<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:atom="https://www.w3.org/2005/Atom" xmlns:sy="https://purl.org/rss/1.0/modules/syndication/" xmlns:dc="https://purl.org/dc/elements/1.1/" xmlns:content="https://purl.org/rss/1.0/modules/content/" xmlns:wfw="https://wellformedweb.org/CommentAPI/" xmlns:slash="https://purl.org/rss/1.0/modules/slash/"
  version="2.0">
  <channel>
    <title>The dot before the Net</title>
    <atom:link
      href="https://docs.microsoft.com/archive/blogs/sanket/feed.xml"
      rel="self"
      type="application/rss+xml" />
    <link>https://docs.microsoft.com/archive/blogs/sanket/feed.xml</link>
    <description>Of all the systems interconnected with .Net</description>
    <lastBuildDate>Tue, 27 Nov 2018 18:03:18 GMT</lastBuildDate>
    <language>en-US</language>
    <sy:updatePeriod>hourly</sy:updatePeriod>
    <sy:updateFrequency>1</sy:updateFrequency>
    <item>
      <title>How to Encrypt SQL communication on the wire</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/how-to-encrypt-sql-communication-on-the-wire</link>
      <pubDate>Tue, 20 Nov 2018 19:29:55 GMT</pubDate>
      <dc:creator><![CDATA[SanketBa]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/?p=915</guid>
      <description><![CDATA[A lot of applications are moving to the cloud. The Iaas model provides a great way to lift and shift...]]></description>
      <content:encoded><![CDATA[A lot of applications are moving to the cloud. The Iaas model provides a great way to lift and shift the applications and start leveraging the goodness of the cloud without having to re-write to adapt to the Platform-As-a-Service (Paas) model. Of course, the Paas is going to be immensely efficient in the longer term, but just moving the infrastructure is perhaps the easiest step for most app teams. Most of the times, it also means moving the database servers to the cloud.

While on-premises, most applications did not take advantage of securing the communications to the database on the wire just because of the inherent isolation advantages of having the application ONLY on the internal LAN. However, as more and more of these applications start moving to the cloud in Iaas model, the security of data over the wire is rightfully starting to gain increased importance.

Here is a quick guide to how you can setup your databases and database clients to encrypt communications over the wire. Do note that if you are moving your databases to Azure SQL database, you don't really need to worry about this. Azure SQL Database enforces encryption (SSL/TLS) at all times for all connections, which ensures all data is encrypted "in transit" between the database and the client. There are some minor considerations with Azure SQL databases that we will cover below.

But first, let's fry the big fish. Let's look at what happens to your database servers that are lifted and shifted to Azure in Iaas model. Basically moving your database server VMs to the cloud and having your applications connect to these databases. For most purposes, this model is very similar to how the databases are deployed in your data centers except that the underlying hardware is now the cloud. Which also means that you need to explicitly take care of encrypting the communication over the wire using TLS. TLS is a common security  mechanism used with web applications. That's what is happening behind the scenes when you see a URL that starts with HTTPS. If you are familiar with the mechanism of TLS on the web applications, you would be glad to know that your SQL communication can use exactly the same style of communication. To make it really simple, you simply setup a certificate that is issued for Server Authentication and set some properties to enable encrypted communication. The server can either force all the connections to be encrypted from the client or simply let the client determine if the connection needs to be encrypted or not. In terms of SQL, this gets determined by the SQL connection string.

On the server side, you will be <a href="https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-2017#Provision">Installing a certificate</a> to allow connection encryption. The certificate must be issued for Server Authentication and the name of the certificate must be the FQDN of the computer. To use encryption with a failover cluster, you must install the server certificate with the fully qualified DNS name of the virtual server on all nodes in the failover cluster. For example, if you have a two-node cluster, with nodes named test1.&lt;your company&gt;.com and test2.&lt;your company&gt;.com, and you have a virtual server named virtsql, you need to install a certificate for virtsql.&lt;your company&gt;.com on both nodes. Once the certificate is installed, the SQL Server Configuration Manager would allow you to <a href="https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-2017#ConfigureServerConnections">force encryption from the client connections</a>. After this point, if the certificate is from a well-known certification authority, then the process is pretty much done. However, if you are using a self-signed certificate, you would want to set the "Trust Server Certificate" setting on the server along with the Force Encryption.

Once the process on the server is done, the client <a href="https://docs.microsoft.com/en-us/dotnet/api/system.data.sqlclient.sqlconnection.connectionstring?view=netframework-4.7.2">connection string</a> can be configured for secured connections as well. There are two key parameters on the connection string that need to be looked at for this purpose.
<ul>
 	<li><strong>Encrypt</strong>: Setting this to true encrypts all data sent between client and server.</li>
 	<li><strong>TrustServerCertificate</strong>: When set to true, SSL/TLS is used to encrypt the channel when bypassing walking the certificate chain to validate trust. If TrustServerCertificate is set to true and Encrypt is set to false, the channel is not encrypted. Beginning in .NET Framework 4.5, when <em>TrustServerCertificate</em> is false and Encrypt is true, the server name (or IP address) in a SQL Server SSL certificate must exactly match the server name (or IP address) specified in the connection string. Otherwise, the connection attempt will fail.</li>
 	<li style="list-style-type: none"></li>
</ul>
The client application settings never reduce the level of security set by SQL Server Client Configuration Manager, but may strengthen it. For example, if Force Protocol Encryption is not set for the client, an application may request encryption itself. To guarantee encryption even when a server certificate has not been provisioned, an application may request encryption and "<em>TrustServerCertificate</em>". However, if "<em>TrustServerCertificate</em>" is not enabled in the client configuration, a provisioned server certificate is still required.

