As you may or may have not heard I switched roles here at Microsoft and I’m no longer a Technical Evangelist.  I’m now a Technical Solution Professional focusing solely on Enterprise Mobility + Security.  It’s a seriously fast growing part of our business and if you want to keep up with what’s going on make sure you bookmark the Enterprise Mobility + Security blog.  All updates will be posted there.

Of course locally we have a number of partners working in this space.  One of those is Dilignet and they are running an event focused around what they offer in the EM+S space.  Please the details below of the Borderless Protection event:  www.borderlessprotection.com.au  The event is December 2nd in Melbourne and you register at the site above.

Overview:

Borderless security is an enterprise grade mobile security solution. Borderless Protection addresses all aspects of the security puzzle:  Identity Management, Mobile Device Management, Information Protection, Advanced Threat analytics, Productivity, to help you simplify your mobility solution.

By securing users, devices, and information in parallel, you can collaborate securely on any device, and maintain enterprise level of auditing and control. Our subscription-based service offers a per user per month model, aligned to OpEx, that blends Dilignet’s cloud support expertise with your own IT support team’s experience.

And below is a short video that explains what the service is.

Jeffa

Progress doesn’t drive itself.  It’s propelled into the future by ideas. By technology.  By people like you, who love innovation and what it can do.  And for four days in February, Microsoft Ignite Australia is at the epicentre of it all and brings together Developers and IT Pros.

We rely on the expertise and creativity of our speakers to make it a successful event and we are pleased to invite you to participate in our Call for Content.

This year, Microsoft Ignite Australia will offer 10 tracks across a range of products and technologies.  Familiar favourites such as Architecture, Cloud, .NET, Windows, Productivity and Datacentre and Infrastructure Management will feature across 170 sessions throughout the event to ensure attendees can master the skills they need.

We’re also shaking things up to include sessions covering new topics that tech audiences need to know about. Data & Analytics, Innovation, Hack@Ignite and a dedicated Open Source track will ensure attendees will gather new ideas and build their knowledge.

Review full track descriptions now >

The Call for Content tool is now open and you can submit a session before 15th October 2016.  To enhance the success of your submission, please prepare your content to ensure it provides Ignite attendees with comprehensive technical readiness to inspire and succeed in their career. Your content should focus on level 300 / 400 to ensure it aligns with the expectations of Ignite attendees.

Get those creative juices going and start submitting sessions now >

Below are some additional tips for a successful submission:

• A short, catchy but descriptive session title to match content is a must
• Descriptions should be limited to 300 words and entice people to want to attend your session
• Be sure to showcase your speaking experience
• Build your presentations with 60-65 mins of content and allow 10-15 mins for Q&A
• Ignite is about technical readiness so focus on the technology – attendees don’t want to hear marketing in your content

Good luck with your submissions!

Jeffa

If you are in Melbourne and want to hear all the latest updates on Windows 10 then we have an event for you.  Myself and Andrew McMurray will be running a 1 day TechNet Update dedicated to Windows 10.  All the details below!

Join Microsoft Australia as we bring together local Microsoft experts and share the latest information around current and upcoming Microsoft technologies.

This TechNet update is all about Windows 10 which has been out for almost 1 year now. We will focus on what’s coming in the Anniversary update later this year and then deep dive into deployment with 2 sessions covering everything you need to know.

After lunch we will then dive into runtime provisioning in Windows 10, what’s new in security and finally how to manage and deploy Windows 10 with Windows as a Service.

There will be a prize draw at the end of the day so make sure you stick around for that!

Date:  June 29th 2016

Location:  Pullman on the Park, 192 Wellington Parade, Melbourne VIC 3002

Registration:  Please click here to register!

We still have plenty of seats available so if you are in an enterprise, mid-market or a small business then register to hear all the latest on Windows 10!

Jeffa

Hi everyone,

I wanted to alert you to a new website called Ready for Windows!  It’s a new site where ISV’s can list their applications as compatible with Windows 10 and business customers can check to make sure the apps they use everyday are certified to run on Windows 10.  More details below!

Windows 10 is off to the fastest start in Windows history with over 300 million active devices, outpacing Windows 7 by 145%.  As a software provider it’s important to let your customers know that you support their choice to run their applications on Windows 10.  With the majority of Enterprise customers actively piloting Windows 10 and large scale deployments already underway, now is the time to create support statements for Windows 10, and list your applications on Microsoft Ready for Windows.

