This post is an extension to a KB article mentioned below that was written for Excel 2003.

https://support.microsoft.com/en-us/kb/914199 

But I encountered few issues where the requirement was to have the same behaviour confirmed for Excel 2013.

Hence created a scenario for the same using Unprotect and Protect Method.

Hello Command Button

Would just pop a message saying Hello.

I placed it to show that a function like MsgBox has no issues executing with IRM protection applied to the workbook.

Unprotect Command Button

It calls the Unprotect Method to remove protection from the current sheet.

Protect Method

I am calling the Protect Method here the moment I click on any cell.

Code :

Private Sub CommandButton1_Click()
MsgBox "Hello"
End Sub
 
Private Sub CommandButton2_Click()
ActiveSheet.Unprotect Password:="hello"
End Sub

Private Sub Worksheet_SelectionChange(ByVal Target As Range)
ActiveSheet.Protect Password:="hello"

End Sub

Scenario 1 :

Workbook that I have not protected using Protect Method and applied IRM protection to it.

Saved it and then opened it with another user , who has almost all permissions just not full control that the owner of the document will have.

Permissions the user holds.

Now when I select on any cell the Protect Method gets called and we receive the following error.

Scenario 2 :

Workbook that I have protected using Protect Method and applied IRM protection to it.

Saved it and then opened it with another user , who has almost all permissions just not full control that the owner of the document will have.

Now when I click Unprotect Command Button , got the following error.

As already mentioned this is by design and mentioned in the following KB Article.

https://support.microsoft.com/en-us/kb/914199 

But if the user has full control over the document , we will not encounter such a situation.

Kaustubh Dwivedi

Microsoft Security Support Escalation Engineer

So it all started as a discussion with one of my colleague who had an issue, where we were able to take screenshot’s of Right Protected Word Document when opening it through Word Online. The rights are being applied by uploading the document to SharePoint online. To get an actual answer, we have to first understand in depth on how a Screen Capture does work. And how does Windows stop the Screen Capture when it does. Normally when opening it through a Thick office client.

I came across this wonderful explanation by Raymond Chen. Would advise you to go through it before continuing as this holds all the answer’s we need.

Windows Confidential: What You See Is What You See

Windows Confidential The Case of the Disappearing Cursor

The purpose of this feature is not to protect information from an attacker who can run code on the system. It's to defend against users who take a screen shot without realizing that the confidential budget data is visible in the background.

Reference: https://blogs.msdn.com/b/oldnewthing/archive/2013/06/03/10422964.aspx

When using screen capture tools like Snipping Tool or PrintScn function, the pixel arrays for the protected content window are inaccessible so it is blacked out in the capture. The segment of the screen that has the Rights Protected Document opened on blacks out, as we can see in the figure below.

An advanced application like OneNote will automatically detect that a Right Protected Document is open and would let you know that. We will not go in how it does that.

So, to recap:

1. Client application opens IRM protected content.

2. Client application reads the ‘Do Not Print’ permission attached to the document(if any).

3. Client calls the Desktop Window Manager service (ensure that the service is running) to enforce this right.

4. The pixels of the window overlay are marked as protected/inaccessible to PrintScn function calls.

User could easily get around this by “viewing the document via a Web site (for example, put it on your Exchange mailbox and use Outlook Web Access) and PrtSc the Web page. The Web browser certainly doesn’t know which pixels are IRM-protected or not”.

So far, I have not come across on how we can control this behaviour through a web browser. At the time of writing this post, the best way around this is to force the User to use the thick client, which is installed on your machine.

In case of SharePoint Online, we can choose the right combination of Permission and force the user to open the document using the Office application that is installed on the machine. Here’s how we can implement this.

1) Create a new Group and under the section “Give Group Permission to this Site”, checked the option “Read - Can view pages and list items and download documents”.

https://support.office.com/en-us/article/Manage-permissions-for-a-list-library-folder-document-or-list-item-9d13e7df-a770-4646-91ab-e3c117fcef45

2) Add the member’s to this group according to my scenario, in general we would follow the company policy.

