Analyzer is a new tool for capturing, displaying, and analyzing protocol messaging traffic, events, and other system or application messages in network troubleshooting and other diagnostic scenarios. Message Analyzer also enables you to load, aggregate, and analyze data from log and saved trace files. It is the successor to Microsoft Network Monitor 3.4 and is a key component in the Protocol Engineering Framework (PEF) that was created by Microsoft to improve protocol design, development, implementation testing and verification, documentation, and support. With Message Analyzer, you can choose to capture local and remote traffic live or load archived message collections from multiple data sources simultaneously." Take a look here.

    Sysmon

    "System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time. By collecting the events it generates using Windows Event Collection or SIEM agents and subsequently analyzing them, you can identify malicious or anomalous activity and understand how intruders and malware operate on your network." Defrag Tools #108 - Sysinternals SysMon - Mark Russinovich great blog article - Sysinternals Sysmon unleashed WannaCry Detection with Sysmon

    WMI Troubleshooting

    The WMI Diagnosis Utility -- Version 2.2 WMI Troubleshooting - Logs

    Querying and Viewing the WMI Repository

    You should also consider to buy some dedicated books regarding WMI, if you are working very often with it.

    Especially also the Windows Internals Book is a good consideration!

    WMI Explorer

    WMI Explorer     and here the download

    WBEMTest

    WBEMTest is a graphical utility that you can use to test connectivity to remote systems, validate your WMI queries and explore WMI.

    Winmgmt

    Winmgmt is the WMI service within the SVCHOST process running under the LocalSystem account. In all cases, the WMI service automatically starts when the first management application or script requests connection to a WMI namespace. For more information, see Starting and Stopping the WMI Service. Sometimes the self-repair helps: here winmgmt /verifyrepository winmmgmt /salvagerepository winmgmt /resetrepository

    DISM

    Deployment Image Servicing and Management (DISM.exe) is a command-line tool that can be used to service a Windows® image or to prepare a Windows Preinstallation Environment (Windows PE) image. DISM can be used to service a Windows image (.wim) or a virtual hard disk (.vhd or .vhdx). DISM /Online /Cleanup-Image /CheckHealth DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth

    SFC

    System File Checker is a utility in Windows that allows users to scan for corruptions in Windows system files and restore corrupted files. This article describes how to run the System File Checker tool (SFC.exe) to scan your system files and to repair missing or corrupted system files. If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions may not work, or Windows may crash. 
    sfc /scannow findstr /c:"[SR]" %windir%\logs\cbs\cbs.log > c:\windows\logs\cbs\sfcdetails.log 

    Event Viewer

    The Event Viewer is a Microsoft Management Console (MMC) snap-in. You can start Event Viewer by adding the snap-in to MMC or by double-clicking the snap-in file, Eventvwr.msc, which is located in the %SYSTEMROOT%\system32 folder. In addition, Event Viewer can be started from the Windows interface or the command line by using the following procedures. Must-read documents (!): Spotting_the_Adversary_with_Windows_Event_Log_Monitoring Detecting-Lateral-Movement-through-Tracking-Event-Logs

    Windows Event Forwarding

    Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server.

    Windows Event Forwarding to a workgroup Collector Server

    Introducing Project Sauron – Centralised Storage of Windows Events – Domain Controller Edition

    Telerik Fiddler

    "The free web debugging proxy for any browser, system or platform" - Fiddler is great for website performance analysis and troubleshooting of encrypted traffic.

    CMTrace

    CMTrace is a real time log file viewer for System Center Configuration Manager. Important features:
    • Real-time logging
    • Merging multiple log files together at once.
    • Highlighting -  error messages in red; warning messages in yellow.
    • Error Lookups
    • Standard format for many log files
    Error lookup:

    Log Parser

    "Log Parser 2.2 is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows operating system such as the Event Log, the Registry, the file system, and Active Directory. You tell Log Parser what information you need and how you want it processed. The results of your query can be custom-formatted in text based output, or they can be persisted to more specialty targets like SQL, SYSLOG, or a chart. Most software is designed to accomplish a limited number of specific tasks. Log Parser is different... the number of ways it can be used is limited only by the needs and imagination of the user. The world is your database with Log Parser."

    Log Parser Studio

    Log Parser Studio is a utility that allows you to search through and create reports from your IIS, Event, EXADB and others types of logs. It builds on top of Log Parser 2.2 and has a full user interface for easy creation and management of related SQL queries.

    Further information here.

    Windows System Control Center - WSCC

    "WSCC allows you to install, update, execute and organize the utilities from various system utility suites. WSCC can install and update the supported utilities automatically. Alternatively, WSCC can use the http protocol to download and run the programs. The portable edition doesn't require installation and can be run directly from a USB drive." WSCC supports the following utility suites:
    • Sysinternals Suite
    • NirSoft Utilities

    Sysinternals

    "The Sysinternals web site was created in 1996 by Mark Russinovich to host his advanced system utilities and technical information. Whether you’re an IT Pro or a developer, you’ll find Sysinternals utilities to help you manage, troubleshoot and diagnose your Windows systems and applications."

    You really should know about the Sysinternals tools! Most of the tools are discussed and explained in the mentioned DefragTools. Start here.

    Procmon

    "Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit."

    Procexp

    "The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded."

    ProcDump

    "ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. ProcDump also includes hung window monitoring (using the same definition of a window hang that Windows and Task Manager use), unhandled exception monitoring and can generate dumps based on the values of system performance counters. It also can serve as a general process dump utility that you can embed in other scripts."

    Autoruns

    "Autoruns has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys. Autorunsreports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond other autostart utilities."

    PSExec

    "PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems."

    Nirsoft Tools

    "Unique collection of freeware desktop utilities, system utilities, password recovery tools, components, and free source code examples." The NirSoft Tools include some really nice tools as the following: RegistryChangesView "NirLauncher is a package of more than 200 portable freeware utilities for Windows, all of them developed for NirSoft Web site during the last few years."

    PPing

    "PPing is designed to give you the easiest possible solution for discovering ports from a windows console. The design was heavily oriented towards the terminology and behavior of the classic ping tool under windows." Alternatively you can do it with PowerShell:

    Test-NetConnection

    Further examples can be found here.

    PuTTY

    "PuTTY is an SSH and telnet client, developed originally by Simon Tatham for the Windows platform. PuTTY is open source software that is available with source code and is developed and supported by a group of volunteers."

    Posh-SSH

    Windows Powershell module that leverages a custom version of the SSH.NET Library https://github.com/sshnet/SSH.NET to provide basic SSH functionality in Powershell. The main purpose of the module is to facilitate automating actions against one or multiple SSH enabled servers

    LogLauncher

    The LogLauncher gathers all important logs from one or many machines and is really awesome! It can be download here.

    IE / Edge - F12 Developer Tools

    The Microsoft Edge F12 DevTools are built with TypeScript, powered by open source, and optimized for modern front-end workflows. 

    Use the Debugger to step through code, set watches and breakpoints, live edit your code and inspect your caches. Test and troubleshoot your code

    The Microsoft Edge F12 DevTools Debugger The Performance panel offers tools for profiling and analyzing the responsiveness of your UI during the course of user interaction.F12 DevTools Performance panel Take a look through the docs and additionally here: https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-126-Internet-Explorer-F12-Developer-Tools-Part-1 https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-127-Internet-Explorer-F12-Developer-Tools-Part-2

    Microsoft Security Compliance Toolkit

    "This set of tools allows enterprise security administrators to download, analyze, test, edit and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products, while comparing them against other security configurations.
    The Microsoft Security Configuration Toolkit enables enterprise security administrators to effectively manage their enterprise’s Group Policy Objects (GPOs).  Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them via a Domain Controller or inject them directly into testbed hosts to test their effects. "
    Here you will find important announcements: https://blogs.technet.microsoft.com/secguide/
    And this will give you further guidance: Defrag Tools #174 - Security Baseline, Policy Analyzer and LGPO

    PerfView

    "PerfView is a performance-analysis tool that helps isolate CPU- and memory-related performance issues."
    PerfView Defrag Tools videos: Part8, Part7, Part6, Part5, Part4, Part3, Part2, Part1

    Windows Analyzer 

    "Included in the Windows Assessment and Deployment Kit (Windows ADK), Windows Performance Analyzer (WPA) is a tool that creates graphs and data tables of Event Tracing for Windows (ETW) events that are recorded by Windows Performance Recorder (WPR), Xperf, or an assessment that is run in the Assessment Platform. WPA can open any event trace log (ETL) file for analysis."
    This tool is one of the most important ones for a Client PFE.