What is Ready for Windows?

ReadyforWindows is a new web site that makes it easy for ISVs to list Commercial applications that support Windows 10 and generate market visibility for your applications.  All you have to do is create a public support statement for Windows 10 and complete a short application (that takes 1–3 minutes), and Microsoft will notify you of your listing within 5 business days.

Why should you list your apps?

Once an application is accepted, the solution(s) will be listed in the directory for anyone looking for Windows software providers.  Business customers will be able upgrade to Windows 10 with confidence knowing the business solutions they rely on are Windows ready today.

So if you are an ISV and develop apps for Windows 10, make sure you list them on the Ready for Windows site, and if you are customer make sure you check out the site to see the apps that are already listed!

Jeffa

Troubleshooting Network Security Groups

Are you using NSGs in the Azure Resource Manager Model and want to troubleshoot why something isn’t working? ARM now offers diagnostics on NSGs but at first glance this appears rather difficult to get to and understand the data.

The manual steps to get to these logs would be follows:

1. Find the VM, identify the NSG, and view the diagnostics on the NSG to locate the storage account.
2. From the storage account, drill down through the 14 levels of folders inside the container to find the log file relevant to the date and time you are after.
3. Get the path to the file then use a GUI or command line tool to download the file from Azure storage (including more clicks through the console to get the storage keys).
4. Open the 15MB file in a json parser and try to make sense of the data.
5. At this point you will need to go back to the VM to determine the MAC Address to filter the data based on that, and then enumerate which rules and time that you were interested in.
6. Then you realize that the matchedconnection counter looks rather big, and as you discover this is incremental you need to look back to the last value to see the changes for that period.

If you get through all of those steps, well done, but the likelihood that you will do them again manually is low.

So... PowerShell to the rescue. Initially some of the above steps seem rather difficult with PowerShell, but I will walk you through the challenges to make a nice clean script that you can use to easily get the usage data on your Azure NSG rules. This data will give you a view of how much traffic you are getting allowed or blocked on a per rule basis per VM.

A few variables we need to know to start:

$ServerName = "kgtestvm"

$NSGName="kgtestvm"

$NSGResourceGroup="KG_Resource"

$ServerName is the name of your VM

$NSGName is the name of the NSG attached to that VM (either at the VM level or the subnet level)

$NSGResourceGroup is the name of the resource group where that VM resides

Next step is to login to Azure.

              Login-AzureRmAccount

Now we will go and get the network interface and NSG objects.

$NSG = Get-AzureRmNetworkSecurityGroup -Name $NSGName -ResourceGroupName $NSGResourceGroup

$NICs = Get-AzureRmNetworkInterface|?{($_.VirtualMachine.Id).split("/")[-1] -eq $ServerName}

$TargetMACs = $NICs|%{$_.MacAddress.Replace("-","")}

The NICs are needed to get the MacAddress which is needed to filter this log to this server only later in this script. I am using a bit of pipelining and powershell shortcuts to keep this short and sweet. Here is a bit of explanation:

• The “?” on the NICs line is a filter and the text inside the filter looks for the last element (-1) of the VM Id string linked to the NIC (split on “/”) that equals the name of the VM.
• The % is a foreach and the replace takes the dashes out of the MacAddress to match how it appears in the log.

Next we get the details for the storage diagnostic account where we need to get the log from:

              $DiagSetting = Get-AzureRmDiagnosticSetting -ResourceId $NSG.Id

if ($DiagSetting -eq $null -or -not(($DiagSetting.Logs|?{$_.Category -eq "NetworkSecurityGroupRuleCounter"}).Enabled)) { throw "There is no diagnostic logging on the '$($NSGName)' NSG." }

$StorageResGrp = $DiagSetting.StorageAccountId.Split("/")[4]

$StorageName = $DiagSetting.StorageAccountId.Split("/")[8]

$DiagStorageKey = Get-AzureRmStorageAccountKey -ResourceGroupName $StorageResGrp -Name $StorageName

Two things to note in that code:

• Check that there is a diagnostic setting and that the counter logs are enabled. Otherwise there are no logs to look at.
• The splits on the $DiagSetting get the relevant details out of an id string for the storage.

Go and get the latest blob:

$connectionString = "DefaultEndpointsProtocol=https;AccountName=$($StorageName);AccountKey=$($DiagStorageKey.Key1)"

[Microsoft.WindowsAzure.Storage.CloudStorageAccount]$storageAccount = [Microsoft.WindowsAzure.Storage.CloudStorageAccount]::Parse($connectionString)

[Microsoft.WindowsAzure.Storage.Blob.CloudBlobClient]$client = $storageAccount.CreateCloudBlobClient()                  

$container = $client.GetContainerReference("insights-logs-networksecuritygrouprulecounter")

$Blob =  $container.ListBlobs($null,$true)|sort {$_.properties.LastModified}|select -Last 1

This is where I stop using Cmdlets and start using .NET. The reason for this is because the cmdlets do not allow me to get to a diagnostic log when the path is too long… as most diagnostic paths are because they include full id, all names and group names, and the year, month, day, hour.

E.g. resourceId=/SUBSCRIPTIONS/XXXXXXXX-YYYY-ZZZZ-AAAA-BBBBBBBBBBBB/RESOURCEGROUPS/KG_RESOURCE/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/KGTESTVM/y=2016/m=03/d=08/h=08/m=00/PT1H.json

• The above code gets the newest blob (sorted by date and last selected) and stores the blob object into $blob.

Now we can download it and parse it all in one magical line:

$Records = (convertfrom-json ($Blob.DownloadText([System.Text.Encoding]::ASCII))).records

The magic:

• Rather than saving the blob and then opening the file, this opens the blob straight into memory using the DownloadText and specifying ASCII encoding.
• Then it runs the easy Cmdlet of “convertfrom-json” to convert the file format into an array of hashtables that can be easily consumed by PowerShell.

Last.. let’s look at the data:

$Records|select @{L="DateTime";E={Get-Date -Date $_.time}},@{L="rulename";E={$_.properties.rulename.Split("/")[-1]}},@{L="matchedconnections";E={$_.properties.matchedconnections}},@{L="macAddress";E={$_.properties.macAddress}}|?{$TargetMACs -contains $_.MacAddress}

• A little bit complex to look at, but all it is doing is getting the relevant data out:In a select statement @{L=ColName;E={Expression}} does calculations on the fly and makes new properties of them. So:
• DateTime is the datetime conversion of the WMI date style string
• RuleName is a subsection of the rulename string hidden under properties
• Matchedconnections and macAddress are the strings hidden under properties
• Then I filter to the MAC addresses that were collected earlier. Given this is an array because a VM can have more than one NIC, I use contains instead of equals.

So we get out something that looks like this:

A breakdown of hits per rule given for all rules every 5 mins. When interpreting this please note the following:

• The matched connections are incremental and reset every hour. So 2 consecutive values of 5 mean no additional traffic in those 5 mins. A jump from 5 to 6 would
  be one connection in those 5 mins.

What can we do with this? While there isn’t much data right now you will need to generate more rules to see a breakdown of connections. But this is a good building block for analyzing diagnosis data stored on Azure Blobs.. and I get the feeling that this data will be extended on over time. Given this script parses the Json, it will be easy to consume new changes.

Jeffa

Since the release however there have been many changes including the November 2015 update.  So with that my colleagues in APAC are running a 4 part webinar series all about deployment, management, security and what the new OS means to enterprises.  The first event starts March 17th 2015 and continues for a each week after that.

During each of these webinars and for 30 minutes after each event we will have experts, including me, online to answer your questions.  So make sure you get in and register and we’ll see you all online during the webinars.

#1. Windows 10 for businesses of any size
Thursday, March 17, 2016
First, we will give you an overview of Windows 10 and how it enhances worker performance. This introductory webinar will show how familiar UI features take productivity to new levels, and how we have created a converged experience for multiple screen sizes.
Register here

#2. Preparing your environment and deploying Windows 10
Thursday, March 24, 2016
In this session we will introduce the concept of Windows-as-a-Service and help IT teams prepare for a Windows 10 upgrade. He will show you how to manage deployment and updates.
Register here

#3. Windows 10 for device management.
Thursday, March 31, 2016
In this session we will demonstrate how Windows 10 helps businesses of any size deliver the full mobility experience for employees and simplifies device management. Our expert will demonstrate how to use different Active Directory setups to seamlessly manage identities.
Register here

#4. Windows 10 security.
Thursday, April 7, 2016
Windows 10 includes new tools to protect information workers against modern threats. In this session we will show you how to lower the risks of data being stolen or misused and how to prevent unauthorised downloads.
Register here

Jeffa]]> https://docs.microsoft.com/archive/blogs/jeffa36/free-ebook-microsoft-intune-step-by-step Mon, 29 Feb 2016 16:23:02 GMT https://blogs.technet.microsoft.com/jeffa36/2016/02/29/free-ebook-microsoft-intune-step-by-step/ If you have or are about to deploy Microsoft Intune make sure you check out this free Ebook from one of our MVP’s in the System Center space.  Mai Ali demystifies the implementation and configuration process for Microsoft Intune.  Here is an outline of what’s covered in the book:

• Chapter 1 - Definition of Microsoft Intune.
• Chapter 2 - Configure Microsoft Intune.
• Chapter 3 - Implement and Configure ADFS for Single Sign-ON.
• Chapter 4 - Create Intune groups to organize users and devices.
• Chapter 5 - Set Mobile Devices Management (MDM) Authority.
• Chapter 6 - Create Mobile Management Policies.
• Chapter 7 - Manage Computers Using Microsoft Intune.
• Chapter 8 - Deploy Applications Using Microsoft Intune.
• Chapter 9 - Configure Alerts, Notifications and Reports.
• Chapter 10 - Enroll Mobile Devices in Intune.
• Chapter 11 - Configure Mobile Application Management policies “MAM”.
• Chapter 12 - Resource Access profile with Microsoft Intune.
• Appendix - Firewall Ports and Proxy Server Settings for Client Computers.

So make sure you check it out here!

Jeffa

I know we are all time poor and it’s hard to attend every possible event in person.  So my good colleagues in the US are putting on a virtual event called TechNet Virtual Conference 2016.  The event runs from March 1st – 3rd 2016and is an online event that promises 3 days of technology, inspiration and fun!  I had a quick look at the agenda and it looks like they have 3 days of good stuff planned.  Hey they have my good buddy Rick Claus and Mary Jo Foley hosting the first day so it should be fun!

If you live in  Australia you most likely won’t be able to attend the event as it happens so it’s all being recorded and will be available at:  https://aka.ms/technetvc

Check out the website for more details of the agenda and make sure you save the date for details of how to watch.

Jeffa

I wanted to alert you to a great community driven event coming up in March that has been running in Asia for a few years now, and is coming to Australia for the first time.  I’m going to be presenting in the keynote so you have even more incentive to come!  For more information and details of the event please see below!

For the first time ever, System Center Universe is coming to Australia in 2016! This is a first-class community conference where you can mingle with experts and fellow industry professionals to explore new technologies. The conference has been running for many years in Asia, typically Singapore and Malaysia and also in Europe and USA.

This one-day event will be showcasing upcoming System Center solutions and Microsoft Azure cloud technologies with the latest Windows 10 to be held at the Crown Promenade Melbourne on Friday 11th March.

Hear firsthand top secrets, best practices, tips and tricks from international renowned speakers and MVPs - Wally Mead, Pete Zerger, Mike Resseler, Thomas Maurer, Symon Perriman, Marcel Zehner as well as number of local Australian based speakers.

A number of sponsors will be exhibiting in the expo area including Flexera, Veeam, Savision, Systemology, Infront Consulting, Opslogix, itnetx and Cireson.

There will be amazing prizes to be won and a free Cloud Architecture Arena where you can ask any questions about starting your cloud journey.  A number of masterclass workshops will be run by System Center and Cloud experts and you end the day with a cocktail networking session with all speakers and sponsors.

Please visit https://systemcenteruniverse.asia/australia/ for more details.

And for up to the minute information please check out all the social media locations

Facebook - https://www.facebook.com/systemcenteruniverse.apac/

Twitter - https://twitter.com/scuapac

You Tube - https://www.youtube.com/channel/UCicwZ6EIKuQnUU34GE-atpA/feed

And if you need to convince your boss make sure you check out the Top 10 reasons to attend SCU Australia!

Hope to see many of you there!

Jeffa

Nothing like a free ebook to warm your heart.  The good folks over at Microsoft Press have released a new one on Windows 10.

Introducing Windows 10 for IT Professionals, Technical Overview is now available for free as a pdf download. Mobi and ePub formats will be available soon.  There has been a preview of this book that has been available for awhile now but this one is the most up to date version.

In fact this one was written after the release of Windows 10 version 1511 in November 2015 so it includes all the enterprise focused features.

So if you are thinking of deploying Windows 10 in your organization or have already started then check out this free resource!  I’ve put the link to the free PDF above so make sure you download now.

Jeffa