Bienvenue, on Frédéric ESNOUF's Web Log

C’est le moment de penser à migrer vers TS 2012 !

Frédéric ESNOUF — Thu, 02 May 2013 14:08:44 GMT

Dans le cadre de mon activité, j’ai fréquemment l’opportunité de parler infrastructure avec mes clients et mes partenaires, et les infrastructures VDI sont un point important des discussions.

Au sein de ces échanges nous avons des débats techniques, licences, mais aussi avec l’arrivée du Cloud, certains discussions intéressantes atour d’Azure.

L’idée de ce billet est donc de regrouper un certain nombre de liens sur lesquels vous aller très rapidement trouver des réponses..

Quelques points d’attention

Sur la base de mon expérience, quelques petits points d’attention et quelques vérification à réaliser de votre coté :

* Warning 1 : de nombreux clients disposent encore de licences (CAL) Terminal Server en version 2000. Attention, ce n’est plus supporté, pensez à mettre à jour votre environnement !

* Warning 2 : Toujours au niveau CALs, certains clients utilisent une infrastructure TS 2003 avec des licences 2003. Bien qu’encore supporté, le support est passé en phase étendue, et se termine dans quelques mois. Il est important de planifier une réflexion dans ce domaine (budget, architecture, etc..), plein de nouvelles fonctionnalités sur Windows 2012 vous attendent !!

* Warning 3 : La majorité des clients utilisent une version 2008, 2008 R2 ou 2012 au niveau infrastructure, mais certains continuent à utiliser d’anciennes licences (Terminal Server 2000/2003). Bien que ce ne soit pas volontaire, il faut penser à mettre à jour vos licences.. vous n’êtes pas conforme !

* Warning 4 : pour tous les clients en phase de réflexion autour de Windows 2012, en particulier avec de nouvelles opportunités comme le Bring Your Own Device, Azure, etc. Il existe de nombreuses options différentes pour mettre en œuvre RDS et choisir les bonnes licences. Contactez nous pour vous guider (toutes les équipes Microsoft, partenaires, .. sont la pour cela). Une vidéo dédié aux licences 2012 est présente un peu plus bas dans ce billet un peu plus bas !

Pour ceux qui souhaitent découvrir les nouveautés de RDS 2012 en 15 Mn : Cliquer ICI. La session technique complète (1H00) : Cliquer ICI

Tout ce que vous souhaitez savoir sur le VDI, en Vidéo (Anglais), par les équipes Microsoft (boot Camp)

Vous aurez tout sur ce lien (Module1) : Cliquer ICI

En fait, il s’agit du premier chapitre d’une présentation globale et très intéressante autour du VDI, incluant en particulier un chapitre dédié aux licences. Voici les chapitres :

Mod 01: Introduction to Desktop Virtualization (Lien ci dessus)

Mod 02: Optimizing the User Experience

Mod 03: Deploying Virtual Desktops with Windows Server 2012 and RDS

Mod 04: Hyper-V for VDI

Mod 05: Capacity Planning and Architecture

Mod 06: Leveraging Citrix

Mod 07: Microsoft VDI Licensing

Information techniques, comparaison 2003/2008/2008R2 SP1

Ce document (White Paper) présente techniquement TS 2008 R2, en particulier “quoi de neuf avec le SP1”.

Même si depuis Windows 2012 est arrivé avec plein de nouveautés, ce document est intéressant en particulier car vous y trouverez un tableau comparatif entre les différentes versions (2003, 2008 et 2008 SP1), fonction par fonction. Cliquer ici.

Microsoft Management Summit

Au mois d’avril a eu lieu le MMS, dédié au “management” des infrastructures. Toutes les sessions sont en ligne : Cliquer ICI

* Pour les sessions dédiées au VDI : Cliquer ICI

Information techniques, comparaison 2003/2008/2008R2 SP1

Quelques blogs de référence :

Blog de l’équipe Windows : Cliquer ICI

Blog de l’équipe RDS : Cliquer ICI

Bonne lecture !!