    Windows Performance Recorder

    "Included in the Windows Assessment and Deployment Kit (Windows ADK), Windows Performance Recorder (WPR) is a performance recording tool that is based on Event Tracing for Windows (ETW). It records system events that you can then analyze by using Windows Performance Analyzer (WPA)." This tool is necessary to create the traces for the Windows Analyzer.

    Xperf and scripts

    I also got some (old but gold) xperf-scripts:

    Notepad++

    Last but not least comes the well-know Notepad++. If you don´t know this tool you definitely missed something! It is especially good, when working with very big log files >50MB and/or with xml files. It includes the following features:

    Visual Studio 2017

    Yes - I use it a lot.

    PowerShell:

    One of my main specialties is also one of my biggest tools. You can actually achieve everything with PowerShell: gather information, automate and even use techniques, which are completely missing in the UI. You can even automate most of the described tools above - and as for example the new Project Honolulu for Windows Server is completely based on PowerShell and uses PowerShell WMI cmdlets in its backend. But for using PowerShell in the daily work there are also some tools you really need to know.

    ISE with ISESteoroids

    PowerShell.exe and PowerShell_ISE.exe are the most known tools fo PowerShell using in Windows. The ISE is not the best toolset, if you are coming from Visual Studio for example. I am a former .Net software architect and by working with PowerShell this was my first little downside. But - there is this addon called ISESteroids from Tobias Weltner, which brings a bunch of additional functions to the ISE and results into a complete great toolset - here are some of the added capabilities:
    • Essential Editor Settings - Secondary Toolbar
    • Code Refactoring
    • Advanced Search&Replace
    • Ensuring Code Compatibility
    • Creating Modern User Interfaces
    • Security and Protection
    • Community Tools

    VSCode

    "Visual Studio Code is a lightweight but powerful source code editor which runs on your desktop and is available for Windows, macOS and Linux. It comes with built-in support for JavaScript, TypeScript and Node.js and has a rich ecosystem of extensions for other languages (such as C++, C#, Python, PHP, Go) and runtimes (such as .NET and Unity). Begin your journey with VS Code with these introductory videos." VSCode will replace the most used tool - the ISE - within the next time and therefore you really should take a look at it. I gathered the most important articles around this topic, which you really should go through:

    How to install Visual Studio Code and configure it as a replacement for the PowerShell ISE

    Why I use Visual Studio Code to write PowerShell

    Transitioning from PowerShell ISE to VS Code Here you will find all default keybindings, which will help you a lot.

    VSTS / Git / Release Pipeline

    Visual Studio Team Services just allows to easily create your complete Release Pipeline. I will not spend too much time in here, because it is a dedicated topic, but focusing into more professional and sophisticated powershelling or dev, you really should take a closer look at it.

    PSGUI

    Working with XAML-created PowerShell GUIs I very often reuse my own projects PSGUI and PSGUIManager:

    Knowledge Management:

    A fact is - as a PFE you are always working hard and you are always lacking time. Also no one in the world can now everything, but you should know where to find the information. Very often totally undererstimated, but the knowledge management is one of the most important areas, where you can improve your work quality and performance. I will show you some of my most used tools to manage all the information and my time.

    Email Structure

    A good email structure is the most important thing nowadays. As a PFE you easily get hundreds or thousands of emails per day. Most of them contain at least some information, which may be usable at some point in the future. There are dozens of books out there to assist you in these kind of tasks. I want to show you one of my favorite books:

    How to be a Productivity Ninja: Worry Less, Achieve More and Love What You Do Kindle Edition

    OneNote

    I grab every information into my OneNote and sort it. The biggest benefit of OneNote is the performant search capability. It looks like this: And as you probably would expect, I have dozens of notebooks: If I found some interesting blog posts I normally just copy them and add them to my OneNote. I always remember some passphrases or keywords to the topics I am searching for and this helps a lot!

    Teams

    Teams is our new communication tool, which allows to add all other services directly into it, aswell as meetings similar to Skype.

    To-Do

    "Microsoft To-Do helps you manage, prioritize, and complete the most important things you need to achieve every day, powered by Intelligent Suggestions and Office 365 integration. Download the To-Do Preview today." It is important to manage my tasks and time - therefore I used for a long time Wunderlist - then To-Do and now the tool below - Office Tasks or so called Microsoft Planner from the O365. I would say, that Microsoft To-Do is the consumer app and Microsoft Planner is the enterprise app.

    Office Tasks

    "Take the chaos out of teamwork and get more done! Planner makes it easy for your team to create new plans, organize and assign tasks, share files, chat about what you’re working on, and get updates on progress." Office Tasks is my new tool, which I use with my personal O365 account to manage all upcoming work and personal tasks. The good thing about this specific one is, that you can assign tasks to dedicated users in your O365 account and leverage everything with documents from your OneDrive / for Business.  

    Social Media:

    Social media is important. Networking is important. You really should not ignore this.  Most of the news as blog posts, announcements, official discussions and many more can be catched by being involved into social media. This is one of the most important things today to stay up to date in the IT. Additionally to this I use some more tools, which bring a huge benefit to my daily work. This aren´t all of my tools, but probably the most important ones.

    Twitter

    Twitter is necessary to stay up to date and gather all new blog articles from officials or well-known people as MVPs.

    LinkedIn

    In LinkedIn you very often find great high level articles specifically targetting CXOs, which contain good information. It is also the most important platform for networking. I get frequently asked via LinkedIn regarding little technical topics (and I am totally fine with this!) and in the counterpart I also try to get some feedback from the people regarding our newest technologies. One more topic is jobs - LinkedIn is from my experience the most used platform for sharing jobs and the place where job hunters are trying to fill up their sophisticated jobs. If you want to join this chance you really should ensure, that your profile is completely and correctly filled. There has also been added a feature to provide headhunters with further information, if you are searching for a job and what direction it should go to.

    Blogs

    I really need to write this down. We are in a time, where blogs are important. As you are reading my blog post, you know that blogs may contain useful information, but even more - sometimes official announcements are made via blogs. You need to have a dedicated list of blogs, where you take a look into in regular timeframes. Michael Niehaus´ one for example is one of the most important ones for me and probably also for you: https://blogs.technet.microsoft.com/mniehaus/

    Hootsuite

    "Hootsuite is a social media management platform, created by Ryan Holmes in 2008. The system’s user interface takes the form of a dashboard, and supports social network integrations for Twitter, Facebook, Instagram, LinkedIn, Google+, YouTube, and many more." I am using Hootsuite a lot - it is very useful for me, because I can now plan postings to all my social media accounts in advance. As you can see it is also combinable with Right Relevance:

    Right Relevance

    "Discover fresh relevant content to your interests, save interesting articles, follow influential experts, be the first to share soon-to-be viral content and much more." I really love Right Relevance, because it just gives me the most important blog articles and news regarding specific topics. Included in Hootsuite I can now just share the most important information just in time and set it up into my "read-line".

    The Old Reader

    The Old Reader is a RSS-reader which I like a lot! I have added my favorite blogs here and can easily prove, what articles I missed.

    Conferences & UserGroups

    As an IT-Pro you really should visit conferences and usergroups from time to time. As mentioned before - networking is one of the most important things in a life of an IT-Pro and you can do this the best at conferences and usergroups!

    MeetUp

    This one is my main tool to identify UserGroups in my area and I am managing the German PowerShell UserGroup and more dedicated the Munich one via MeetUp. We are having around 30-50 attendees every time and you realy should use it to connect yourself!

