win10digimon

Always On VPN - Face to Face with Direct Access

Antonio Vasconcelos [MSFT] — Mon, 02 Oct 2017 14:39:27 GMT

For ages that Direct Access was *the* Microsoft de facto solution for Enterprises to seamlessly connect remote devices into their corporate network. But times changed (fast!) and we needed different, let's even say "better", solutions. Let's enumerate a couple of points where DA was not so suitable.

It only worked with Windows devices (PC). We had to show some love for Windows 10 Mobile, right? :)
It was only for Domain Joined devices
Enterprise SKU only
Required a complex infrastructure
No Azure AD (DJ++) support!! Windows AutoPilot FTW!!!
etc.

More info regarding Always ON VPN vs DA. So... are you looking for a new remote connectivity solution? Look no further! Here's a fresh deployment guide for Always On VPN.

Remote Access Always On VPN Deployment Guide for Windows Server 2016 and Windows 10

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy There's also a Microsoft IT Showcase case study, if you want to have a look on how MSIT implemented Always On VPN in Microsoft. Enhancing remote access in Windows 10 with an automatic VPN profile https://www.microsoft.com/itshowcase/Article/Content/894/Enhancing-remote-access-in-Windows-10-with-an-automatic-VPN-profile Happy VPN'ing!!

Happy Anniversary Windows 10!!

Antonio Vasconcelos [MSFT] — Wed, 03 Aug 2016 00:08:23 GMT

So, here it is! Finally! Windows 10 Anniversary Edition (1607), or as I prefer calling it, Redstone (1). And yes, we know, it was launched in August (month 08), but the build was closed in July, hence the 07 :) And, you might be thinking... Why Redstone? Well, Redstone means (at least in my uneducated Minecraft experience) Power! Power to change, power to transform, power to be creative and last but not least, power to "(...) empower every person and every organization on the planet to achieve more" (Satya copyright). The changes in Redstone 1 are massive! Especially those that are not UI related. Security was once again a huge focus, and new features where introduced to revolutionize the World. For example, Windows Information Protection and Windows Defender Advanced Threat Protection. Naturally that previously existing security features where dramatically improved, so you can count on a more robust Windows Hello, Device Guard, Credential Guard and Windows Hello for Business (former Microsoft Passport for Work). On a productivity point of view, Windows Ink is one of my favorites. The improved Start Menu, Action Center and Cortana, the new Skype Preview and tons more, makes this release one of the most groundbreaking piece of software launched by the fearless Windows Devices Group (What's New in 1607). Head out to https://blogs.windows.com/windowsexperience/2016/08/02/how-to-get-the-windows-10-anniversary-update/ and find more info on how to get the latest Windows version. The ISO's are already available and can be downloaded via the Media Tool: https://www.microsoft.com/en-us/software-download/windows10. You can also get Windows 10 1607 from other resources, like Volume Licensing Service Center (Enterprise), MSDN Portal (Dev's), Windows Insider site (preview builds) and the Download Academic Products page (Education editions, product key required). Don't forget to visit Channel 9 MSDN to grab more details on the mentioned features. Congrats Windows 10! And by the way, start your engines for Redstone 2 (be an Insider!)!! See you around! (here's some wicked Minecraft art especially crafted for this post :P)

Microsoft Ignite (Bis)

Antonio Vasconcelos [MSFT] — Tue, 02 Aug 2016 22:24:53 GMT

Last year I had the honor to participate in one of the biggest IT Pro events WW, Microsoft Ignite (Chicago). If you haven't had a chance to watch some cools sessions, check out the sessions where I participated last year: Single Sign On (SSO) with BitLocker and Common Myths about Pre-Boot Authentication Attacks https://channel9.msdn.com/Events/Ignite/2015/BRK2345 Scratching the Surface: Lessons from Support https://channel9.msdn.com/Events/Ignite/2015/BRK4300 And guess what?! :) I'll be there once again this year! So, let's meet in Atlanta! I should be around the Surface + Windows booth in the Expo area. Have questions? Want to hang around with geeks? Then don't hesitate to pass by! See you around!

It all ended at 11:59 PM, in Hawaii...