3) I am assuming we have the IRM already configured, if not please visit the following link.

https://support.office.com/en-us/article/Set-up-Information-Rights-Management-IRM-in-SharePoint-admin-center-239ce6eb-4e81-42db-bf86-a01362fed65c

4) Now only pointing out the option which will force the Word Document to open using the Desktop Client.

Check the option “Prevent opening documents in the browser for this Document Library”

After steps 1-4, I was able to get the Document open through Word 2013(in my case) and verified that I was not able to take a Screen Capture.

Hope this post has been informative and helps address Print scenarios while dealing with confidential data

Note: This weblog does not represent the thoughts, intentions, plans or strategies of my employer. It is solely my opinion.

Just came across an issue with TMG 2010. We were trying to install SP2 RU5 and it was failing with the error:

Internal error 2771

We were currently running SP2 RU4.

So we did make sure we had all the TMG 2010 Services running and had a look at the event viewer for pointers. But with no luck we had to move to the plan of collecting a verbose installation log.

Remember that to generate verbose logs, pass "/L*v <file name>" (without quotes) to the command line for msiexec.exe. If using Windows Installer 3.0 or newer, you can also pass "x" along with "*v" to the logging switch for additional debug information.

And before we jump into what we did to resolve it please read the article by Heath Stewart.

https://blogs.msdn.com/b/heaths/archive/2006/11/30/rebuilding-the-installer-cache.aspx

Snippet from the complete log that would give us an idea on how to tackle such an issue.

Log Snippet: Start

MSI (c) (F0:78) [16:02:58:640]: Opening existing patch 'C:\Windows\Installer\2cbf5a.msp'.

MSI (c) (F0:78) [16:02:58:640]: Note: 1: 2203 2: C:\Windows\Installer\2cbf5a.msp 3: -2147287038

MSI (c) (F0:78) [16:02:58:640]: Couldn't find local patch 'C:\Windows\Installer\2cbf5a.msp'. Looking for it at its source.

MSI (c) (F0:78) [16:02:58:640]: Resolving Patch source.

MSI (c) (F0:78) [16:02:58:640]: User policy value 'SearchOrder' is 'nmu'

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Media enabled only if package is safe.

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Looking for sourcelist for product {5E52CFA5-2A84-4E59-8F63-EA43511E518A}

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Adding {5E52CFA5-2A84-4E59-8F63-EA43511E518A}; to potential sourcelist list (pcode;disk;relpath).

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Now checking product {5E52CFA5-2A84-4E59-8F63-EA43511E518A}

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Media is enabled for product.

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Attempting to use LastUsedSource from source list.

MSI (c) (F0:78) [16:02:58:640]: SOURCEMGMT: Trying source C:\Users\CASETH~1\AppData\Local\Temp\.

MSI (c) (F0:78) [16:02:58:641]: Note: 1: 2203 2: C:\Users\CASETH~1\AppData\Local\Temp\TMG-KB2288910-amd64-ENU.msp 3: -2147287038

MSI (c) (F0:78) [16:02:58:641]: SOURCEMGMT: Source is invalid due to missing/inaccessible package.

MSI (c) (F0:78) [16:02:58:641]: Note: 1: 1706 2: -2147483647 3: TMG-KB2288910-amd64-ENU.msp

MSI (c) (F0:78) [16:02:58:641]: SOURCEMGMT: Processing net source list.

End

The lines that are highlighted in yellow tells that the installer is not able to find 2cbf5a.msp.Which resolves to TMG-KB2288910, which is SP1 Software Update 1.

How did I know that? please read the article that I have pasted initially. So we created a MSP of the TMG-KB2288910 which was in .exe format.

Command used here:

TMG-KB2288910 -amd64-ENU.exe /t c:temp /c

It might take a few seconds before the MSP file shows up, so be patient. Copied the MSP file and renamed it as 2cbf5a and pasted it under the location

C:\Windows\Installer. Tried installing the SP2 RU5 again with verbose logging and it failed. Looking at the logs we observed it was then missing an

existing patch that installer was looking for. Followed the above method over and over again till we got the TMG SP2 RU5 to start the installation without the error.

Basically we had to build up the cache for the Windows Installer from SP2 RU4 back to SP1.

Hope this helps resolving similar other issue’s and point to remember here is, this does not specifically apply to TMG 2010.

Problem Statement:

When running a Sync on a Source MA we are getting the following error in the Stack Trace.

Microsoft.MetadirectoryServices.AttributeNotPresentException: Attribute <attribute name> is not present.at Microsoft.MetadirectoryServices.Impl.AttributeImpl.get_StringValue() at Mms_ManagementAgent_<Source MA>Extension.MAExtensionObject.MapAttributesForExport(String FlowRuleName, MVEntry mventry, CSEntry csentry)

For sake of keeping things simpler I am going to use the attribute name as “mail” and the Source MA as “ADMA”.

Cause:

The provisioning code that we are implementing is using an attribute that we are not flowing from the Source Management Agent to the Metaverse.

Resolution:

If we read the exception carefully it tells us the that, I am provisioning certain attributes to the destination connector space, but the attribute “mail” which is being provisioned to destination connector space as “email” (example) is not being provided by the Source Management Agent(ADMA).

Steps to resolve this:

1) Make sure we have an import flow to the metaverse for mail.

2) Remove the attribute from the code, if it is not going to add any value and recompile the MVextension.dll.

Code Example:

csentry("email").StringValue = mventry("mail").StringValue //mail is not being flowed from the Source Management Agent.

While working on a TMG 2010 issue, we were getting an error when generating any kind of report. The error is mentioned below.

================================================================================

System.Web.Services.Protocols.SoapException: The item '/ISA2008

Reports/Summary_ServerParticipation' cannot be found. --->

Microsoft.ReportingServices.Diagnostics.Utilities.ItemNotFoundException: The

item '/ISA2008 Reports/Summary_ServerParticipation' cannot be found.

at

Microsoft.ReportingServices.WebServer.ReportExecution2005Impl.LoadReport(String

Report, String HistoryID, ExecutionInfo2& executionInfo)

at

Microsoft.ReportingServices.WebServer.ReportExecutionService.LoadReport(String

Report, String HistoryID, ExecutionInfo& executionInfo).

The error occurred on object 'Reports' of class 'Reports Configuration' in the

scope of array <Servername>

=================================================================================

It is always a good idea to actually look if actually the Report “Summary_ServerParticipation” existed in the SQL or not.

So we opened the Reporting Services Configuration Manager on the TMG 2010 Server.

Clicked the Highlighted link below.

This opened an IE window and we could not find any report in the location mentioned.

Compared this to a healthy TMG 2010 Server and I could see a bunch of reports present. Highlighted is the report that we are actually getting an error:

So, our Task now was to do a restore of the Database from a healthy TMG 2010 server that is holding the above populated report to the TMG 2010 server, we are facing issue with.

Details of the TMG servers.

TMG2 – TMG 2010 Server with the issue.

TMG1 – Healthy TMG 2010 Server.

Take a backup before we proceed.

Based on the complexity of the implementation of the action plan, we will be accomplishing this task in Phases:

Phase 1: Taking Backup of the Database from TMG 2:

How to: Back Up a Database (SQL Server Management Studio)

https://technet.microsoft.com/en-us/library/ms187510(v=sql.105).aspx

Database’s that we need to take a backup for:

Phase 2: Backing Up the Encryption Key from Reporting Services Configuration Manager:

Backing up the Encryption Key.

Back up encryption keys -Reporting Services Configuration Manager (Native Mode)

https://msdn.microsoft.com/en-us/library/ms157275.aspx

Now as we are done backing up the database’s from TMG2, we need to perform the same steps for exporting the database from the working TMG1 Server.

At the end we will have 3 files that we need:

EK- Encryption Key

ReportsServer$ISARS – Report Server Database.

ReportsServer$ISARSTempDB – Report Server Temporary Database.

Phase 3: Deleting the Database from the TMG 2 and Importing a healthy Database from TMG 1:

On TMG 2 we need to delete only ReportsServer$ISARS from the SQL Management Studio.

Now why we delete this database only is because firstly this is the database where our report Summary_ServerParticipation is under. And we want to replace our Database ReportsServer$ISARS with a healthy one.

How to: Restore a Backup from a Device (SQL Server Management Studio)

https://technet.microsoft.com/en-us/library/ms188312(v=sql.105).aspx

We need to only import ReportsServer$ISARS as that’s what we are recovering.

Phase 4: Importing the Encryption Key onto the TMG 2 server that we exported from the TMG 1 Server:

Restore encryption keys -Reporting Services Configuration Manager (Native Mode)

https://msdn.microsoft.com/en-us/library/ms157275.aspx .

It will take a little bit to complete this process , do watch out for the message in the Results Section.

Phase 5: Delete the TMG 1(Working Server) instance from the Scale-out Deployment.

Delete the Working Server Instance(TMG1) and after deleting we should see only one server which is TMG2.

How to Delete TMG1 Instance:

On the ReportsServer$ISARS Datbase execute the below mentioned query.

delete from keys where machinename=’TMG1’.

To confirm the Exact Machine Name:

On the table dbo.keys under ReportsServer$ISARS Database execute the below mentioned query.

Select [MachineName] from [ReportServer$ISARS].[dbo].[Keys]

After deleting the Instance TMG1, visit the Scale-out Deployment Status.

We would see only TMG2 Server listed there.

This completes the process and now to confirm if we can see the Reports on TMG2. Follow the same procedure mentioned in the starting of the article.

Or you can directly generate a report and see if we are still getting the error. If followed in the exact way we should see the issue getting rectified.

I hope this article will come handy in solving these kind of Reporting issues while working on Forefront Threat Management Gateway.

Author:

Kaustubh Dwivedi
Microsoft Security Support Engineer

Reviewer:

NITIN SINGH
Microsoft Security Support Escalation Engineer

So it was about time that someone wrote an article about Advanced Feature option on the Rights Management Page.

But first of all what is Azure Rights Management?

Almost every organization is Internet-connected these days, with users bringing personal device to work, accessing company data on the road and home, and sharing sensitive information with important business partners. As part of their daily work, users share information by using email, file-sharing sites, and cloud services. In these scenarios, traditional security controls (such as access control lists and NTFS permissions) and firewalls have limited effectiveness if you want to protect your company data while still empowering your users to work efficiently.

https://technet.microsoft.com/en-in/library/jj585026.aspx

How do we enable it on the Office 365 Portal?

https://technet.microsoft.com/en-us/library/jj658941.aspx

Going a little deep and you can create and manage custom templates in the Azure Management Portal. You can do this directly from the Azure Management portal, or you can sign in to the Office 365 admin center, and choose the advanced features for Rights Management, which then redirects you to the Azure Management portal.

More about the Advance Feature for Rights Management: https://technet.microsoft.com/en-in/library/dn642472.aspx

But I am not here to talk about the advanced feature here. But more of when we decide that we want to go ahead and try this out and we end up with an error.

No Subscriptions Found when we click on the Advanced Feature button on the Rights Management Page

When we click on the advanced features button on the rights management page (Figure 1) we get a message like the one in Figure 2.

Figure 1

Figure 2.

So what happened here?

I am logged onto the office365 with kaustubh@kausd.onmicrosoft.com . So the tenant here is kausd.onmicrosoft.com.

Office 365 account: kaustubh@kausd.onmicrosoft.com

What is a Tenant?

We as cloud users would often hear the term “tenant” a lot. As per oxford tenant would mean: a person who occupies land or property rented from a landlord.

Same way in office 365 it means your own space and in general it is denoted by .onmicrosoft.com.

So if one company has an office 365 name space abc@domain.onmicrosoft.com then no other company can use the same name space.

Now when I click on the advanced features button it takes us tohttps://account.activedirectory.windowsazure.com/.

This page would land us on Azure Management portal once it verifies that we have a subscription associated with my account with which I am logged in on office 365.