If you are using Azure SQL Database, as mentioned above, all the communication is always encrypted. However, <a href="https://docs.microsoft.com/en-us/azure/sql-database/sql-database-security-overview">in those cases the client connection string guidance is slightly different</a>. <span>In your application's connection string, ensure that you specify an encrypted connection and </span><em>not</em><span> to trust the server certificate (For the ADO.NET driver this is </span><strong>Encrypt=True</strong><span> and </span><strong>TrustServerCertificate=False</strong><span>). This helps to prevent your application from a man in the middle attack, by forcing the application to verify the server and enforcing encryption. If you obtain your connection string from the Azure portal, it will have the correct settings.</span>

&nbsp;

Here is a quick cheat-sheet of how the settings on the client and server are going to be impacting your security of communication on the wire.
<table width="941">
<tbody>
<tr>
<td><strong>Force Protocol Encryption client setting</strong></td>
<td><strong>Trust Server Certificate client setting</strong></td>
<td><strong>Encrypt/Use Encryption for Data connection string/attribute</strong></td>
<td><strong>Trust Server Certificate connection string/attribute</strong></td>
<td><strong>Result</strong></td>
</tr>
<tr>
<td>No</td>
<td>N/A</td>
<td>No (default)</td>
<td>Ignored</td>
<td>No encryption occurs.</td>
</tr>
<tr>
<td>No</td>
<td>N/A</td>
<td>Yes</td>
<td>No (default)</td>
<td>Encryption occurs only if there is a verifiable server certificate, otherwise the connection attempt fails.</td>
</tr>
<tr>
<td>No</td>
<td>N/A</td>
<td>Yes</td>
<td>Yes</td>
<td>Encryption always occurs, but may use a self-signed server certificate.</td>
</tr>
<tr>
<td>Yes</td>
<td>No</td>
<td>Ignored</td>
<td>Ignored</td>
<td>Encryption occurs only if there is a verifiable server certificate; otherwise, the connection attempt fails.</td>
</tr>
<tr>
<td>Yes</td>
<td>Yes</td>
<td>No (default)</td>
<td>Ignored</td>
<td>Encryption always occurs, but may use a self-signed server certificate.</td>
</tr>
<tr>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>No (default)</td>
<td>Encryption occurs only if there is a verifiable server certificate; otherwise, the connection attempt fails.</td>
</tr>
<tr>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Encryption always occurs, but may use a self-signed server certificate.</td>
</tr>
</tbody>
</table>
&nbsp;]]></content:encoded>
    </item>
    <item>
      <title>Managing VC++ legacy within your Enterprise</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/managing-vc-legacy-within-your-enterprise</link>
      <pubDate>Mon, 16 Jul 2018 18:21:57 GMT</pubDate>
      <dc:creator><![CDATA[SanketBa]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/?p=905</guid>
      <description><![CDATA[Firstly, let the title of this blog post not fool you. VC++ is very much alive. Take a quick look at...]]></description>
      <content:encoded><![CDATA[Firstly, let the title of this blog post not fool you. VC++ is very much alive. Take a quick look at <a href="https://blogs.msdn.microsoft.com/vcblog/">the VC++ blog</a> and you will see that there is continuous investment still happening with VC++. However, while we say that, there are a lot of organizations that have a ton of legacy VC++ applications either their teams themselves have written or they have got those as a part of third party solutions running in their environment.

For an IT team that is focused on ensuring a supported and secure solution, detecting such legacy applications is sometimes a fairly big task. This post gets into some of the details around the detection of such legacy VC++ projects and runtime.

Now before we delve into the detection mechanisms, let's first look at what are the things that we should be really concerned with. First of all is the supportability. One basic reason for looking at supportability is that you get technical support for the product. But more importantly, it also helps address security concerns. Security threats for various software components are very common and having a supported version of the product ensures not just the technical support but also an assurance that Microsoft will fix the security vulnerabilities on the supported versions as they arise. This, I have seen is a biggie for most enterprises. Having a vulnerable version of software in your environment can potentially lead to  larger attack across your network. Which is why it is absolutely critical to ensure that you are on a supported version. The table below provides details on the supportability of each version of the VC++ runtime. If the applications in your environment are targeting any of the runtimes that are out of support, it is a solid indicator that you need to start either upgrading the application or looking at alternatives.

Before the Visual Studio 2005, VC++ did not provide any redistributable runtime. The runtime dlls were usually shipped along with the application and were usually copied to the application local folders. These dlls were usually available as msvcr70.dll or msvcr71.dll. Do note that up till the VC++ 6.0 time (late 90s), Microsoft also shipped the runtime as msvcrt.dll. However, that dll has since been forked and adopted within the OS. It is supposed to be used by Windows components only. If any applications are using this dll, they are still considered out of support.