Antonio Vasconcelos [MSFT] — Sat, 30 Jul 2016 17:52:45 GMT

Yep! 1 year already! Time flies when you're having fun:) The free upgrade offer for Windows 10 ended yesterday at 11:59 PM, UTC -10 (Hawaii). 1 year later, and with more than 350 million machines installed, it surely was a nice ride. But it's only the beginning! Enterprises that have SA (Software Assurance), will always be able to upgrade to Windows 10, following always the innovations that Microsoft is making available. Alternatively, it's either via the Volume Licensing program or when buying new hardware from your favorite OEM. For home users, head out to your favorite retail store, buy it online via Microsoft Online Store or if you have Windows 8.1 you can purchase the upgrade in Windows Store. See you around!

SCM 4.0 in the house!

Antonio Vasconcelos [MSFT] — Sat, 30 Jul 2016 17:11:23 GMT

Compliance and IT... Lack of compliance is like not having butter to pour on your morning toast.... Well... not so drastic, but very close ;) For ages that Microsoft, together with a bunch of specialists, have produced a list of industry best practices for products like Windows, Exchange, SQL, etc. This week, we witnessed the birth of Security Compliance Manager 4.0! (queue heavenly music here) Besides being free, it's awesomely cool since it allows you to save a ton of work when creating new policies, or simply managing, customizing or analyzing already existing ones. And don't forget those DCM (Desired Configuration Management, aka Compliance Settings Manager) packs that you can use with System Center Configuration Manager. It even sports the new recommendations for Windows Server 2016, which should be among us pretty soon! As of now, TP5 is the latest preview build if you want to test it. You can get SCM 4.0 from here: http://go.microsoft.com/fwlink/?LinkId=823534 Here's a bit of guidance regarding security baselines. Windows security baselines https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-security-baselines And don't forget to follow the Microsoft Security Guide blog! https://blogs.technet.microsoft.com/secguide/ See you around!

cowsay "Hello World!"

Antonio Vasconcelos [MSFT] — Sat, 30 Jul 2016 16:36:41 GMT

cowsay "Hello World!" :) How cool is that?!? It clearly brings back memories. Not that I haven't been in touch with Linux for the past 5 years, but I do remember clearly all the VM's and emulators, ala Cygwin, that I used to run in Windows. It's truly awesome to run bash and everything that it implies, natively in Windows 10 :D Personally, things like SSH are mandatory to have, so being able to run out-of-the-box that, it's like Xmas in Summer. Well, not really but you get the picture ;) Check it out! It's easy to enable and enjoy, and although naturally there's still a lot to walk, it's clearly an awesome start. There's a ton of nice technical articles, how to and videos out there, so I won't reinvent the wheel. Go, search and have fun! Here's a few of my recommendations to you: Windows Subsystem for Linux: Architectural Overview https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-Subsystem-for-Linux-Architectural-Overview Windows Subsystem for Linux Overview https://blogs.msdn.microsoft.com/wsl/2016/04/22/windows-subsystem-for-linux-overview/ The Performance Of Ubuntu Software Running On Windows 10 With The New Linux Subsystem http://www.phoronix.com/scan.php?page=article&item=windows-10-lxcore&num=6 See you around! sudo kill -SIGKILL me

The 5 million microsecond question

Antonio Vasconcelos [MSFT] — Thu, 25 Apr 2013 17:14:00 GMT

Recently I was helping a costumer analyzing their Windows image and the OS performance, in particular the boot times. And for this customer 1^st logon was a big priority, since it was taking around +200 seconds. At least they wanted to understand what was going on, even that we would or would not be able to optimize it. Here’s a bit of info before we start:

Corei5 + 8GB RAM machine
Win7 + SP1 + latest windows updates installed
They were not using Roaming Profiles
They were using Folder Redirection, but to a local partition, instead of going to a remote server
Some GPOs/GPPs, but nothing too much complex like WMI/Item Level Targeting
The +200 seconds could be reproduced either by Wi-Fi or LAN