For example, Azure Space will look if my account Kaustubh.kausd.onmicrosoft.com has a subscriptions associated with it, if found it will check if my account is a Service administrator or a co-administrator.

In case it does not find that my account satisfies any of the conditions mentioned above it will throw a message like the one in Figure 2.

What is Microsoft Azure?

What is Azure? In short, it’s Microsoft’s cloud platform: a growing collection of integrated services—compute, storage, data, networking, and app—that help you move faster, do more, and save money. But that’s just scratching the surface.

https://azure.microsoft.com/en-us/overview/what-is-azure/

In case if any one of them is not true we will get message we saw in figure 2.

Now let’s look at how to resolve this kind of issue.

Scenario 1:

Some of the users are confused if they have or don’t have an Azure Account.

So let’s check that by visiting https://manage.windowsazure.com and see if we can login here or not.

Login with the same account the account as of office365. At this point you will be logged of from Office365 if the login to the Azure Portal Succeeds.

Under setting section look if he we have the subscription associated with the Directory that you intend to use (Figure 3). In my case it would be kausd.onmicrosoft.com.

Now in starting I could never logon to the Azure portal with the Kaustubh@kausd.onmicrosoft.com because of the reason that kausd.onmicrosoft.com was not associated with any subscription.

I have multiple directories (Figure 3) and the default directory was the one that had the subscription associated with it. So I had to first login to the portal as a global administrator (Figure 4) where the account used is kausd@outlook.com.

Figure 3

Figure 4

kausd@outlook.com was the account through which I first signed up for my Azure Account.

Under setting section and click edit directory (Figure 5) and (Figure 6).

Figure 5

Figure 6

NOTE: For this change you have to be a Global Administrator.  Once you associate the directory you need to make Kaustubh@kausd.onmicrosoft.com either a service administrator or a co-administrator.

For this we need to go to the Active Directory section select the Directory you (kaustubh@kausd.onmicrosoft.com) belong to.

Under users tab look for the account and once you expand that you would see a section where a role can be assigned (Figure 7). Again I have to be a global administrator for this.

Figure 7

Here I have made Kaustubh@kausd.onmicrosoft.com as the service administrator.

Once done with these steps we should be done.

Scenario 2:

In case we don’t have an Azure Subscription then we can always sign up for a trial.

We need to click on sign up for Windows Azure and then we can proceed with procedure in Scenario 1.

I hope you find the above given information helpful and useful. Welcome to the Microsoft Rights Management world.

Author:

Kaustubh Dwivedi
Microsoft Security Support Engineer

Reviewer:

NITIN SINGH
Microsoft Security Support Escalation Engineer

Today I am going to talk about a new feature which Office 365 team has introduced and that is “Office 365 Message Encryption”.

https://technet.microsoft.com/en-us/library/dn569286.aspx

Office 365 Message Encryption depends on Microsoft Azure Rights Management (previously known as Windows Azure Active Directory Rights Management). To use this encryption service, you must have an Office 365 organization that includes an Exchange Online or Exchange Online Protection subscription that, which in turn, includes an Azure Rights Management subscription.

https://office.microsoft.com/en-us/business/office-365-enterprise-e3-business-software-FX103030346.aspx

Office 365 Enterprise E3 includes:

So when creating a transport rule for message encryption, we may receive the following error.

You can't create a rule containing the ApplyOME or RemoveOME action because IRM licensing is disabled

After doing some research found out that this was because for IRM the internal licensing was not enabled.

Please refer to the below given TechNet article that would help us understand and enable the internal licensing for the IRM.

Note: Follow all the six steps in the article mentioned below.

https://technet.microsoft.com/en-us/library/dn569291.aspx

Also on how to connect to Exchange Online, we can use any PowerShell tool from any machine and connect as mentioned in the article below.

https://technet.microsoft.com/en-us/library/jj984289(v=exchg.150).aspx

Author:

Kaustubh Dwivedi
Microsoft Security Support Engineer

Reviewer:

NITIN SINGH
Microsoft Security Support Escalation Engineer