&nbsp;
<table width="100%" border="1">
<tbody>
<tr>
<td width="228"><strong>VC++ Runtime Redist Version</strong></td>
<td width="208"><strong>Associated Visual Studio version </strong></td>
<td width="191"><strong>Mainstream support end date</strong></td>
<td width="176"><strong>Extended Support End Date</strong></td>
<td width="197"><strong>Comments</strong></td>
</tr>
<tr>
<td width="228">Microsoft Visual C++ Redistributable for Visual Studio 2017</td>
<td width="208">Visual Studio 2017</td>
<td width="191">4/12/2022</td>
<td width="176">4/13/2027</td>
<td width="197">VC++ 15.0 (vcruntime140) VS2015 &amp; VS2017 use the same VC++ Runtime</td>
</tr>
<tr>
<td width="228">Microsoft Visual C++ Redistributable Packages for Visual Studio 2015 Update 3</td>
<td width="208">Visual Studio 2015</td>
<td width="191">10/13/2020</td>
<td width="176">10/14/2025</td>
<td width="197">VC++ 14.0 (vcruntime140) VS2015 &amp; VS2017 use the same VC++ Runtime</td>
</tr>
<tr>
<td width="228">Microsoft Visual C++ Redistributable Packages for Visual Studio 2013</td>
<td width="208">Visual Studio 2013</td>
<td width="191">4/9/2019</td>
<td width="176">4/9/2024</td>
<td width="197">VC++ 12.0 (msvcr120)</td>
</tr>
<tr>
<td width="228">Multibyte MFC Library for Visual Studio 2013</td>
<td width="208">Visual Studio 2013</td>
<td width="191">4/9/2019</td>
<td width="176">4/9/2024</td>
<td width="197">This add-on for Visual Studio 2013 contains the multibyte character set (MBCS) version of the Microsoft Foundation Class (MFC) Library</td>
</tr>
<tr>
<td width="228">Visual C++ 2013 Runtime for Sideloaded Windows 8.1 apps.</td>
<td width="208">Visual Studio 2013</td>
<td width="191">4/9/2019</td>
<td width="176">4/9/2024</td>
<td width="197"></td>
</tr>
<tr>
<td width="228">Microsoft Visual C++ Redistributable Packages for Visual Studio 2012 Update 4</td>
<td width="208">Visual Studio 2012</td>
<td width="191">1/9/2018</td>
<td width="176">1/10/2023</td>
<td width="197">VC++ 11.0 (msvcr110)</td>
</tr>
<tr>
<td width="228">Microsoft Visual C++ 2010 Service Pack 1 Redistributable Package MFC Security Update</td>
<td width="208">Visual Studio 2010</td>
<td width="191">7/14/2015</td>
<td width="176">7/14/2020</td>
<td width="197">VC++ 10.0 (msvcr100)</td>
</tr>
<tr>
<td width="228">Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package MFC Security Update</td>
<td width="208">Visual Studio 2008</td>
<td width="191">4/9/2013</td>
<td width="176">4/10/2018</td>
<td width="197">VC++ 9.0 (msvcr90)</td>
</tr>
</tbody>
</table>
&nbsp;

&nbsp;

<strong>Detecting Legacy Applications with Source Code</strong>

The easiest detection techniques are often when you already have access to the source code. Within the source code, you would usually start by looking at the project files. This scan will usually be done on the centralized code repository such as TFS or VSTS.

The VC++ source code can have the following project files –
<ul>
 	<li><strong>.dsp project files</strong>: This is a project file for VC++ 6 and earlier. Note that these projects are already out of support and MUST be upgraded ASAP.</li>
</ul>
&nbsp;
<ul>
 	<li><strong>.vcproj project files</strong>: These files are used for VC++ 7 to VC++ 9 runtimes. Again, these are out of support starting April 2018 and MUST be upgraded ASAP. The vcproj is an XML file. It can be parsed further to understand the specific runtime version that it is targeting.</li>
</ul>
<table border="1">
<tbody>
<tr>
<td width="100%">&lt;VisualStudioProject

ProjectType="Visual C++"

Version="9.00"</td>
</tr>
</tbody>
</table>
&nbsp;
<ul>
 	<li><strong>.vcxproj project files</strong>: These files are used for VC++ 10 and above. This one again is an xml file and can be parsed further to understand the specific runtime version being  targeted.</li>
</ul>
<table border="1">
<tbody>
<tr>
<td width="100%">&lt;PlatformToolset&gt;v141&lt;/PlatformToolset&gt;</td>
</tr>
</tbody>
</table>
&nbsp;

<strong>Detecting Third Party Legacy Applications </strong>

Detecting the third party legacy applications is slightly more challenging process. The runtimes usually do not register any link backs to the applications that are using them. Hence, it is a fairly tedious process to understand which applications are using a particular version of the runtime. One of the ways to detect this is to use the <a href="https://docs.microsoft.com/en-us/cpp/build/reference/dumpbin-reference">DUMPBIN utility</a>.

The DUMPBIN utility ships with Visual Studio and allows you to display information regarding a particular binary file. The DUMPBIN /HEADERS option displays the linker version information. This version can be correlated with the table above to understand the VC++ runtime being used and its supportability status.

&nbsp;

Detecting all the legacy VC++ applications is a multi-step process. Following the below steps might help simplify the process for your organization.
<ol>
 	<li><strong>Gather software inventory for VC++ Runtime installations:</strong> This would be the first step and probably the easiest as most organizations already maintain an inventory of installed software or can easily prepare an inventory of the installed software with the configuration management tools. If the machines do note have the older runtimes installed, then there are high chances that those machines are still supported. Unless some rogue application is using an older version of runtime before VS 2005.</li>
 	<li><strong>Inspect Source codes for available applications:</strong> This step ensures that all of the applications written by your development teams are covered and supported.</li>
 	<li><strong>Detect third party application dependencies using DUMPBIN:</strong> This step is perhaps the most challenging and very difficult to automate with some challenges of its own. But possibly once the first two steps are done, it will help address most of the legacy applications within your environment and you would hopefully have a very small subset to perform a scan using DUMPBIN.</li>
</ol>
&nbsp;

Here are some of the links regarding this topic that will be helpful once you start exploring this more -

DUMPBIN Utility Reference - <a href="https://docs.microsoft.com/en-us/cpp/build/reference/dumpbin-reference">https://docs.microsoft.com/en-us/cpp/build/reference/dumpbin-reference</a>

Latest Supported VC++ Runtimes - <a href="https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads">https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads</a>