    PaperCall

    If you are speaking a lot at conferences you would have seen, that many conferences are moving their CFP to Papercall. Take a look - there may be a conference you want to speak on.

    The End

    Thank you all for reading the whole list - I hope, that some of the mentioned ideas tools and techniques will help you in the future. If you find any important things missing or want to discuss any of the parts you are always free to comment. I am happy to hear your feedback and opinions!   All the best,
    David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>         WaaS at MSIgnite - Official Rings and asking for Feedback https://docs.microsoft.com/archive/blogs/daviddasneves/waas-official-rings-and-asking-for-feedback Wed, 04 Oct 2017 02:10:49 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=995 I want to ask you for feedback! You can download the current slides and videos from the Ignite with the same following script: Ignite Download Script The slides in this blog post can be found here: Servicing Windows 10: Understanding the Windows as a service process and improvements Michael Niehaus, Director of Product Marketing Designing and implementing your flighting strategy to support your Windows 10 deployment decisions John Wilcox, WaaS Evangelist Further Sessions should also have your attention: Succeed with app compat for Windows as a service Chris Jackson How Microsoft deploys Windows 10 and implements Windows as a service internally Robert Van Winkle Windows 10 servicing explained (WAAS): Deploying Windows as an inplace upgrade Adnan Hendricks How to design and complete your successful move to Windows 10 and WaaS John Wilcox, WaaS Evangelist

    What more?

    As usual you should really take a look at the sessions from Michael Niehaus. You will find a lot of similar points from my previous article "Automating Windows as a Service" and I really recommend you to take a look at the stated sessions in this article. In terms of tools a very big recommendation is to evaluate the mentioned tools from the Windows Analytics: They will help you a lot!

    The following material is the information you should be aware of:

    So - what is Waas?

    A new day - some new slides - the same and simple information: First of all you must know the difference between Quality and Feature Updates: Every 6 months a new release is published - every spring (03) and fall (09) Each one serviced for 18 months - please don´t forget the time (you would not be the first one) : Aligned with O365 Not aligned, but assisted and supported by System Center Configuration Manager. I saw many customers missunderstanding the latest blog article around alignment, but the following slide should clarify it very clearly. You will continue to have 3 releases of ConfigMgr every year.

    Why WaaS?

    Customers continuously ask about the why. Why is every IT manufacturer moving their software to an agile approach and why do we do the same for our OS? Actually we are the last ones to move into these type of servicing times and here are just some of the big arguments to do so: #Security Security is the number one - the most important thing to stay secure, is to stay up to date with all your applications - and finally now also the OS. We will continuously work on security in the OS and adding security features to it within every release. Some may be visible - some not. Some things you get to know - some not. A typical example is the Edge Browser. Did you know that Edge is out of the box MUCH more secure than the IE? Probably not?! Take a read here. #Productivity  Continuously adding new Feature Updates brings new productivity features along - how Windows looks like and can be administrated and this in smaller timeframes with smaller changes with each release. #Hardware Support Coming with new hardware there needs also to come changes within the OS to adopt these new, available or changed hardware features: #No more big deployments Moving from big and disruptive deployments, which came very often along with a complete migration project and hardware costs, to the Semi-Annual-Channel and adopting this in the daily and operative work, which can lead in a total reduction of costs by using automation and recurring processes.  

    The recurring Cycle

    Smaller deployments with less changes in smaller timeframes. It may sound easy, but you really should recognize the different approach. Switching from release deployment to an always recurring agile deployment is a huge step. Each release should be adopted from every customer within the following 3 phases: How many devices in each phase? What about App Compat? Our Compatibility Promise So you have proactive and reactive testing for your apps. This is one of the arguments for deployment rings:

    The Deployment Rings

    How could these deployment rings look like? As you see in the picture we added the "Deployment Decision" in here. A simple recommendation I always give to my customers is to prepare initially every new release version. You don´t really need to deploy every release, but you should have the possibility to do so, if you run later on into other problems. You should evaluate Insider Preview for Business! You can gain important information from an Insider Preview! Some of these points can be:
    • validating new / deprecated features
    • testing new features
    • testing LoB apps
    • get an insight what is coming, before it´s there
    How does the deployment rings look like in a high-level view? In the "Target" area you see the stairs - each step is a ring with different devices in it.

    How does the official Microsoft recommendation look like?

    All of the following groups are dynamically and also users are allowed to join the early ones, if they want to (and they will want to withing time) The idea is to deploy the next version on dedicated machines and gathering feedback / data to make with this data the deployment decision, if you want to deploy this version in the broad deployment for your company. Canary is the initial ring with a small amount of chosen users:
    • IT-Admins
    • Client Team
    • Application Holder / Key Users
    Self-Selects: Small amount of users, who want to have early access. They can place themselves into this ring. Sample: It should deliver you a complete presentation of all job roles, apps, geographical locations. You want to gather the feedback with Windows Analytics or other feedback channels and with this data/feedback you make the deployment decision for this release. Broad: If the data in Windows Analytics or the feedback was sufficient and good you push out the release to all devices. And now with some more details: And what happens, if you encounter any problems within your reactive deployments? Just stop, fix and continue.  

    What Tool / Technology to use for Servicing?

    You have the following four possibilities to use - you could also combine, which may become hard to manage. Most of my customers went for SCCM and WUfB. Difinitely evaluate within SCCM the two possibilities: And finally the session takeways from the session BRK3048, which I highly recommend you to do or use / understand and share:

    Recap:

    I showed you the latest officially presented information and now it´s time for feedback! As stated above I want to hear about your approaches and ideas! Here are some questions which you could probably answer:
    • What do you think about WaaS?
    • How do you configure your rings?
    • What technology do you use?
    • Do the published ring recommendations fit for your company?
      • If not - why?
    • What can be improved?
    • Do you need further help?
    P.S: Be honest and professional and please not insulting ;)
    David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>         Automating Windows as a Service https://docs.microsoft.com/archive/blogs/daviddasneves/automating-windows-as-a-service Sat, 12 Aug 2017 12:48:59 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=505 Bold lines are important. Blue lines are most important. (read with care) TL;DR; at the end - if you need it.
    Hello together, first of all I need to apologize again for the length of this blog post, but I personally think that the following topics need to stick together to be understood into depth and I don´t want to leave any chance for missunderstandings. It took me some time (100h+) to create this article and it will take probably some time to read it. But before you continue reading you should be aware of Windows as a Service and what really stands behind it. (if not read Demystifying Windows as a Service – wake up! please and Update to the Windows as a Service Model) I will start with a short intro and some theory - moving on to the procedural automation and to technical adoption in theory and finally to technical adoption with automation.

    Disclaimer:

    I´ve received so many negative feedback regarding WaaS after my previous extensive article and I have heard so many times that WaaS is so extremely complex and no one would ever be possible to adopt this in any way. First - nearly all of the topics, which I am speaking about, are mandatory know-how - either regarding to Project Management, ITIL, ALM, Security Management (updates) or obvious technical background. I am actually not explaining something new - I am only explaining how professional IT can and should be adopted. The answer is - professional. I am also writing this as a private person, who thinks that DevOps is not only a buzzword. I see a huge need to show a theoretical approach for automating WaaS and also to show a technical Proof of Concept - otherwise it seems that no one will ever believe me. By writing this article as a private person you might also recognize that I am doing this in my free time. (having not too much of it!)

    Introduction

    WaaS is not something "Microsoft-special" and nowadays there is this cruel necessity to keep up the pace and adopt the newest technologies just in time. With WaaS this is accomplished for the Operating System, where by speaking of the coming "new wonderful Features"  we are mainly speaking about Security and Administration Features, which are increasing the Clients´ Security with hardening. Additionally we introduce new technologies like Windows Hello for Business with Companion Devices, Exploit Guard, Application Guard and later on also features using Artifical Intelligence on or with the OS like Advanced Threat Protection and even the Antivirus.  I see companies grumbling about this change, but this is just a kind of Digital Transformation. There is no time anymore to release new Operating Systems manually every 3 to 5 years.    I love to quote Jeffrey Snover: “If you want to fail in a transformative change just treat it as an incremental change.” Video from PSConfEU 2017 - 13:10 ff. MUST see.