Yammer and Windows Phone 8

Frédéric ESNOUF — Mon, 19 Nov 2012 07:12:09 GMT

I like yammer ! This application is very interesting and help me to save a lot of time. For each of my projects, I open a yammer GROUP, add my colleagues, and then we can collaborate in real time.

Recently Microsoft launched Windows phone 8 and of course, Yammer App is available. For me it is a Nokia 820.

Microsoft is FEDERATED with Yammer. This means that if I want to connect the web site, I am first redirected to Microsoft authentication web page where I provide my identity. Once (ADFS) authenticated, I go back to yammer and the web site authenticate me based on the ADFS token I received.

For Phone application, the Auth is a bit different.

The app ask you for your login (email) and password, but in this scenario the “password” is not the corporate one.. this is a “random” password generated by yammer when you subscribed to this application. To get this password, go on yammer web site, applications, and click the “learn more” button on the Windows Phone app. This explain how the app work, but at the bottom of this page you have a SSO instructions section, where you will see your password.

I recommend of course to make this password a bit more visible yammer guys, but once you know how to do it, .. yammer is back on the screen on your Windows Phone 8 !

More complex objects (Part 4) : Manual Sets, criteria based Sets and Sync rules

Frédéric ESNOUF — Fri, 08 Jun 2012 08:51:54 GMT

So now you are very familiar with scripting, and the logic is always the same no matter which object you want to create.

I would like now to share with you some other samples.. especially when some objects are just a bit more “complex” to script in FIM.

This example authorize “administrators” to create new activities in the portal :

This one is a bit more interesting. The goal here is to have a “SET” that contains the list of Built-in Group of AD. If you do it manually, of course you need to create a set, and then add one by one each Built-in Group. The reason I created it is that for me FIM is of course good in IAM and Advanced IAM solution, but it can also provide very good services to the infrastructure. The ability to interact with AD built-in groups (for example add Aproval and notification workflows when people enter/leave such group) is great value. But this is AD, what about Exchange, Office365, CRM.. or any kind of other product ? Having one script per Microsoft Product is very interesting, since they can load this configuration in a few seconds.

In the previous examples we have just created the objects. The logic was to create the object and set properties in the same process. In the script below we use another logic, which is pretty much create an empty object, and then, property by property, we “change” the object (mean add a new property). What is the difference? For our SET, we need to do it another way.

For the 3 first properties of our Set (ObjectType, DisplayName, Description) we could have used the previous logic. But we want here to load in a multievaluated property named “ExplicitMember” (List of groups in this SET) a long list of pointers to group objects. So we need to “code” the logic a different way.

Here is how we can achieve that job :

So now you have learned another way of coding in FIM.

This new example below is a Set, but based on a XPATH Query :

Note : I recommend to test your XPATH query first in the FIM portal, advanced view if needed. If the XPATH is for any reason bogus or not compatible with FIM, the PowerShell code will generate a “generic” error… since FIM web services will refuse the format (and you could think it is your code).

So now warm up is finished. We will see how to create a sync rule, which is a bit more challenging.

Note : After reading this part, maybe some of you will have ideas to enhance the approach. Feel free to contact me, always want to learn. What I mean here is that the below scripts work very well, but I have the feeling that we can enhance it.

So back to the reason I started to script in FIM, I wanted to set up an offer where we could automate FIM installation. Part of FIM, we have Synchronization Rules.

The methodology (we probably can enhance it) I used is to first configure FIM manually, so create my sync rules, test my configuration, tune it if need.. and then take this manual configuration as the basement to build my script.

Sync Rules are in fact a bit complex since they have many options (in, out, in/out), many properties, and also contains some complex data (the properties matching). So first let’s investigate a bit how is structured a Sync Rule in FIM via the FIM Portal (being autonomous)

Here is a screenshot of the sync rule I will use for this article. Supposed to sync users between FIM and AD :

If you go in the outbound TAB, you can see the matching, and also notice some properties marked as Initial flow only, Existence Text, .. etc. This is very important for the next part of the article !