CRT Distribution with older version of Visual Studio - <a href="https://support.microsoft.com/en-us/help/326922/redistribution-of-the-shared-c-runtime-component-in-visual-c">https://support.microsoft.com/en-us/help/326922/redistribution-of-the-shared-c-runtime-component-in-visual-c</a>

&nbsp;]]></content:encoded>
    </item>
    <item>
      <title>API Management: Quota versus Rate Limits</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/api-management-quota-versus-rate-limits</link>
      <pubDate>Thu, 02 Nov 2017 16:16:23 GMT</pubDate>
      <dc:creator><![CDATA[SanketBa]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/?p=885</guid>
      <description><![CDATA[Azure API Management provides really good capabilities for usage throttling. This is useful in...]]></description>
      <content:encoded><![CDATA[Azure API Management provides really good capabilities for usage throttling. This is useful in scenarios such as defending against a denial of service attack and protecting back-end services against a huge influx of requests to your API layer. It can also be used to provide tier based access restrictions to your customers as a feature.

To implement such throttling capabilities, API management provides abilities to either limit the rate or limit the overall quota for a given subscription. The options you have for implementing these limits are -
<ul>
 	<li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRateByKey">Limit call rate by key</a>: Limits the call rate for a particular subscription key.</li>
 	<li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRate">Limit call rate by subscription</a>: Limits the call rate for a particular subscription. Applies to all the keys in a given subscription.</li>
 	<li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuota">Set Usage quota by Subscription</a>: Limits the overall usage (call volume) for subscription over its lifetime or a period of time. E.g. 1000 calls per month.</li>
 	<li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuotaByKey">Set usage quota by Key</a>: Limits the overall usage (call volume) for a particular subscription key over its lifetime or a period of time.</li>
</ul>
Now at a first glance, both the call rates and usage quotas seem to be for controlling the number of calls over a given period of time. For instance, look at the examples of setting call rate and usage quota by subscription, both of them need a specific timeframe.

Call Rate:

&lt;rate-limit <strong>calls="number"</strong> <strong>renewal-period="seconds"</strong>&gt;
&lt;api name="name" calls="number" renewal-period="seconds"&gt;
&lt;operation name="name" calls="number" renewal-period="seconds" /&gt;
&lt;/api&gt;
&lt;/rate-limit&gt;

&nbsp;

Usage Quota:

<span class="hljs-tag">&lt;<span class="hljs-name">quota</span> <strong><span class="hljs-attr">calls</span>=<span class="hljs-string">"number"</span></strong> <span class="hljs-attr">bandwidth</span>=<span class="hljs-string">"kilobytes"</span> <strong><span class="hljs-attr">renewal-period</span>=<span class="hljs-string">"seconds"</span></strong>&gt;</span><span> </span><span class="hljs-tag">&lt;<span class="hljs-name">api</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"name"</span> <span class="hljs-attr">calls</span>=<span class="hljs-string">"number"</span> <span class="hljs-attr">bandwidth</span>=<span class="hljs-string">"kilobytes"</span>&gt;</span><span> </span><span class="hljs-tag">&lt;<span class="hljs-name">operation</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"name"</span> <span class="hljs-attr">calls</span>=<span class="hljs-string">"number"</span> <span class="hljs-attr">bandwidth</span>=<span class="hljs-string">"kilobytes"</span> /&gt;</span><span> </span><span class="hljs-tag">&lt;/<span class="hljs-name">api</span>&gt;</span><span> </span><span class="hljs-tag">&lt;/<span class="hljs-name">quota</span>&gt;</span><span> </span>

So when do we use quota versus the call rates?

&nbsp;

As a guideline, consider that call rates are usually used to protect against short intense volume bursts. For instance, if you know your backend service gets choked on its database with a high call volume, you would set your API management to not allow high call volume by using this setting. In such cases, this setting can be set to not allow say more than 100 calls every minute.

On the other hand, usage quotas are more for controlling call rates over a longer period of time. Usage quotas for instance can determine the total number of calls in a given month. For monetizing your API, this can also be set to tier based subscriptions where a Basic tier for instance can make no more than 10,000 calls a month but a Premium tier can go up to 100,000,000 calls each month.

From the API management implementation standpoint, the rate limits information is understood to be for a shorter duration (less than 5 minutes) and hence any changes in rate limits are propagated faster across the nodes to protect against spikes. The usage quota information on the other hand is expected to be used over a longer term and hence its implementation is different.

In summary, call rates protect against short intense volume bursts and usage quotas for longer duration access restrictions and tier based monetization scenarios.

&nbsp;

Hope this helps.

&nbsp;]]></content:encoded>
    </item>
    <item>
      <title>ASP.Net Session Swapping – Why it happens and what can be done about it?</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/asp-net-session-swapping-why-it-happens-and-what-can-be-done-about-it</link>
      <pubDate>Tue, 07 Mar 2017 18:21:29 GMT</pubDate>
      <dc:creator><![CDATA[SanketBa]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/?p=855</guid>
      <description><![CDATA[Referring my recent post from the Premier Developer Blog.

Kernel Cache is a powerful and...]]></description>
      <content:encoded><![CDATA[Referring my <a href="https://blogs.msdn.microsoft.com/premier_developer/2017/01/19/asp-net-session-swapping-why-it-happens-and-what-can-be-done-about-it/">recent post from the Premier Developer Blog</a>.

Kernel Cache is a powerful and well-known feature introduced in IIS 7 and found in all later versions.  It’s the highly performant server level cache that very efficiently delivers frequently used content.  Since the cache is in kernel memory, it is served even before the request reaches the IIS pipeline and, hence, it’s lightning fast.  The problem arises with ISAPI components if <em>they are attaching session cookies on the content in Kernel cache,</em> then it is possible to run into a “session-swap” issue.  In other words, a session for userA gets assigned to userB.  This issue can happen on IIS 7 onwards including IIS 8 and IIS 8.5 versions.