    Theory 

    First of all I want to clarify our latest changes to make sure, that everyone is on the line. WaaS is an always recurring process in identical time frames as shown in the following picture: One OS is supported 18 month. You will always have around 6 months between each OS release. So you know when specific OS Versions are in Insider Preview, get released, become ready for broad deployment and when they run out of support. Always. Michael Niehaus consolidated this vast information and complexity in its latest blog article. It is probably the shortest article ever and he is right. This is the main information. Everything else, that I am describing and explaining is just:
    • how to do it professionally
    • how to save time in the future
    • and the most important one: how to do it structured!
    Lets start by diving into a more detailed view:
    The latest changes result into completely predictable time frames, which you should simply address in a recurring manner. So - what has to be done for one specific OS Version? Michael separated this into 3 phases (see here), which makes it very simple to understand - and you should be aware of these 3 phases:  
    • Plan and Prepare. Leverage the Windows Insider Program to follow along with the development of new Windows 10 features (so that you can prepare to deploy those features), while at the same time validating compatibility and providing feedback on any issues or concerns.
    • Targeted Deploy. Starting as soon as a new Semi-Annual Channel feature update is released, begin targeted pilot deployments to a targeted group of machines (we typically suggest around 10%) to validate app, device, and infrastructure compatibility.
    • Broadly Deploy. Once you are satisfied with the results of the pilot deployments, begin broadly deploying throughout the organization.  For some organizations, broad deployment can begin quickly; for others it can take longer.  It is up to each organization to determine when to make that transition. (see here)
    As a result of this we will now dive deeper and take a detailed look for one specific OS Version - for example Windows 10 1803 - starting from Insider Preview up to its end of life and what has to be done in each time period.

    Granular View for one Release:

      [video width="800" height="1080" mp4="https://msdnshared.blob.core.windows.net/media/2017/08/WaaSArticle2.mp4"][/video]
    The video ends up in this slide and demonstrates the transition from the specific acronyms and timestamps to fully understand the model and how all the time frames are actually working together: Starting from left to right you see the different states of the OS Version. Starting in Insider Preview and then becoming finally available in SACT - moving on to SAC and finally moving out of support. The timestamp when a release finally becomes officially "Ready for Broad Deployment" may vary to different circumstances like feedback from Premier Support, feedback via Feedback Hub, feedback over Telemetry and also internal feedback. But as mentioned in my last article - it does not affect the general support time of 18 months.

    Legend:

    Also some more detailed words to the "Buffer for Upgrade": Buffer for Upgrade = Compliance Cleanup = a defined time buffer, which is placed at the end of broad deploy to make sure having some time, if something does not work as desired and to target computers, which were not able to upgrade by any means. This ones need to be addressed specifically and therefore the naming "Compliance Cleanup" is used. This was actually everything, what changed. Only names. Nothing less, nothing more. Now let´s continue and move from Theory into the Procedural Adoption.

    Procedural Adoption

    Speaking in times:
    • around 6 months Insider Preview
    • 18 months supportability
      • consisting of approx. 4 months SACT
      • and approx. 14 months SAC
        • evaluate 10 months for broad deploy
        •  and 4 months for Compliance Cleanup and Buffer
    This slide will show you what "User"-group (team/persons)  has to accomplish which "Workflow" (tasks / processes)  in which defined "State" (timeframe):
    • State - predictable timeframe regarding the specific OS Version. Due to the fact of the OS releases in March and September every timeframe can be defined pretty exactly.
    • User - a group of persons / a team / a outsourcer who has the lead for the defined tasks in this timeframe
    • Phase - one of the 3 known phases to divide the OS deployment - for better explanation: Plan & Prepare, Targeted Deploy, Broad Deploy
    • (scroll down) State 2 - Separation of the working tasks into Proactive Testing, Reactive Testing & Production and Upgrade It describes what the approach should be at the shown timeframe. You start in Proactive Testing to set up the configuration and test LoB apps, but also moving in your internal first tests. In Reactive Testing you deploy your upgrade to dedicated machines (starting with small numbers) to find any incompatabilities, which were not identified without causing a high impact. By defining small numbers and well chosen computers you predefine the possible impact and completely control your testing approach. Afterwards you move fluently into Production and at the end upgrading special or very sensitive machine. (VIP, industry computers, etc.)
    • Workflow - Defined work tasks that have to be accomplished in the current time frame.
    You predefine the upcoming processes and because it is completely predictable you are able to set up a detailed recurring project plan! Let us go through each State in detail to discuss the Workflow and the specific "User"-group.

    Plan & Prepare

    In this timeframe we now define our phases by our events - so we have the "Plan & Prepare" phase,  where you start the first preparations for the upcoming OS version. The most important steps here are to test the most important LoB apps and to validate the new features. Regarding the new features you have to make the decision, if you want to use it and also to take a look at the prerequirements and including these tasks into your internal roadmap. Additionally you should also take a look at closing, deprecated or removed features, which might affect you. It is also a good idea to test the inplace upgrade itself - does the computer with a bunch of software installed on it still upgrade as intended? Are there any modifications made to the computer, which need to be addressed after the upgrade? For the first releases every customer is doing this process manually. Why? It was ever done this way and there was no need to change this. But now coming with updates every 6 months this won´t be possible anymore. So you should start building a procedural and technical workflow which addresses all recurring and automatable tasks completely.

    Targeted Deploy

    The "Targeted Deploy" is initialized by the official release and it is the most complicated phase and I will explain you why. The first things you need to achieve with the released version is to get everything ready for the broad deployment. This means that you have to create GPOs, enabling new features, making some modifications to configuration, CI or even other technologies and so on. So you want to have some test/dev computers where the new release is just installed on as soon it is published. This should be done via Inplace Upgrades, because you passively just test, if the technical upgrade process itself works well and how the computer looks like after this upgrade. The project team (for probably new features) and the IT department can now set up the whole configuration and test on these dedicated machines. As you see - we have a defined collection of computers which should be upgraded automatically after this event (the release of the new OS Version). This task should take as less time as possible to push out the first testing rings. Testing rings? You want to deploy the new OS as fast as possible to a small but very representative number of computers. The very first testing rings should include mostly IT-people which can handle small problems and give good feedback to - for example - missing GPOs or additional fixes which have to be made after the inplace upgrade. You want also to test applications in this phase - as you see in the picture I have mentioned the Application Holder and the App Test Users. While the configuration is evolving to its finish the first rings targetting the applications should start firing. And here it gets tricky - it´s not only about applications - there is much more that should be taken into consideration:
    • Applications
    • Organizational Units
    • Network Segments
    • Geographical Locations 
    Applications are pretty understandable. Who are the best testers? People who actually work with the software products. So you want to deploy as soon as possible the new OS version to people working with applications - BUT - you don´t want to have an huge impact. So you start with very small numbers trying to target ALL applications. It would be great if you upgrade  a number of computers with all existing applications installed on it at least once. Why Organizational Units? OUs are very similar to the transversal cut through all applications. There are some applications which only are used in specific teams, which at many customers are managed in specific OUs. Additionally to this you want also to test all different GPOs and don´t want to find some coincidences too late coming from specific settings and creating unusual errors. Why Network Segments or Geographical Location? Actually you know the answer - you don´t want to find network-related errors too late for a whole building or even region. A great benefit by doing this - you create indirectly caching points in the whole field. For example - if you have 10 buildings and 100 machines in each building (depending on the technology for sure) the devices will reach out for the feature updates in the same building or even NAT. Therefore the best strategy would be to upgrade in the first place one computer for each building and then increasing this number step by step. Even if machines are offline - there will be pretty fast the situation that you have at least one caching point sitting in each building. As you see - there are a lot of benefits for this approach - but how can you adopt this technically und fully automated? This is where the "tricky" begins. The combination of all these transversal cuts split up into some rings will be the hardest part to accomplish in the automation of WaaS. Setting up the collections for the rings with well-chosen computers is hard - but manageable. And the good thing - if you have accomplished this task once you will never need to do it again, because it will be automated! We will take a more dedicated look at some possible solutions later on in the technical part.