If you go in advance view, you can see that FIM propose for the “Existence Test property” to download it as a text file. The reason is that this property contains a lot of data, and showing it in the FIM Portal would be very ugly.

The same approach is used for Initial Flow and Persistent Flow.

If you download one of these files, you understand that each “matching” in the FIM portal is in fact a line in the corresponding property, but for a reason I don’t know each matching line is separated with the next one with a line of “-“ when exported.

So now we see how this object is created in FIM.

The methodology I used to script in the context of my scenario is again to create the rule via the Portal and test it. But then, rather to hard code the value of each properties especially these complex “ExistenceTest/InitialFlow/PersistentFlow”, rather save the file on the hard disk to prevent errors (especially when properties contains stuff that could cause problem in the code such as quotes, double quotes..), and then have a “Load from file” approach in my script.

Let’s see the code now…

So first, I created 3 variables that contain the name of my 3 “flow” import files (again it facilitated the reuse of the code, copy and paste approach). I load the content of these files with the powershell Get-content command :

Then the beginning of this Sync Rule is classic, it follows the same logic has we have seen in the previous posts :

But at the end of this screenshot we want to set the “Persistent Flow” propertie.

To do this we have a basic “Loop” in the code that will parse the variable we have loaded in the beginning of the script, remove the “---“ lines and just then set the property.

At the end of this loop, we have our “new-fimImportChange” function that se the “PersistentFlow” Property.

Then we do the same with initial flow :

And with Existence Test :

Finally we create the Sync Rule object which contains all the parameters we want.

As you can see, Sync Rule is a bit more complexe since we have these “flow” properties. I have seen some other IT PROs that prefere to put the matching in their code (rather than import from text) but the main raison I did this is because it is so convenient to change something in the portal, test it.. then export the new flow in a file.. next time you use it it works without other effort (rather than changing a code). Remember ? I am not a PowerShell developer.

I hope these samples and explanations will be useful for you.

What other objects in FIM ? Being autonomous (Part 3)

Frédéric ESNOUF — Fri, 08 Jun 2012 07:03:30 GMT

One of the things I learned working in IT is that being autonomous is key. What I mean here is the ability to “discover” how to do something yourself, for example in case something is missing in the documentation.

In the previous article I showed how to script FIM with basic examples.. but what about the other objects in FIM ? In the FIM schema, you have a lot of objects, and each of these objects have a lot of properties:

So I would like now to show you how I “discovered” how to do it a few month ago.

Let’s suppose that you want to create a security group in FIM using PowerShell.. but that it is not documented (I mean no sample to download). The first thing to do is in fact to create this group the normal way, via the FIM portal. We do this in order to see what FIM Portal has created in terms of objects and properties.

Here is the example of the group I will use for this article:

All HR Group is a “manual” (not criteria based) security group. In the “Member” tab we have a few users :

.. you can see here that I have 4 people in that group.

The first approach to “learn” is to click the “advanced” view button in the portal. Then the web interface will display all the properties of that specific object. As you can see below, the interface is nice but we could have problems with the names displayed (not in fact the name of the properties). As an example, my interface is in FR and that is definitely not the name of the properties :

Second possibility is to go in the REQUESTs section of the portal, and look at the request.

But I have a better approach for you: scripting !! Look at this script :

With this script I ask FIM to export the configuration of an object where its type is a GROUP, and where the DisplayName is “All HR”. This is in fact what we call an XPATH request (sort of SQL for the IAM solution). The convert-FIMexportToPSObject will format the text displayed.

Executing this script will show us this result:

As you can see we have the exact name of the properties and of course the corresponding value. It is again very easy to use Copy and Paste and prevent mistyped variables in the script.

On this screenshot you can see some properties, such as an account name, a display name, a domain, etc. These properties are in fact the ones we need to set when we create a security group.

You can also see “ugly” things starting by “URN”. These properties are “references” (a pointer) to another object in FIM. For example, “Creator” point to a “user object” in the FIM database which is in fact the account that has created this object.