Kernel cache has a very <a href="https://support.microsoft.com/en-us/kb/817445">strict policy for what gets stored in this cache and how it gets scavenged</a>.  If any content that meets this criteria also has the session cookies attached to it by an ISAPI component, then content still gets cached.  The subsequent requests from other users will find the content in the session cache and in process will also get the session cookies for the other user.  That’s the mechanism for session swap.  <em>This does not happen for managed components since </em>IIS can better track how managed components are manipulating responses. Hence, if any managed component attaches a session cookie to a content that can potentially be stored in the kernel cache, that response content does not get stored in the kernel cache. However,  ISAPI components are not cache aware and hence the issue.

The guidelines for ISAPI components regarding the kernel cache suggest that components either make themselves cache-aware by using the <a href="https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/f2ccb603-3202-49da-9071-f472e0176d18.mspx?mfr=true">FilterEnableCache metabase property</a> or disable caching for a specific response each time they perform a set-cookie operation on the response. This becomes tricky when using third-party components since you don’t have control of the ISAPI source code.  The only option in that case is to disable the Kernel mode cache.

Disabling the kernel cache is a configuration change.  If it is not locked at the applicationhost.config level, the applications can choose to override.  In a multi-tenant environment, you might wonder about how to determine if any applications accidentally enable this?  Kernel cache provides a set of <a href="https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/ba61cb2d-2c0b-4709-9270-8fb79a16f7d9.mspx?mfr=true">performance counters</a> that can be monitored for any such activity.  It’s important to note, however, the kernel cache is controlled by http.sys so restarting IIS does not have any impact on the values of the performance counters. It is quite possible to keep seeing stale values in the performance counters even when the kernel cache is disabled, misleading you to believe that the cache is still being utilized.  When tracking the perfmon data, it will also be observed that when performing an IIS reset, the aggregate counters such as Total URIs cached, Total Hits, Total Misses etc will go down to zero momentarily and then bounce back the original stale values.  Since the kernel cache is being handled by http.sys and this driver is never restarted, the aggregate counters never lose their values.

Perfmon counters interact with the IIS Admin Service for monitoring purposes.  Since an IIS Reset causes this service to stop and restart, perfmon is not able to read the counter values during that time and hence the momentary zero values.  This does not indicate any changes in the actual values of the counters, rather, that the values were simply not availably for that time when the admin service was restarting.  Restarting the HTTP service using the “NET STOP HTTP” command will reset these counters to zero.

As an effective monitoring strategy for identifying Kernel cache usage, it is recommended that teams monitor the “Current URIs cached” performance counter and alert if the value for this counter goes above zero.  The other counters specified <a href="https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/ba61cb2d-2c0b-4709-9270-8fb79a16f7d9.mspx?mfr=true">here</a> can be tracked for post-mortem purposes.  Typical monitoring products such as <a href="https://technet.microsoft.com/en-us/library/hh205987(v=sc.12).aspx">Systems Center Operations Manager</a> can be used to monitor and alert on these performance counter values.