Called in the “big guns”, aka Windows Performance Toolkit (WPT), version 5, and took a boot trace for a 1^st logon. Now, there’s already a lot of info about WPT, xperf, wpa and xbootmgr around the web and therefore no need to explain it here. I usually like to start with a simpler trace just to make sure that the machine will not be affected for the amount of info being generated, like an “xbootmgr -trace boot -traceflags DiagEasy”. But in this case the computer had nice specs and it would easily be able to cope with more flags+stackwalk. So, I basically issued the following command: “xbootmgr -trace boot –traceflags base+latency+dispatcher -stackwalk profile+cswitch+processcreate+threadcreate+readythread” For stackwalk, don’t forget to disable paging executive (http://support.microsoft.com/kb/184419). Rebooted, logged in with a never logged on before user, and waited :) The result was this: Around 209 seconds to arrive at the desktop. The purple bar accounts for all the activity after the desktop is ready, which in the case was a bit extended, but nevertheless this was not the main issue. The issue, which is quite easy to spot, was the Winlogon phase, where we have Services, CAD (CTRL+ALT+DEL), GPO, etc. With WPA (Windows Performance Analyser), there’s a specific graphic for the Windows Logon along with his sub phases. Let’s take a peek: Hum… it seems that the wait was because of GPClient. Ok, there are several ways to troubleshoot group policies, but with an xbootmgr trace, by default, we have group policy events logged. Going to Generic Events, table mode, filtering for Windows Logon and Group Policy providers, and moving the column time to the left side (grouping by time that is), we arrived to this view: Now let’s hunt our waits! Or by other words, make use of your mouse scroll and search for big intervals of time. The first one to stand out is this: This is what happens when our fingers don’t collaborate and we mistype our password :D Moving on, we’ve stumbled into a 37 sec gap, just after Folder Redirection started. Filtering by the start and stop event for Folder Redirection, it looks like that we spent 113 seconds processing that specific CSE (Client Side Extension). Let’s do a short cut. I can tell you that there was no resource contention (CPU, Disk, Memory), or network issues. We also did some network packet traces with netsh and reviewed them with Netmon, but nothing was wrong. Since we activated stackwalk on this trace, I decided to start analyzing the process and thread responsible for the Folder Redirection CSE. After going to “CPU Usage (Precise)”, basically CPU usage based on context switch, and arranging a little bit the columns and walking the stack, here’s the result. At this image it’s possible to see the start of GPO processing, moving on to Folder Redirection CSE (fdeploy.dll) and then calling in “SHELL32.DLL”, the shell, which will be responsible to create the new directories. It seems that we have 11 times * 5 second wait, making a total of 55 second doing nothing… since the readying process was “Idle (0)”. We have 11 waits, which by coincidence are exactly the same number of folders that are being redirected. So, I would say that just before performing the redirection of each folder, there’s a 5 second wait… But for what?!? Took another trace, again reproducing a first logon, and added new flags in order to obtain more details, and therefore a possible insight. “xbootmgr -trace boot –traceflags base+latency+dispatcher+registry+file_io+file_io_init -stackwalk profile+cswitch+processcreate+threadcreate+readythread” Re-did all the same steps has before, and used one of the eleven 5 second interval. In this new trace, the responsible process was “svchost.exe (924)”, along with thread 1896. Adding to the same analysis view file+registry information and making use of WPA synchronized selection (basically highlights events in different graphics/tables when you select a particular interval/event in time), gave me this vision: ´ During the creation of the new folder, where the redirection will be done to, there’s some registry keys that have “STATUS_OBJECT_NAME_NOT_FOUND”. Might be worth it to search in there :) A little bit of search magic (searching by “redirection” for example) returned a registry key “FolderRedirectionWait”. We have a winner!!! Now it was just a question of digging on the Web to understand why this key was called and doesn’t exist by default. From http://social.technet.microsoft.com/Forums/pt-BR/w7itproperf/thread/dc3b77da-7fe4-4b09-bf95-aabcce4b7000: “The 5 seconds delay is due to the NTFS quota. If the server has per-directory auto quota enabled, it might take them a while to apply to the folder we just created. So, if we are query quota too early, we might get the wrong number. It is very hard from client side to know the auto quota applied on the server. So let's just wait a little bit here.” There we have it! The delay is by design in order to check for NTFS quotas on the server side. Only when the option “Move contents…” in the Folder Redirection policy is enabled. In this specific scenario, the redirection was being done to the same disk but a different partition, with no NTFS quotas. Which means that we can skip this 5 second interval by creating the registry key and set the value to 0 (millisecond). Here's the final result after adding the key and redoing the 1st logon: