Windows Passport is Microsoft's implementation of the Fido 2.0 specification.  In a nutshell, my understanding is the client is able to create a public/private key pair (or use an enterprise CA with NDES) and registers the public key with a service (Azure AD in this case).  The private key is then protected on the client within a key vault (TPM or software).  The vault can be unlocked with a "gesture" (Windows Hello) that initially a PIN or with bio-metrics are supported. This registration is likely combined with a second auth factor (MFA) to also prove user identity at the same time - the Passport depends on pairing the device and credential.  Each device has its own certificate and PIN/biometrics.  This is great because this eliminates the scenario which most people do by using the same password on many accounts and the password is never sent over the network. 

If you want to read how it really works - check out this article - https://technet.microsoft.com/en-us/library/mt589441(v=vs.85).aspx

I, like many of you, follow prominent voices in the Exchange community through blogs and other outlets.  One recent post by Tony Redmond, MVP and technologist, caught my interest more than usual.  His recent post ‘The end of Exchange? I don’t think so’ was a response to a blog post by Scott Cameron.  Tony makes many good points, and lays out some thoughtful counter-points to Scott’s premise.  While, like Scott, I also work for Microsoft – so as Tony point out (rightfully so) you should take the vendor’s bias into consideration, I would like offer an additional insight that I think both have missed, and why I do think the end is near (oohhh and aaaah). 

To this point, the service and on-premises offerings have more or less been close in feature parity.  So, Scott’s arguments make sense..it is largely a cost/benefit analysis that customers make to decide if Office 365 is right for them.  Given the extremely low cost of the service, sometimes there are a few other levers that come into play.  For example, whether or not a customer can accept the evergreen model, or the other “excuses” (in Scott’s words) also play a factor in the decision process.  That’s pretty much where we have been from the last few years till today.

Now, the game changer.  There is and will be more functionality, and more innovation in the service.  There will be features, that will never make it to the on-premises product.  Not because Microsoft doesn’t want to offer them, its because these are features you can only get when you have the entire platform and can do more interesting things farther up the stack.  Let me give a few examples.  First, we recently released multi-factor authentication (MFA). In just a few clicks, you can, for free, enable MFA for your administrators.  No infrastructure investments needed..super easy to enable..enhanced security beyond most typical IT shops (I am in our services group, I see a lot of IT shops).  For some nominal fee (judgment call), you can enable this per user / per application (I’m just learning this – so I think I have my facts straight).  I have my MSDN subscription, that includes Azure, and I also have a trial Office 365 tenant that I enabled this on.  So here is just one example on how the service continually is enhanced and can provide new features that would be rather difficult to deploy in a typical enterprise.

I’ve also been playing with Azure RMS. For anyone who has tried to deploy this on-prem, it couldn’t be easier to do with Azure RMS.  All that is required is installation of  a RMS connector (on-prem) and all of your on-prem services (like Exchange) are tricked into thinking you have deployed an on-premises ADRMS.  Again, simplicity and integration makes cloud services like this incredibly compelling.

Ok, so that’s two examples of where deploying a service is just easier..what else?  As I alluded  to at the start – the gap between features will grow.  One example is Microsoft ‘Oslo’.  At this point, I’m assuming Oslo will only be a feature available in Office 365.  Another announcement was made around new group functionality – bringing together Yammer and Exchange integration, which I personally think will be the lynch pin to finally realize the power of enterprise social and collaboration.  These types of solutions require bringing together information or integration across multiple applications.  For an enterprise to be able to deploy and maintain would be difficult.  I also can see a future when new features are developed from having access to a large user base (not saying access to specific tenant data, Im talking about telemetry data and possibly anonymized meta-data).  These applications may just not be easily productized. 

There you go, that’s my bet on the future.  Customers will move away from cost decisions to choosing software and services that help them get their work done, sell more widgets, or collaborate more efficiently.  People will likely be able to try and buy, or use a freemium model – where services are used because they fulfill a demand.  The back-end will make it easy to consume and use.  Consumerazation of IT has already started breaking down traditional barriers.  Look at Box, or Yammer where individuals can use a service for free.  Enough people use it, IT can choose to buy it and enforce controls. People purchasing their own software on their own hardware that interop with enterprise services (like EAS clients and Exchange).  Need more storage – don’t bother going to IT, just click and add to your cloud storage for $1.99, oh and its automatically highly available with business continuity. This future is why Exchange’s future (and other traditional on-prem applications)  have a horizon – and I’m going to bet that its not that far off.

Am I biased, probably.  Not because I work for Microsoft – but because I live in that world today.  I’ve moved all of my files to  OneDrive for Business after my laptop HD died.  This move also let me access my files across my devices (I have a Surface RT, Dell Venue Pro 8, Laptop, Desktop, and a Windows Lumia 1020 phone). Also, I can share my files more easily, which means I can collaborate with less friction.  This also enabled multi-author editing, which is the greatest feature ever! The line between internal and external collaboration is blurred.  You can reach me on Lync, get me on email, or Yammer.  I can secure my documents with RMS – even with non-Microsoft people.  If I need to electronically sign documents – I can purchase an Office Application from DocuSign.  All of these things add up to the fact that the service model empowers me to live and work better..

Its my job as a Solution Architect at Microsoft to help customers realize this vision.  My current role is largely working with customers who are deploying on-premises Exchange.  This shift affect me, just like the customers I help on a daily basis.  But, I’m excited about this future because I do enjoy helping customers solve business problems, and I see the IT industry shifting in this direction.  Only time will tell  

p.s. These are solely my opinions and do not represent Microsoft or anyone else’s. There is no insight to inside information, or customer information implied.

Hello again!

I wanted to try out some of the new Windows Server 2012 R2 functionality that is meant to replace TMG/ISA/UAG.  Thanks to Georg Hinterhofer for helping me troubleshooting and getting my lab working!

This post assumes you know how to do basic setup, like DNS, installing Exchange 2013, etc.

You can setup the other protocols/vdirs – but only OWA & ECP support pre-authentication. The others must be set as pass-through.  I may try to add those to the lab later, but today we only are doing OWA.

LAB Setup

I use the administrator account to setup everything.

I created one domain account for ADFS – called ADFSSvc. This account was not mailbox enabled.

Setting up ADFS

Goal: Install and configure ADFS server.

On ADFS1, from server manager  add the ADFS server role.

Note the requirements. I *think* you can install this on your DC to save a server, but at the time of this writing Exchange 2013 CU3 does not support a Windows 2012 R2 domain controller. This is why I used a separate ADFS server in my lab.

While that installs, import the certificate from MSX1. In this case I have a public certificate from DigiCert.  It has 3 names (SAN certificate). Most of the time, you will see STS is the name for your ADFS service.  I don't know why, but I picked ADFS.  Just make sure you don't name your server ADFS, or you will have issues.  You may be better off sticking with STS just to avoid confusion.

You can see the alternate names here:

The install finished, yeah!. Now click on configure

I suppose in a real production setup, you would use SQL.

This is what my service looks like.. Since I already had this installed it looks like my settings didn't totally clear out.  Note the organization tab is blank.

We need to add a non-claims aware relying party trust.  Good thing there is a wizard.

If I get ambitious I may try to tackle using an AD group to secure the ECP directory rather than setting up an additional vdir in Exchange to limit Admin access to ECP from outside the company’s network.

To test your ADFS setup is working – you can go to the portal page - https://localhost/adfs/ls/idpinitiatedsignon.aspx

If you see this – continue on!

Setting up Exchange

Goal: We need to change the authentication type for the OWA virtual directory to Windows Integrated Auth (from forms) in order for the delegated authentication to work.

On MSX1, open the ECP (https://localhost/ecp or https://msx1/ecp)

Ignore the cert warning.

Change the auth type.

Setting up the WAP server

Goal: Install and configure remote access for OWA.

On WAP1, from server manager, we will install the Remote Access role.

Once you click Web Application Proxy, it will ask if you want to automatically add features, go ahead and leave the defaults and continue.

While that installs, import the certificate from the Exchange or ADFS server. I will not show these steps – they are the same as for the ADFS server using the Certificate MMC.

Next, edit the host file on WAP1.  While everyone else in DNS gets the WAP server for the ADFS.rosenexchange.com address, the WAP server itself needs to be able to resolve that to the ADFS1 server. Yep, this is the way to do it.

It will sit for a while on ‘configuring ADFS Proxy’

It will then launch the Remote Access Management Console.

Click publish under General in the Tasks pane

Select Exchange OWA (you will see this since it made its connection back to the ADFS server and we setup the trust)

If you forget the trailing “/”, in a few screens you will get this error.

One thing to note, if you look in the certificates store, the server created a self-signed cert with a five days from the date of install expiration. I think this auto-updates itself – but if you turn off your lab machines and this expires – Im not sure what you do J.

On DC1, we need to configure Kerberos constrained delegation.

Click Add, and it will pop up the ‘Add Services’ dialog box. Press ‘Users or Computer’ and enter MSX1.

Pick HTTP, then OK.

Note, it may show just MSX1, but if you ok and close the window, reopen the properties you should see the FQDN (MSX1.rosenexchange.com).

Finished

To test, on DC1, open IE and browse to https://mail.rosenexchange.com/OWA.

If you are successful, you should get this:

Finally, Yeah!! Im in my mailbox.

If you have issues a few things to check

· Make sure your time is synced (I synced everything to my DC)

· Make sure all the services are running

· The self-signed certs issue mentioned above

· Klist purge will clear out any Kerberos tickets

· Look in the event viewer – in 2012 R2 you have to look in the individual event logs to find the information (stuff is no longer just pushed to the application and system logs)

It my understanding that the WAP server(s) are stateless. So if you wanted to scale out – you could just use DNS RR or something to loadbalance your mail.rosenexchange.com address to all of the WAP servers.  For ADFS, you can add servers to the farm.  I haven't looked for any scale numbers..Im not sure any have been published yet.

Good luck, and I hope this helps you.

Jeffrey

Let’s get to it..

Go to your SkyDrive Pro and create a new folder. I named mine ‘OneNote for Meetings’

Create a new OneNote notebook.  I did this from within the OneNote application, and selected my SkyDrive Pro, then the new folder I created.

You may get this prompt, I selected ‘Not now’

Back on the SkyDrive Pro website, you should now see your OneNote inside the new folder. 

Select the ‘…’ and click SHARE.

You need to select ‘Everyone except external users’.  This means that all internal users can also take notes during the meeting instead of it being read only.  This also means that they have free reign on this notebook..more on that in a bit.

Note that I clicked ‘SHOW OPTIONS’ and unchecked ‘Send an email initiation’.  I’m not really sure this is needed, but why take chances (I don’t want to start Bedlam 2013)

You can test this by starting a “Meet Now” with the Lync client, and follow part 1.

You can see my notebooks when I started sharing. (The test was made just for this writeup)

Once you select the notebooks you should see a new page with Meeting Notes and the date.  Don’t forget to change the title, I usually add the meeting title or something.  Also, as mentioned in part 1, at the end of the meeting I move the page to another notebook.  This is because of the wide open security required – anyone attending the meeting can see your other pages (and even create new pages).  So for me, this notebook is empty all the time.

I hope you find this as useful as I have.  I do wish there was a way to use the nice meeting templates that OneNote has..but I have not figured out a way to make that work.  (This is on the insert, page templates ribbon..you can create a new page and cut/paste your notes..but it would be nice to set a default for online meetings).

Related post – Part 1

What is it?

When you are a presenter in a Lync meeting you have the ability to create a shared OneNote allowing.  This has several benefits:

• Allows everyone to participate in note taking
• The roster in OneNote is updated as people join the meeting
• You can easily send the meeting minutes at the end of the call to all participants

The Experience

Before I show you how to set it up, let’s take a look at how it works.

Within a meeting, as presenter you can hover over the sharing button (the icon that looks like a monitor along the bottom row of the client window).  From there you change to the ONENOTE tab, and select Shared Notes.

This will popup a new window that lets you choose the page or section to share:

Once you select the page, OneNote will open and meeting attendees will get a message that you are sharing a OneNote and they can allow it to launch.

As you can see, participants are automatically added as they join the meeting.  As people type notes, it will automatically keep everyone in sync.  As others type, you will see their new text with their initials, letting you know who made those changes.

You can even insert the meeting details by clicking the ‘Meeting Details’ button on the ribbon. This inserts details like the invitation message, original attendee information and a link to the Outlook Item.

Finally, when finished with the call you click the ‘Email Page’ button and it will automatically populate the To: line with attendees.  Usually I made some edits and add things like Action Items or clean up the notes.

So there you have it..pretty cool!  I have gone from never taking meeting notes to a meeting minute rock star

In my next post, I’ll explain how to set this up..

----> Part 2 

[edit – added link to part 2]

Historically, the ITAP (IT Architecture and Planning) was named something else - EPM, ESC, MTSS, ESC.  The role started as more of a ‘brain on a stick’, but now the role is much more formalized.

I plan on expanding on what the ITAP does and how this service helps customers get more out of their investments with Microsoft in later posts.  Also, I will talk about what its been like going from a deep technical resource to strategic advisor, and the skills it takes to be successful.

Who is listening in on your conference call?  With our previous conference bridge solution, we were assigned a permanent attendee code for people to use to join a conference call.  This number provides the authentication required to join the meeting (i.e. what you know)..but it doesn't prevent other from joining your call that do not belong, and perhaps hearing sensitive or confidential information.

Case in point, a large group of people (including myself) were sent a meeting invite for something by accident.  I had nothing to do with the meeting, but the subject was enticing (as was the invite list).  The meeting organizer realized the mistake and tried to cancel and resend out the invite, but the meeting codes had not changed..so I was able to join the meeting.

Had the organizer been using OCS with audio conferencing, they could have selected the meeting option to generate a new conference ID for each conference. (You can find this option after you create a new meeting invite – under the Audio options)

This also is great for times when you have back to back meetings with different people.

Another security option for OCS meetings have is to allow only authenticated users join.  There are 3 options:

1. Invite anyone – This is what you would choose if you need to invite people outside your company.  This allows ‘anonymous’ users to join.

2. Invite within network – This allows anyone in your company to join.

3. Invite within network (restricted) - You can invite people within your company, and only the people on the invite can attend.

If you initiate the call via OC, then the user names are resolved and you can see exactly who is in your conference call.

So the options are there..use them and have more secure meetings!

I sent an email to a link on their page, and was very surprised to get a response within hours.  The person, who is their web director, went so far as to contact their General Counsel to find out exactly what their EULA says. The last thing I want is video of my kids ending up on a website in some advertising (for example, on their Flip product page).

I’m happy to say he was patient in listening to my questions and went back and forth over several emails.  He confirmed they do not assume rights to video content produced by their customers.  In fact, he even confirmed all of the videos displayed on their website were given specific permission to do so.

So..we get to keep the camera and I feel better about their product.  I’m not sure where the editorial person got their information, but it was wrong (it may have to do with a specific “design” feature on one of their other cameras, but even then what they complained about was inaccurate). 

I came across the following comic on XKDC (one of the best strips out there – hopefully I linked this correctly to give proper credit).

https://xkcd.com/501/

Registration & Lunch (provided by PLA)  12:30-1:00 pm

1:00 – 1:15 pm

Exchange Capacity Planner Tool Demo

Jeff Rosen, Senior Consultant/Certified Architect (Ranger), Microsoft

System Center Capacity Planner (SCCP) 2007 is a pre-deployment capacity planning and post-deployment change analysis solution that provides IT professionals with the guidance required to plan a new deployment in the most efficient manner, while also delivering "what-if" analysis to optimize existing implementations and plan for change.

1:15-2:30 pm
Storage Design Deep Dive for Microsoft Exchange Server 2007

Ross Smith, Technology Architect, Microsoft

This session provides advanced training and tools to help you design the right storage architecture for your Exchange 2007 deployment, with an emphasis on the Mailbox server role.  Expand your knowledge of ESE architecture.  Learn how to properly balance disk performance and capacity.  See the Exchange 2007 Mailbox Storage Requirements Calculator in action.  Understand Microsoft’s best practices for designing, testing, and monitoring your storage solution.  

Objectives:

Explore architectural changes in Exchange 2007 (RTM and SP1) that affect storage design

· Learn how to calculate storage requirements based on business needs and craft solutions to meet these requirements

· Understand what tools are needed to properly design, test, and monitor Exchange storage architectures

Break 2:30-2:45

2:45-3:45 pm

Microsoft SharePoint Tools for the Enterprise
Scott Jenkins, Pre-Sales System Consultant, Quest Software

SharePoint is redefining our current understanding of collaboration.  It is time to utilize SharePoint as a central interface to front-end Line of Business applications, and act as a repository for data that was formally stored in file shares, public folders and Notes databases.  Join Scott Jenkins of Quest Software as he walks through the tools available today to migrate your critical data from across the organization to SharePoint.

3:45 – 4:30 pm

Certificates and Exchange 2007 and ISA 2006
Mark Myers, Senior Consultant, Project Leadership Associates

Exchange 2007 requires certificates for authenticating and encrypting critical messaging services. The default certificate configuration with Microsoft’s Exchange 2007 is only a very basic start that is inadequate for nearly all real-world configurations. Come learn the Microsoft best-practice certificate design and real-world design and configurations from PLA. We will also cover how your certificate design and configuration will change when protecting your Exchange servers with Microsoft’s ISA 2006 reverse proxy server. In this session we will also discuss private and public-CA issued certificates and how you can design your certificates to maximize on functionality while minimizing costs to outside public Certificate Authorities (CAs).

4:30 - 4:45 pm  Wrap-up and Giveaways

Check out the website at https://www.mmcug.org/

My first impressions are that it's a very cool piece of software.  I am using it in my lab to create VM's for Exchange, AD, SCCM, and SCOM.

This got me..I tried to make a template from a brand new Windows 2003 R2 install.  SCVMM made it to about 49% then it failed.  It kept warning me that the version of sysprep was incorrect.  And, of course I didn't make a clone before I started the template creation.  I thought there was an issue with my VM..so I rebuild the whole thing again...same problem.  This time I found out the error was on the SCVMM side..not my VM.  For Windows 2003 R2 SP2, there was an updated sysprep (https://www.microsoft.com/downloads/details.aspx?familyid=93F20BB1-97AA-4356-8B43-9584B7E72556&displaylang=en)

I cannot find the web page that listed the error, but you have to copy a couple of files from deploy.cab from the web download to the program files\microsoft system center virtual machine manager directory.  Look for the sysprep directory. In it you will see different versions of windows.  The one for Windows 2003 sp2 is 5.2.3790.3959. Once I replaced the files with the new ones..it went smoothly.

Also, I could not figure out how to install the VM Additions..I had to go back to the Web admin console..