&nbsp;]]></content:encoded>
    </item>
    <item>
      <title>Auto-Start your ASP.Net apps</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/auto-start-your-asp-net-apps</link>
      <pubDate>Mon, 30 Jan 2012 10:48:42 GMT</pubDate>
      <dc:creator><![CDATA[Sanket B]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/2012/01/30/auto-start-your-asp-net-apps/</guid>
      <description><![CDATA[Moving to the .net paradigm a decade ago, the JIT compiler has always been a nasty part of most of...]]></description>
      <content:encoded><![CDATA[<p>Moving to the .net paradigm a decade ago, the JIT compiler has always been a nasty part of most of us developing the ASP.Net applications. I cannot recollect how many times I have wished that I was able to provide exactly the same experience to the first user that the subsequent users would see. So this includes, pre-loading of assemblies, pre-executing mechanisms that built data cache and a countless number of possibilities. A lot of times, we used to achieve these using some hacks to either write a separate process that would trigger some dummy requests just to boot up the application or to write some ISAPI handlers or HTTP modules to do it if it is an internet facing site. 
</p><p>Well, as always is with the hard days – they need to end somewhere. I recently discovered this ASP.net 4.0 feature that allows us to do just exactly that – auto-start the applications. Quite a no-brainer that the feature is titled "auto-start". 
</p><p>The ASP.net auto start feature allows us to automatically boot up the ASP.net applications and execute certain code that would be critical for the efficient functioning of the app - for instance, loading items into an in-memory cache or just pre-loading certain heavy assemblies. 
</p><p>The feature is partly enabled by the functionality in IIS 7.5 that helps load the worker process and application proactively. Hence IIS 7.5 is definitely required for this to work. 
</p><p>
 </p><p><span style="font-size:14pt"><strong>Getting it to work 
</strong></span></p><p>    <strong><span style="font-size:12pt">What changes on the configuration?</span>
		</strong></p><p style="margin-left: 72pt">To use this feature, you will need to modify the applicationHost.config file under <span style="font-family:Arial; font-size:10pt">(C:\Windows\System32\inetsrv\config\applicationHost.config) and change the start mode of the application pool to "AlwaysRunning". This ensures that the application pool is always running and does not stop after a couple of minutes of inactivity – which is the case for the default setting of the application pools. 
</span></p><p style="margin-left: 72pt"><span style="font-family:Arial; font-size:10pt">Now since one app pool usually hosts more than one web application, it is also important that the web application specifies explicitly if it wants to perform any pre-load tasks. This is done very easily by adding a "ServiceAutoStartEnabled" attribute on the specific web site in the same file and setting it to "true". 
</span></p><p style="margin-left: 72pt"><span style="font-family:Arial; font-size:10pt">As the last bit in the configuration, we also need to create an entry for autostart provider and reference it at the site level. So, when completed, sections of your web config would look something similar to – 
</span></p><p style="margin-left: 108pt"><span style="font-size:10pt"><span style="color:blue; font-family:Courier New">&lt;</span><span style="font-family:Courier New">applicationPools<span style="color:blue">&gt; <br/>&lt;</span>add<span style="color:blue">
					<span style="color:red">name<span style="color:blue">=</span>"<span style="color:blue">MyAppPool</span>" managedRuntimeVersion<span style="color:blue">=</span>"<span style="color:blue">v4.0</span>"<span style="color:blue">
							<span style="color:red"><strong>startMode<span style="color:blue">=</span>"<span style="color:blue">AlwaysRunning"</span></strong> /&gt;</span>
						</span><br/><span style="color:blue">&lt;/</span>applicationPools<span style="color:blue">&gt; </span></span></span></span><span style="font-family:Times New Roman">
			</span></span></p><p style="margin-left: 108pt"><span style="font-size:10pt"><span style="color:blue; font-family:Courier New">&lt;</span><span style="font-family:Courier New">sites<span style="color:blue">&gt; </span></span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">&lt;</span><span style="font-family:Courier New">site<span style="color:blue">
					<span style="color:red">name<span style="color:blue">=</span>"<span style="color:blue">MySite</span>"<span style="color:blue">
							<span style="color:red">id<span style="color:blue">=</span>"<span style="color:blue">1</span>"<span style="color:blue">&gt; </span></span></span></span></span></span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">&lt;</span><span style="font-family:Courier New">application<span style="color:blue">
					<span style="color:red">path<span style="color:blue">=</span>"<span style="color:blue">/</span>" <strong>serviceAutoStartEnabled</strong></span><strong>="true</strong></span><strong>" <span style="color:red">serviceAutoStartProvider</span>="</strong><span style="color:blue"> MySitePreLoad</span><strong>" </strong>/<span style="color:blue">&gt;</span></span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">&lt;/</span><span style="font-family:Courier New">site<span style="color:blue">&gt; </span></span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">&lt;/</span><span style="font-family:Courier New">sites<span style="color:blue">&gt;</span></span><span style="font-family:Times New Roman">
			</span></span></p><p style="margin-left: 108pt"><span style="font-size:10pt"><span style="color:blue; font-family:Courier New">&lt;</span><span style="font-family:Courier New">serviceAutoStartProviders<span style="color:blue">&gt; </span></span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">&lt;</span><span style="font-family:Courier New">add<span style="color:blue">
					<span style="color:red">name<span style="color:blue">=</span>"<span style="color:blue">MySitePreLoad</span>" type<span style="color:blue">=</span>"<span style="color:blue">MyTypeForWarmup, SomeAssembly</span>"<span style="color:blue"> /&gt;</span>
					</span></span></span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">&lt;/</span><span style="font-family:Courier New">serviceAutoStartProviders<span style="color:blue">&gt; </span></span><span style="font-family:Times New Roman">
			</span></span></p><p><span style="font-family:Arial; font-size:10pt">        In some of the cases, you might encounter a file not found error when trying to edit this file in Visual Studio. The best way that I found to circumvent this is to simply open the file in Notepad – it always works.
</span></p><p>
 </p><p><span style="font-family:Arial"><span style="font-size:10pt">    </span><strong>What changes in the code?<span style="font-size:10pt">
				</span></strong></span></p><p style="margin-left: 72pt"><span style="font-family:Arial; font-size:10pt">As you might've noticed in the above snippets, we need to specify a type for the auto start service providers. As with most of the types that you specify in the configs, this one also needs to be written in a particular way. The below code snippet demonstrates how we can specify the pre-load logic in code.
</span></p><p style="margin-left: 72pt"><span style="font-size:10pt"><span style="color:blue; font-family:Courier New">public</span><span style="font-family:Courier New">
				<span style="color:blue">class</span>
				<span style="color:blue">MyTypeForWarmup</span>: System.Web.Hosting.IProcessHostPreloadClient <br/>{ </span><span style="font-family:Times New Roman"><br/></span><span style="color:blue; font-family:Courier New">   npublic</span><span style="font-family:Courier New">
				<span style="color:blue">void</span> Preload(<span style="color:blue">string</span>[] parameters) <br/>   { </span><span style="font-family:Times New Roman"><br/></span><span style="color:green; font-family:Courier New">       // Code for pre load goes here. </span><span style="font-family:Times New Roman"><br/></span><span style="font-family:Courier New">   } </span><span style="font-family:Times New Roman"><br/></span><span style="font-family:Courier New">} </span><span style="font-family:Times New Roman">
			</span></span></p><p style="margin-left: 72pt"><span style="font-family:Arial; font-size:10pt">This class and the code in the PreLoad method is what will get executed on the appPool start and recycle events.  Once this method executes completely, the ASP.net application will be marked as "Ready for processing requests" and subsequently IIS will start sending requests your way. 
</span></p><p>
 </p><p><span style="font-family:Arial; font-size:10pt">This is definitely one of the features that I have been longing for on the ASP.net sites and I am pretty sure it will help you in a lot of scenarios as well. 
</span></p>]]></content:encoded>
    </item>
    <item>
      <title>Availability, Scalability and DR for BizTalk Server</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/availability-scalability-and-dr-for-biztalk-server</link>
      <pubDate>Fri, 11 Nov 2011 12:31:00 GMT</pubDate>
      <dc:creator><![CDATA[Sanket B]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/2011/11/11/availability-scalability-and-dr-for-biztalk-server/</guid>
      <description><![CDATA[Recently, I had to talk to a customer of mine explaining setting up of optimal BizTalk...]]></description>
      <content:encoded><![CDATA[Recently, I had to talk to a customer of mine explaining setting up of optimal BizTalk infrastructure. It was almost a 101 conversation regarding BizTalk Availability, Scalability and Disaster Recovery. That's when I realized that there is not really a unified a concise view of these concepts anywhere on the Internet. Here a stab that I took at it for a really short, crisp, 5 minute view of the topic.