    Broad Deploy

    As you can see in the following image the Broad Deploy area is divided into 3 parts. The first two parts are considered the typical "Broad Deploy" - pushing out the upgrade in a high number into the field. The second ring of this two though will mostly focus on some special machines which should not result in problems by any mean. So they will be deployed in the timeline rather late to have run through a vast amount of proactive and reactive testings before. And in the last region the computers become uncompliant. Why? In IT you should always calculate with time buffers. Therefore you should move your upgrading target date to around 4 months earlier, before the client itself gets out of support. So you would try to place all your upgrades between Insider Preview up to 2/3 of Broad Deploy (SAC). Then you can define a precise task for Compliance Cleanup, which is targetting all machines that did not upgrade / or could not being upgraded. In the next picture (below) I added (by purpose) an additional "State" directly below the "Phase". The shown information is crucial to understand and adopt WaaS:

    Understanding Reactive Testing

    In WaaS you do "Proactive Testing" and you configure everything without making any mistakes and running through quality gates. (sure you do)  But - due to the fact of not having unlimited time like in Windows 7 - there will come a point in time, where you just suggest that everything will work. This approach is called risk based approach, which is specifically targetting applications. (further information in previous WaaS Article) The first question I always get is - WHAT? You want to possibly impact some of our machines in the field? The answer is - Yes! Who are the best testers? People who actually work with the applications! What is the impact? You define the impact by defining the number of computers which are upgraded at the same time, in the same OU with the same applications.  What is the impact for the chosen users who will run into problems? They will call either Support desk or their Application Holder and then roll back --> 30 minutes to 60 minutes What is the outcome? You will get very early dedicated and precise information, what is not working. What is next? You have to prepare a workflow for this scenario. Depending on the application impacted - pausing further deployment and resolving the problem:
    • internal validation
    • validation by Application Holder
    • Support Call at Manufacturer
    • Contacting Premier Support from Microsoft
    • Validating fallback or alternative options
    After having fixed the issue you can just continue with your deployment. Take a look later at "Target Deploy" in the topic "Technical Approach in Theory". More information here.

    Dividing into fixed Procedural Steps

    As a result of this you should collect a list for who has to do what starting at a specific point in time and completing in a specific time frame with an end date and what should be the outcome. This sentence is extremely important and therefore we will take all the necessary information out of it: This is simple project management and setting up all the tasks should be easy work. The cool thing about this (every project manager should love this) - these tasks need only to be set up once. With every Feature Update normally only the settings of these tasks are optimized - sometimes there may be also some tasks added or removed, but - all in all the whole task list is a pretty solid setup (this has to be your target). And now you may see the first problem here: You need to set it up with a decent amount of time and care. Because of its impact you want to make absolutely sure, that the defined task list is complete and correctly "configured".

    How?

    Communication!

    What else?

    Project Management!

    To retrieve a complete and well configured list of tasks you should set up meetings and firstly brainstorm from a technical, but also procedural and business-depending point of view. Just grab every idea from every team or person and write it down. Discuss about removing unnecessary or unappropriate tasks. Think also of consolidating or dividing tasks. Then you should define at least the values for who, what and the outcome for all tasks. Decide whether it makes sense to use Date-based or Event-based (prefer this one the most of the times) and then visualize all the tasks and put them into your timeline for ONE specific OS Version. In the end it is about fine-tuning.   The whole process can be seen in the next picture - depending on your company this process may take some time. (hopefully not months) The blue boxes can be done with ease, but the red ones need to be really handled with care and should be well-considered. Let us take a look at two demos of the mentioned tasks: This is the same example for "Validating new Features" - the first one with absolute dates and the second one based on events. You need to decide by your own, which makes more sense, but we will see later on, that the distribution of each Windows 10 Feature Update (Upgrade) is implemented technically event-based.  

    Process Optimization

    Some lines above I have spoken about the visualization of the tasks. A project manager normally should jump up and and shoot out, that he knows some techniques to accomplish this. We are now moving into some tasks of his job and therefore it may look complicated for some people. (it isn´t that complicated) Personally I would say, that there are two good approaches on this - depending to your company size:

    Gantt Chart

    The good thing about the Gantt Chart is, that nearly everyone has seen or worked with similar charts. It is straightforward und easy understandable - even for non project managers. But it has one devastating downside - if you want to manage and improve a lot of tasks with the Gantt Chart this will become unhandy and confusing. Therefore you should retrieve your amount of possible tasks and decide in one of the first steps, if the Gantt Chart is the technique you want to focus on.
    Further information here

    Critical path method

    The other possibility, which I have seen a couple of times is to work with the Critical Path Method or some similar methods. There is one downside here aswell - setting it up and staying up to date takes more time than with the Gantt Chart. But you can control even better your gaps and holds and optimize all the processes in a centralized way. Due to its complexity you could even use both: Use process automation in the Critical Path Method by dedicated and trained project managers, but deliver simplified Gantt Charts - to the dedicated teams (with only partial outputs). By doing it that way you would have a complex (but effective) project management with the possibility to visualize it in a simplified way for all the teams and involved persons.
    further information here

    Outcome

    The outcome should be an optimized list of tasks which should be addressed for one dedicated release. I will just brainstorm to give you a brief overview, which tasks could be implemented:
    • ADMX - Download & Install
    • Manage GPOs
    • Validating (new) Features
    • Knowledge Management
      • Internally
      • Teams
      • Users
    • Validating Feature Closings
    • Setting Infrastructure Requirement
      • new projects
    • Test Inplace Upgrade
      • Upgrade itself
      • Look & Feel afterwards
      • Technical functionality afterwards
    • LoB Testing
    • Setting up OSD TS
    • Download ISO/WIM
    • Report evaluation
      • Upgrades
      • Versions
      • ALM
    • Feedback Management
      • Retrieval
      • Push
    • Pilot Deployment
      • Outcome
    • Targeted Deployment
      • Outcome
    • Broad Deployment
      • SLA
    • Compliance Cleanup
    • Change Management
    • Security evaluation
    • Evaluation with Legal (Telemetry etc.)
    • Evaluation with workers council (new features / changes)
    • Upgrading depending technologies (Configuration Manager, O365 etc.)
    • Remediation Task
    • Application Incompatibility Workflow
    • more

    Technical Approach in Theory

    After knowing about the 3 phases we will now divide all the phases into smaller chunks. This is what we (Microsoft) call rings - targeting a defined collection to be applied to a specific timestamp which is relative to one of the events "Insider Preview", "SACT" and "SAC". What does this look like? [video width="800" height="1080" mp4="https://msdnshared.blob.core.windows.net/media/2017/08/WaaSArticle2_Rings.mp4"][/video] The video showed how the timeline is split into these rings and ended up in this slide (beware count of rings only for demo purposes): So you divide your complete timeline for one OS version into rings ("TimeTrigger" with specific "Collections"). These specific collections are used for the automatic upgrade and do have different purposes.