&nbsp;

BizTalk Server comprises of the front end application servers that perform the processing and the backend SQL Servers that hold the in-flight messages and configurations for the server. In order to ensure a highly available solution, both these tiers need to be considered.

&nbsp;

<span style="text-decoration: underline"><strong>High Availability </strong></span>

<span style="text-decoration: underline"><strong>SQL Server tier </strong></span>
<p style="padding-left: 60px">The high availability at the database tier can be achieved by using SQL clustering and is very standard in terms of configuration. The below link explains this in details. <a href="https://msdn.microsoft.com/en-us/library/aa559920.aspx">https://msdn.microsoft.com/en-us/library/aa559920.aspx</a></p>
&nbsp;

<span style="text-decoration: underline"><strong>BizTalk Server tier </strong></span>

This link discusses the BizTalk Groups feature in further detail. <a href="https://msdn.microsoft.com/en-us/library/aa559010(BTS.70).aspx">https://msdn.microsoft.com/en-us/library/aa559010(BTS.70).aspx</a>
<p style="margin-left: 36pt">Secondly, the BizTalk Server tier can constitute of multiple "Hosts". The BizTalk Hosts run as windows services and allow segregating the processing of different logical components in the solution. Hence allowing process and memory separation on the server for these different solution components. These hosts can reside on multiple servers within the group hence inheriting the high availability features provided by the groups.</p>
<p style="margin-left: 36pt">In certain cases, the hosts cannot run on multiple groups – for instance a host that is responsible for running ports that receive file inputs from FTP. In this case, if the host is running on multiple servers, all the servers will be trying to get the same resource (file). In order to avoid such scenarios, the hosts can be clustered in active/passive mode. The below links discuss more about Hosts and their clustering.</p>

<ul style="margin-left: 54pt">
 	<li>BizTalk Hosts - <a href="https://msdn.microsoft.com/en-us/library/aa578695.aspx">https://msdn.microsoft.com/en-us/library/aa578695.aspx</a></li>
 	<li>Host Clustering - <a href="https://technet.microsoft.com/en-us/library/aa560059(BTS.10).aspx">https://technet.microsoft.com/en-us/library/aa560059(BTS.10).aspx</a></li>
</ul>
&nbsp;

<span style="text-decoration: underline"><strong>Scalability </strong></span>
<p style="margin-left: 36pt">Scaling of BizTalk servers can again be done on either the SQL tier or the BizTalk Server tier depending on where the bottlenecks are present in a given infrastructure. The BizTalk message box is usually the most used database and that can be scaled by adding multiple message box databases as detailed on this link  (<a href="https://msdn.microsoft.com/en-us/library/cc296848(v=bts.10).aspx">https://msdn.microsoft.com/en-us/library/cc296848(v=bts.10).aspx</a>).</p>
<p style="margin-left: 36pt">Scaling for the BizTalk Server tier essentially means adding a new BizTalk server to the group so that it can start sharing the load immediately. This can be done without bringing down any of the existing servers in the group. Also, we can choose to configure only selected hosts on the new server. Hence ensuring that we augment the capacity only at the place where it is absolutely required in the solution.</p>
&nbsp;

<span style="text-decoration: underline"><strong>Disaster Recovery </strong></span>

The BizTalk databases form an important part of disaster recovery since they hold all the in-flight messages. BizTalk server provides its own log shipping routines that allow log shipping the BizTalk databases to be replicated on the DR site. This link provides more information on the same. (<a href="https://social.technet.microsoft.com/wiki/contents/articles/5363.biztalk-server-disaster-recovery.aspx">https://social.technet.microsoft.com/wiki/contents/articles/5363.biztalk-server-disaster-recovery.aspx</a>)]]></content:encoded>
    </item>
    <item>
      <title>Hotfix for assembly reference issues with BizTalk Projects in Visual Studio 2009</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/hotfix-for-assembly-reference-issues-with-biztalk-projects-in-visual-studio-2009</link>
      <pubDate>Thu, 05 Aug 2010 13:43:06 GMT</pubDate>
      <dc:creator><![CDATA[Sanket B]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/2010/08/05/hotfix-for-assembly-reference-issues-with-biztalk-projects-in-visual-studio-2009/</guid>
      <description><![CDATA[When working with a BizTalk solution, I ran into these issues a lot of times. 
The orchestrations...]]></description>
      <content:encoded><![CDATA[<p>When working with a BizTalk solution, I ran into these issues a lot of times. </p>
<ul><li>The orchestrations in the referenced BizTalk project may show compiler warnings. </li>
<li>The changes that are made to the referenced BizTalk project are not propagated on to the referencing project. </li>
<li>When you edit the orchestrations of the referenced project, XLANG errors are thrown. These errors may disappear after the orchestrations are saved and recompiled. </li>
<li>After you deploy the referencing project, the local copies of the referenced project&rsquo;s binaries are deleted. </li>
<li>After you deploy the referencing project, various errors or warnings occur in Orchestration Designer.</li>
</ul><p>A colleague then metioned about this <a target="_blank" href="https://support.microsoft.com/kb/977428" title="KB 97748">hotfix - KB 97748</a>. After installing this, the references do work like a charm. </p>
<p>--Sanket</p>
<p>&nbsp;</p>]]></content:encoded>
    </item>
    <item>
      <title>ESB Toolkit 2.0 – Unable to add new itinerary</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/esb-toolkit-2-0-unable-to-add-new-itinerary</link>
      <pubDate>Thu, 08 Apr 2010 07:44:00 GMT</pubDate>
      <dc:creator><![CDATA[Sanket B]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/2010/04/08/esb-toolkit-2-0-unable-to-add-new-itinerary/</guid>
      <description><![CDATA[So here is what happened. On a 64 bit Windows 2008 server, I got the required BizTalk &amp; Visual...]]></description>
      <content:encoded><![CDATA[<p>So here is what happened. On a 64 bit Windows 2008 server, I got the required BizTalk &amp; Visual Studio components installed and configured along with ESB pre-requisites. Once done with the ESB Toolkit configuration, I started with creating a sample itinerary. </p>
<p>Created a new C# Class Library project and right clicked the project to "Add"&gt;"New Itinerary&hellip;". However, when the template selection dialog box came up, the itinerary template was not visible. Tried a couple of things including restarting VS in admin mode (common remedy), repair the toolkit installation, repaired the Visual Studio 2008 DSL SDK etc. However, none seemed to help much. </p>
<p>Apparently, the item templates were not properly registered with visual studio. So the fix was as simple as running the below command &ndash; </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;<strong><em>devenv /installvstemplates </em></strong></p>
<p>After this, I restarted the Visual Studio and was able to get the itinerary template thereafter. </p>
<p>--Sanket </p>]]></content:encoded>
    </item>
    <item>
      <title>Quick Tips: DTA DB Purge without Archiving</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/quick-tips-dta-db-purge-without-archiving</link>
      <pubDate>Sat, 06 Jun 2009 13:16:30 GMT</pubDate>
      <dc:creator><![CDATA[Sanket B]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/2009/06/06/quick-tips-dta-db-purge-without-archiving/</guid>
      <description><![CDATA[BizTalk provides an out of the box job that can be configured to archive and purge BizTalk...]]></description>
      <content:encoded><![CDATA[<p>BizTalk provides an out of the box job that can be configured to archive and purge BizTalk databases. But sometimes you might be in a situation where archival not necessary and you might as well save that time and simply purge the tracking data. 
</p><p>If you want to do that, here is a quick tip – 
</p><ul><li>Open the SQL Management Studio, connect to the BizTalk tracking database server
</li><li>Run the following sproc on the DTADB - <span style="color:black; font-family:Verdana; font-size:8pt"><em>dtasp_PurgeAllCompletedTrackingData</em></span>
		</li></ul><p>This stored procedure takes care of purging all the data without archiving. This link (<a href="https://msdn.microsoft.com/en-us/library/dd745781.aspx">https://msdn.microsoft.com/en-us/library/dd745781.aspx</a>) will provide further details for BizTalk 2006 R2.
</p><p>It's very handy when cleaning off the database for production go-live after performing a quick smoke test.
</p><p>--Sanket
</p>]]></content:encoded>
    </item>
    <item>
      <title>Required NTFS permissions for BizTalk File Adapter connecting to network share</title>
      <link>https://docs.microsoft.com/archive/blogs/sanket/required-ntfs-permissions-for-biztalk-file-adapter-connecting-to-network-share</link>
      <pubDate>Fri, 05 Jun 2009 22:38:48 GMT</pubDate>
      <dc:creator><![CDATA[Sanket B]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.msdn.microsoft.com/sanket/2009/06/05/required-ntfs-permissions-for-biztalk-file-adapter-connecting-to-network-share/</guid>
      <description><![CDATA[When connecting to a network file share using BizTalk File adapter, you might've noticed that just...]]></description>
      <content:encoded><![CDATA[<p>When connecting to a network file share using BizTalk File adapter, you might've noticed that just specifying "Modify" rights is not sufficient. In simple configuration terms, you would need to have a minimum of "Full Control" or the BizTalk Host Service Account. Obviously this would not gel well with the system administrators. 
</p><p>Tom Canter (<a href="https://blogs.neudesic.com/blogs/enterprise_integration/archive/2007/02/22/4260.aspx">https://blogs.neudesic.com/blogs/enterprise_integration/archive/2007/02/22/4260.aspx</a>) has put down the exact permissions that you would require for the FILE adapter that would help alleviate some of the concerns for the admins. 
</p><p>
 </p><p>Overall, here is what it boils down to – 
</p><p>
 </p><p><span style="text-decoration:underline"><strong>For the FILE Receive Adapter 
</strong></span></p><ul><li>After you provide "Modify" rights, Click on "Advanced" button and on the Advanced Security Dialog, edit the permission entries for the BizTalk Service Account
</li><li>Here you will notice that the "Delete Sub Folders and Files" option is not given by default. This is exactly the missing link for the receive adapter.
</li><li>Simply set this property and you are good to go without "Full Control"
</li></ul><p>
 </p><p><span style="text-decoration:underline"><strong>For the FILE Send Adapter
</strong></span></p><ul><li><div>If you are NOT USING the "use temporary file while writing" attribute on your send port, only the following permissions are required on the permissions entry dialog
</div><ul style="margin-left: 72pt"><li><div>Create Files / Write Data
</div><p>
 </p></li></ul></li><li><div>If you are using the "use temporary file while writing" attribute on your send port, the following permissions are required on the permissions entry dialog
</div><ul style="margin-left: 72pt"><li>Create Files / Write Data
</li><li>Delete Files
</li><li>Delete Sub Folders and Files
</li><li>Read Permissions
</li></ul></li></ul>]]></content:encoded>
    </item>
  </channel>
</rss>