    Centrally-Controlled vs. User-Controlled Upgrade

    The date which is event-based could be the starting point of the deployment or a forced and fixed upgrading date. I usually recommend that we (administrators) define the time frame where the upgrades are available (1-4 weeks - afterwards forced) and the user defines the point in time, when he initializes the upgrade. Depending to your environment either the one or the other or even both methods could make sense and should be used. This is something that you have to discuss. If the user initializes the upgrades he definitely needs to be aware of, what that means for him and his machine. (1h upgrade time)   Okay - let us take now a closer look to the collection numbers. What are the right numbers for collections? To discuss this question let us take a look at the 3 areas in detail:

    Plan & Prepare / Insider

    As you have read above, the main target here is to evaluate new or possible deprecated / removed Features and probably aswell some or all LoB Apps. How many collections do you need in the space of the Insider Preview / Plan & Prepare? I would say - not much. One might come into consideration - for example with a virtualized machine, which can easily be rolled back to defined checkpoints and easily by repaired by recreating it. This one could also be greatly shared along different teams to connecting remotely to it. But using also some dedicated machines should be discussed. (2nd devices, dedicated testing machines, etc.) You would configure Insider Preview - Fast Ring on these machines. Additionally you could add two more rings and having the following three:
    • Insider Preview - Fast
    • Insider Preview - Slow
    • Preview Release

    Targeted Deploy / Semi Annual Channel (Targeted)

    Okay - now it gets more complicated. What are the first aims in the Targeted Deploy? Definitely to set up the client configuration and to get everything ready for broad deployment: You would probably set up machines for the GPO team and Application Testers on VMs or dedicated machines and so on. You should take a look at your complete task list and decide whether you need a specific collection for some tasks and define the earliest time of usage. Targeted Deploy - Reactive Testing This part is for sure some of the biggest challenges. As you have read you should target a transversal cut of:
    • Applications
    • Organizational Units
    • Network Segments
    • Geographical Locations 
    and divide them into representative collections. For this you will need many information and some script / tools to assist you in doing this. I will discuss some of the ideas in the Technical Approach later in this article.

    Testing Rings

    In targeted deploy you want to get as soon as possible ready to push out your testing rings. In the example I am starting the "UserAcceptanceTest" (UAT) 40 days after release and the "Testing Rings" after 70 days. The earlier you can address this - the better! A good advice here is to upgrade around 10% of all the devices in your environment in Targeted Deploy to be ready for broad deployment. You don´t want to find any suprises in Broad Deployment - therefore you provoke them as soon as possible. (By experience these suprises are easily handleable as long you detect them very early and in small number counts!)  

    Broad Deploy / Semi Annual Channel 

    In this phase you push out the higher numbers - depending on how many rings you want to define here and how many clients you have in total, you could easily have numbers above 10k for one collection. In the middle you see the group of sensitive machines and VIPs. There may be this kind of machines which should possibly never fail / or you want to reduce the chance for this to a very maximum. In the end you have the Compliance Cleanup where you want to make sure to address the computers, which had problems and did not upgrade properly. A good idea would be to set up collections finding all the computers which are sitting on the old version and then pushing out another upgrade. The last instance would be to reinstall them - surely with the newer OS Version on it.

    Defining the numbers of total rings

    We can easily ignore the Insider Preview / Plan & Prepare Phase for this, because more than 3 rings in this phase wouldn´t make sense at all. But speaking of the rings placed in SACT and SAC this decision could easily get harder. I want to show and discuss the following numbers: For Insider Preview you could set up 1-3 and letting the machines always upgrade for themselves as configured. (Fast / Slow / Release Preview) For Targeted Deploy I would always say the absolute minimum is 3. You will need one at the very beginning, but you want also to start reactive testing at the end of the time span. For Broad Deployment you should evaluate the number of clients in your environment, aswell the number of locations and possibly also the number of OUs or the specialization of your teams. The more complex your environment is - the more rings you should just use to control the impact. And how many do you exactly need? It depends. I would say a pretty solid approach is the illustrated 1 - 8 - 12 - 2 approach. If your company has more than 50k Clients I would definitely recommend starting to increase the numbers. After hitting 100k you should evaluate the maximal recommendation count. I hope that you also did understand till here, that these collections don´t need to be created nor filled manually.

    Technical Approach

    Okay - as we have read now all the theoretical approaches, we should move on and trying to adopt it technically. This part is actually the most simple one, after you have determined all the processes and also planned for a specific number for all the rings. To give you an overview we should take a look at the possibilities and evaluate them:
    • Windows Update for Business
    • WSUS standalone
    • System Center Configuration Manager + WSUS
      • Upgrade-Tasksequence
      • Servicing Plans
    • Third-party Deployment Tool
    More information here.

    Windows Update for Business

    WUfB is the client-side Windows Update Agent which is configured via GPOs. As for know these GPOs look like this (SAC and SACT will show up in 1709): More information here. As you see you can choose between the different "States" of the OS and postpone it by days, which was decribed in the previous topic "rings". The main management would be done with GPOs or even AD groups to set up the rings. This technology should be considered for devices, which are mainly attached to the Internet. You should also configure some kind of caching technology - for WUfB this would be Delivery Optimization: A good way of controlling which computers share with each other is configured as "LAN" and also by "Group". By "Group" can be configured to your specific environment - you would then also define the specific groups via GPO: More information here. The good thing about WUfB is that the Windows Update Agent gathers by default with UUP only the delta ESD material for Upgrades. (read here)

    WSUS standalone

    There are not many companies which are using WSUS standalone, though it is also possible to apply the ring-model to this:   We have improved our official docs - take a look here for a real good description, how it can be configured.

    System Center Configuration Manager + WSUS

    In this area we have actually two possible ways for adoption:
    • Upgrade-Tasksequence
    • Servicing Plans
    The main difference between these two is that in the Tasksequence a complete WIM is used, where in Servicing Plans you are sending out the Feature Updates consisting of an delta ESD. We are technically speaking from a difference of 3,6GB vs approx. 2GB. As you have read this you may think, that Servicing Plans is the way to go. It is, but unfortunately it seems that no customer has even tested Servicing Plans and the cause is pretty understandable. The Upgrade-TS is a known and very approved way how to create and work with deployments in SCCM. All admins know how it works and how to set it up. Additional to this - lazy - argument you can also include easily and many steps before and after the upgrade. In the past this may be often been necessary. e.g. till Windows 10 1703 all apps were reinstalled to the computer and there have been some issues with Language Packs and some of the Personalization Settings. We are working on these issues and targetting an upgrade without the necessity for too many post-upgrade tasks. As for know my personal recommendation is this:
    • Implement the Upgrade-TS with all necessary steps
      • communicate necessary steps / cleanup tasks / neccesities for repairs to TAMs / PFEs
    • Build up the structure for Servicing Plans aside
      • Define the rings
      • Define the collections and what computers are in there
      • Train yourself and get the understanding how it is working
      • Understand the Reporting
    As you have read you may have catched that I personally think Servicing Plans will replace Upgrade TS pretty fast in the future. Let us take a closer look and you will see some more arguments for Servicing Plans.

    Upgrade-Tasksequence

    The Upgrade-TS gives you control to define a complete workflow before and after the upgrading process. This unfortunately allows to do steps, which are normaly not intended to be done in Upgrade. Examples for don´ts:
    • Upgrading applications before OS Upgrade (Application Lifecycle Management! Update the package in your environment before moving to next OS version)
    • Upgrading all your software ( you should have a working Application Lifecycle Management in Place continuously updating your applications!)
    • Reinstalling all your software - just in case (What ? no. Find the errors why upgraded packages / applications stop working after an upgrade and fix them correctly in the package itself)
    • [...]
    There might be some scenarios where additional steps are necessary and therefore Upgrade-Tasksequences are the better choice. Example for do´s:
    • Moving from BIOS to UEFI --> MBR2GPT
    • Moving from 3rd-party disk encryption to Bitlocker
    • Multi-Language environments with unsolvable issues (till now)
    • LTSB feature updates. With the LTSB servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade.
    • [...]
    The problem with this technology is the requirement to prepare all collections in the first steps for all the rings and the necessity to fire each ring manually or by script. This needs a huge workload as overhead to automate WaaS as described. I don´t say it is not possible - it actually is, but I doubt that this kind of time investment is necessary for the adoption of all rings. Therefore I recommend only using Upgrade-Tasksequence for manual deployment and not as complete solution for the rings. More information here.

    Servicing Plans 

    This whole article is actually targetting Servicing Plans. Let us take a look at the Servicing Dashboard: (old namings visible - I will replace with newer and better pic asap) I  recommend reading the great blog article from Niall C. Brady, Enterprise Client Management MVP - it is a perfect guide for how Servicing Plans are manually created. So you would set up the rings with automatic deployment rules to trigger at the specific events, which you configured. This is actually the exact thing we need to have. The good thing about this - you just need to configure it once - it will reapply for every coming OS Version. (main difference to Upgrade TS) You should also take a look at the PowerShell CmdLets: New-CMWindowsServicingPlan, Get-CMWindowsServicingPlan, New-CMCollection, New-CMSoftwareUpdateDeploymentPackage, Get-CMSoftwareUpdateDeploymentPackage, Get-CMWindowsUpdate, Save-CMSoftwareUpdate,  Start-CMContentDistribution     For automating the creation with PowerShell you could easily create the collections, the deployments and the ServicingPlans via Script: Take a look here or here from Kaido Järvemets.   I am currently working to set up some clever script to allow the creation of the collections, the plans and the more complicated queries for the collections used. (next topic) Also in comparison to the Upgrade-TS there IS also the possibility to initialize post-upgrade tasks. Take a look here. And more information here and here. 

    Third-party Deployment Tool

    It depends to your third-party deployment tool, if it is capable to deploy and control Feature Updates in an automated manner AND with using Delta ESD material. If it does - good. If not - I would always recommend to use some of the described technologies. WUfB or WSUS standalone should come here into consideration and be discussed.

    Filling Collections with representative Devices for Reactive Testing

    This part is for sure some of the biggest challenges. As you have read you should target a transversal cut of:
    • Applications
    • Organizational Units
    • Network Segments
    • Geographical Locations 
    and divide them into representative collections. For this you will need many information and some script / tools to assist you in doing this.  Setting up well-chosen collections is the point where all this model could shine or either collapse. Unfortunately to its importance it is also - I would say - the most challenging part of this all. Let us take a look at the different targets:

    Applications

    You want to reactively test all applications to not running into any suprises in the broad deployment, where you deploy your upgrade to larger collections. So you are provoking on purpose possible problems to find them as soon as possible to have enough time to react. The idea is pretty easy. The problem - do you have a complete list of all your applications and can you define good testing machines? As mentioned in my last extensive article you should work in collaboration with the Application Holders. One approach can be to allow them to define test users. Another approach would be to let the user define his collection by himself. I will get into this later in "What I am working on"

    Organizational Units

    This is easy possible with a PowerShell Script running through all OUs and picking a by algorithm defined number of devices and moving them into the first collections. You want to do this to have the additional safety to not miss some applications out and also to validate some coincidences with GPOs.

    Network Segments

    This is about bandwith and about clever caching. By configuring - for example - the Windows Update Delivery Optimization for NAT and upgrading a small number of computers in each location, you will have caching points in place without the necessity to reevaluate this all the time. This information could be retrieved via Script from SCCM.

    Geographical Locations

    With this marker you just want to make sure not to find any special locations with dedicated networking problems. It should be included in OUs and Network Segment, but you should just make sure that you did not miss any location out in your tests. May be there is some naming convention in the device names which allows you to identify the locations - or it is managed via OUs.

    What I am working on

    I am working on two possible approaches
    • PowerShell Script / Module / Tool with UI to create the rings manually, semi-manually (changing) and automatically - the idea is to define all the rings till "Targeted Deploy" C6-7 (semi-)manually and the rest automatically by just dividing the left devices into chunks and spreading them with an algorithm into all the collections
    • Tool to allow the User himself from a client to move him into specific collections
    Let me know your ideas and feedback - are there any other ideas to be discussed?

    Exception Handler

    What do you do, when you encounter some problems / application incompatibilities?  As described in my last article you should have up some workflows for these situations. Working with Servicing Plans (and all other technologies) you can always pause the current deployment and just continue it, when you have fixed the cause.

    Further Improvement

    After reaching this kind of automation there will be still space to improve: Knowledge and Information Management
    • Update of central information stores (OneNote / SharePoint / Teams) and pushing out email to IT Teams / End Users automatically at a specific event
    • Preparing the layout of emails
    • Setting up Meetings automatically
    • Setting up Webinars automatically
    Reporting / Alerting
    • Automatic control of reports
    • Sending emails on defined SLAs automatically
    • Sending out reports automaticaly
    Automatic creation of Compliance Cleanup Collections
    • Automatically inform the impacted users of the state - warning and advising them
    • After defined alerts automatically create cleanup collections for forced upgrades or reinstallations
    • Send out automatically reports of its success
    Longterm Roadmap
    • Plan longterm adoption of technologies
    • Define target versions for specific OS releases
    • Create more automation around this
      • Information and Knowledge Management
      • Setting up defined Meetings automatically
      • Automatic Involvement of Finance Team
     

    Summary

    If you have come this far I am very proud of you. (Yeee... too long - I know) What are the main points? You want to have the information at the earliest point in time where you could get it. You want to mix proactive and reactive testing depending your company. (more proactive or more reactive) Workflow:
    • Set up processes and work with project management techniques
    • Understand and define rings
    • Define a method for upgrades: fixed date (centrally-controlled) vs time frame (user-controlled upgrade)
    • Implement the rings technically
    • Keep automating additional recurring steps - like:
      • Knowledge and information management
      • Reporting / Alerting
      • Automatic creation of Compliance Cleanup Collections
      • [...]
    • Address Feedback to us
     

    TL;DR;

    Automating the Windows as a Service Model is possible and I actually recommend doing this for EVERY enterprise customer. You will need some time in the preparation phase and setting up the whole process, but in the end you will save a huge upcoming and recurring workload.  By defining well chosen computers into your rings you predefine the possible impact and completely control your testing approach. The best toolset for this task is probably SCCM with Servicing Plans, but it is also possible with WSUS standalone or Windows Update for Business (or even a third-party solution) - you have just to implement the automation steps. The target must be to set up an technically automated environment where every team and user (who may need this information) at every time know, on which phases is currently being worked and what follows. It needs to become a always recurring adoption cycle where manual tasks should consecutively being replaced by automation / scripts / automatic processes. The outcome will be to integrate Feature Updates mostly in the operative work. If you ignore this recommendation you might end up struggling a lot.
    Thank you all and I hope it was somehow helpful and you could take some points for your environment out of this huge article. All the best,
    David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>         How to become a PowerShell Pro - v2 https://docs.microsoft.com/archive/blogs/daviddasneves/how-to-become-a-powershell-pro-v2 Sun, 06 Aug 2017 16:11:19 GMT https://blogs.msdn.microsoft.com/daviddasneves/?p=615

    First - Why PowerShell?

        PowerShell is the main language to adopt any Service (Cloud / On Premises) on any device (Windows / Linux / Server / Cloud). Raising the adoption of PowerShell will be an enabler for everyone getting their first steps into Automation, new Services and central management. It is a prerequisite for cloud deployment, manageability and DevOps in general. (e.g. MCP certificates contain huge PowerShell parts – especially the Azure certificates.) Also coming with Windows as a Service and the Digital Transformation everyone has to change their existing processes and tools into the modern direction and increasing the level of automation where PowerShell helps a lot.    

    TL;DR;

    I worked out a learning plan to give you simple advice how to jump into this great scripting language! I will list up the best material you should work on at a specific learning point. (as for my own personal experience) But keep in mind - this could vary for you. Persons are different as also their learning types. Some persons need to hear and see the things to capture the input better. Others learn best by reading and some need to interact as by writing. But one thing is for sure - you will need a lot of practice and you will need to write scripts by yourself!  

    Starting tips:

    A good thing is to store your knowledge for future use by creating your own "knowledge base". Here you store all nice solutions or code snippets, which you may need in the future. By writing them down and testing them you strengthen also your knowledge. Don´t forget to manage it nicely to find everything later on. You will also need a "Script-Store" where you can store your complete scripts in the future. If you haven´t done that yet - the time to do this is now. Also a very important point: Get to know what Powershell best practices are and respect them. When your scripts become larger or if you use scripts in an productive or business environment you don´t want to learn by yourself why best practices had been made to "Best Practices". The PowerShell Best Practices and Style Guide And here

    Beware!

    I see many admins out there copy/pasting scripts from the internet and using it in their production environment. From the experience I see in the field - most of the admins can be divided into three sections:
    • The ones who don´t like to code and only very hardly understand what some specific code is doing.
    • The ones who don´t like to code but can read code and understand what it is doing technically.
    • The ones who like to code and can read and write code with the understanding what it is doing technically.
    Please don´t use code which you did not write and/or do not understand. Sometimes some specific code is working under specific circumstances but it may break your complete environment if something changes.

    Beginner:

    First you need to get in touch with the Powershell basics and this may be the scripting basics if you don´t have a developing background. Herefore i can only recommend the godfather of powershell himself - Jeffrey Snover. He has made some very nice online trainings which can be found on the Microsoft Virtual Academy. When you watch the videos, try to test the methods by your own. Pause the videos, if you want to test something out: Pure basics: Getting Started with PowerShell 3.0 Jump Start Continuing basics: Advanced Tools & Scripting with PowerShell 3.0 Jump Start After having watched the videos, you should try to work out some scripts by yourself. You need to know the basic Cmdlets and how to work with them. Use Get-Help as much as you can. A good book to start with is this one:
    Learn Windows PowerShell in a Month of Lunches, Second Edition
    Don Jones and Jeffery D. Hicks, 312 pages
    Additionally all the PowerShell videos in the Microsoft Virtual Academy and Pluralsight are very helpful! Some of the best PowerShell trainers have videos on PluralSight which you should take a look at: PowerShell, Pester, DSC, Azure, etc.
    And as always - get your hands dirty! In coding you always learn the best when you write the code snippets and functions by yourself. Most of the time there can be found code in the internet which does something similar you want, but you won´t learn anything by copy-pasting it!

    Intermediate:

    This skill level assures, that you can write some easy script lines and small scripts by yourself, but you have to google/bing a lot to achieve your aims. This skill level is the hardest to proceed. Here you have to strengthen all your skills: You need to get to know the most used commandlets and how they work - and this in combination with some powershell techniques. You have to fill all your gaps in the powershell scripting basics and many more. But you should not extend your knowledge massively. Keep your eye on the basics - these must be known perfectly to have a good fundamental. Do not dive into some very rare powershell deep dives - better you concentrate on daily work tasks. Very good resources for this step are the cookbooks of Dr. Tobias Weltner which can be found here: CookBooks by Tobias Weltner Afterwards you could go deeper with the next book, which is also written by Don Jones and Jeffery D. Hicks. Personally i think that this book can also be skipped. But if you read a lot and don´t worry about the money take it in your journey: Learn PowerShell Toolmaking in a Month of Lunches Don Jones and Jeffery D. Hicks, 368 pages At this point you should also join a forum where you can read the questions and should try to understand the solutions and the solution scripts. For this I can recommend the Windows Technet in English Windows Technet Forums - Powershell - English and the PowerShell.org Forums: PowerShell.org Forums Get also in touch with WMI. Be sure that you could answer the simple answers like - what is it and how can it be browsed and used.

    Advanced:

    This skill level assures that you are stable with the most important commandlets and you have just written some scripts, but need the knowledge of rarely used techniques or deep diving procedures. Go to a Forum and try to answer the posts. Look at the solutions and compare your solutions with other ones. A perfect book at this time is the following:
    PowerShell in Depth, Second Edition
    Don Jones, Jeffery Hicks, Richard Siddaway, 744 pages I personally loved this one - it is very comprehensive (though missing a lot of the basic stuff) and delivers very nice examples which could be used in your daily work. Also it shows some nice techniques in Powershell, which you won´t find in other books and is therefore worth reading, even if you think, that you have mastered Powershell.
    At this point you should also take a big deep dive into Regex and how to use it with Powershell. If you are good in Regex you can easily parse everything. I would suggest to buy a dedicated book for this task. An additional topic at this point is to learn how to write good and reusable code. Following keywords should get into your repertoire: Function, Module, Signing, Pester, Help-documentation, Release-Pipeline and much more. Take also some visits to usergroups or conferences. Learn from the best. And at last - keep an eye on active powershell blogs or even better - blog by yourself.

    Pro:

    So - here are we now - the Pro level. Do you think you cannot improve your skills anymore? Then you are absolutely wrong - that´s for sure. One very important point is to know, how Powershell works under the hood and fully understand “why” and more “how” PowerShell is working. So you need to know the basic and also deeper knowledge of .Net. I absolutely recommend to learn C# and later on XAML/WPF. A good book ( if you haven´t read it till here) is the following: “PowerShell in Action” by Bruce Payette At this point you should start your own projects. Grab a nice topic which is rarely described or very new and dive into it - or create some nice tools which can be used by many preople. And - share them! Pros learn best - from other pros. Spread your network - speak at conferences / usergroups / everything you like. And - if you have the time and motivation you should also read more books. By this you harden your basic skills and may be you find some new tricks or nice techniques to extend your own knowledge. And the most important suggestion - never stop learning. Keep an eye on the street - we are driving in a fast car and the street changes every day.

    Thriving PowerShell in the field

    Everyone can make the change! Learn how PowerShell works and share your experience and knowledge. Try to deliver presentations at our UserGroups / PowerShell Saturdays / PSDays / PowerShell Conferences! No one will kill you, if you don´t know everything - it is about sharing your knowledge on potential new or raising topics. Meet the professionals - ask questions and collaborate! PowerShell is still not commonly spread - there are many admins out there who use it very rarely and many of them because they have to. Show them what the power of automation can look like and that it is not hard to get there! The best way to stay up to date is visiting conferences and taking a look at current blog articles. Twitter is a good way to follow members of the PowerShell Team or some of the speakers from conferences which share their knowledge and new findings very regularly!

    Dedicated topics:

    Coming with PowerShell there are topics you may take a dedicated look at. One of the first huge topics is "PowerShell Security". I have written an extensive blog article, which you should go through: Powershell Security at Enterprise Customers Further on you may also take a look at the following topics in depth:
    • DSC
    • DevOps - Release Pipeline
    • JEA (Just Enough Administration)
    • Using PowerShell for dedicated technologies
      • Active Directory
      • Sharepoint / Exchange
      • O365
      • Azure / Azure Stack / other Cloud-products/services
      • Hyper-V / VMWare products
      • Client / WMI / Win API calls
      • Linux / Bash
      • Blue- and Red-Teaming / Malware Frameworks, Forensic Frameworks, Pentesting Frameworks
      • System Center products
      • Operations Management Suite
      • IoT / Win 10 IoT Core
    • and many more
    Regarding all this topics you need to know some architectural information and also how the cmdlets are named and can be used efficiently.

    What´s next?

    You think you have mastered PowerShell? That´s great! But PowerShell is only one of the first steps. Depending on what topics you want to focus on - you should never stop learning. These are some of the possible good follow-ups:
    • C / C++ (Security)
    • Python, R and many more (AI)
    • C# (how does PowerShell work under the hood? - professional software development)
    • F#
    • bash
    • Cloud Services
    • IoT
    • ....

    Additional materials:

    Take a look at this materials - many of the links are just a 'must-see'. Windows PowerShell Survival Guide Windows PowerShell Cookbook” by Lee Holmes 2017 New Years PowerShell DevOps Study List Hitchhikers Guide to the PowerShell Module Pipeline Powershell Security at Enterprise Customers Building a Simple Release Pipeline in PowerShell Using psake, Pester, and PSDeploy Testing PowerShell with Pester DevOps - Enabling DevOps on the Microsoft Stack How Do I Learn PowerShell? Learning PowerShell - GitHub Best Free PowerShell Training Resources PowerShellMagazine PowerShell Page

    Communities & Blogs:

    Collaborate, ask questions and share your knowledge! UserGroups German UserGroups PowerShell Conference EU PowerShell Conference Asia Windows Technet Forums - Powershell - English PowerShell Team Blog Hey, Scripting Guy! Blog Best PowerShell Blogs
    I hope you enjoyed my recommendations. If you have any other material or you absolutely disagree with me in some point please let me know. Best regards, David das Neves Premier Field Engineer, EMEA, Germany Windows Client, PowerShell, Security ]]>