Once you have this, then you just need to create the PowerShell script based on the previous examples. You understand now how this “extract” code is important to discover how FIM works.

But let’s use another example to continue this article: Create an MPR.

Here is the extract script again (This MPR in my scenario means “Arrival of a new employee”):

You can see some new properties such as actiontype, TransitionIn… etc. A nice exercise would be to edit this MPR in the portal, and identify the corresponding properties. This helps to “link” the Portal view and the one displayed by the script.

If you look carefully, we still have those “ugly” “URN” links. Same as previous, the “MPR Object” contains pointers that are important here, for example “the Action Workflow Definition” that contains all the workflows you execute with this MPR and also others such as RerouceFinalSet.

So now that we have observed that “dump” of a working MRP, how can we script it. Here is an example :

If you observe the script correctly, you instantly understand that prior to execute it, we need to create a few other objects. Especially the “SET” that will be used as the trigger to wake up this MPR, but also the “workflows” that we want to execute in this MPR (be patient, we can also script). As we have seen in the previous dump, the SET and the WORFLOWS are not in fact a property of the MPR object. The MPR contains just pointers to these objects.

I would recommend now to play a little bit with this nice “extract” code and dump a few standard objects such as a User, a Distribution Group, a Workfow, .. etc.

You first real “FIM” script (Part 2)

Frédéric ESNOUF — Thu, 07 Jun 2012 07:39:26 GMT

As you will see very soon, the logic is the same for all type of FIM objects : attributes, bindings, MPRs, workflows, sets.. So for this article, I decided to show you what we usually do in the beginning of a project: modify the FIM schema.

Changing the schema means that for a specific object in FIM (let’s say a USER) we want to add a new property. In FIM you need to do 2 things via the Portal to reach that goal (Administrators section) : First you need to create the attribute itself (and provide properties such as name, type (text, integer), etc). Second, you need to create a “binding” that will link an object (user) with the attribute (for example a Social Security Number)..

This is very intuitive, but it takes around 3 mn to do it via FIM portal.. but what about 3 seconds with a script ?

Note : Remember, in the beginning of our script we need to load the Scripting module (check previous article for details).

Now that the fantastic functions created by Craig are loaded ready to be used… and we will use the “New-FimImportObject” function, used to create an object in FIM. Here is the code used to create the attribute:

For a second, forget about the code itself, and suppose you don’t know PowerShell (and don’t want to). Copy this code, paste it in your own script… just change the value of the variable “$Thename” with the name of the object you want to create. You remember what I said before: you should be able to create script without knowing PowerShell, just copy and paste !!

But of course you want to understand the logic.. so let’s review the code. You can even read it like a standard text: The “NEW-FimImportObject” function will create an “object where type” is “AttributeTypeDescription” (this is how FIM calls an attribute object). We will not only create object, but also “change” (modify) it since we will provide some properties to that objects.

The properties here are of course Displayname, Description .. etc.

Using variables ($Thename and $TheDescription) rather than hard coding the values in the function just make copy and paste easier.

So now congratulation, you know how to script FIM with PowerShell in order to create an attribute.

But now we need to do the binding with the “USER” object. Don’t you think you speak now FIM Scripting fluently?

So tell me now with the binding code below what is the difference with the previous code? :

You are right… all is the same except:

· We create an object where type is BindingDescription

· Variables follow the same logic

· But look at the “Bound*” variables. This way of coding says to the function that we want in fact to provide reference of an object, and we want FIM to find this object for us. So we give the criteria to search this object:

o Search an “object” where “type is AttributeTypeDescription” (the attribute that we have just created before). Because we have a lot of attributes in FIM of this type, we provide another criteria in order to have FIM to search and find the good … and this criteria is “DisplayName= $TheName”.

o The same thing appends with the next line, where we provide the second part of the binding, which is the type of object we want to link our attribute.

As you understand, when you create a binding you need to specify a property named “BoundAttributeType” which reference the new attribute created, and “BoundObjectType” which reference the object we want to add this attribute. Now “USER” has a new property !

So as you can see it is not that hard to code in FIM. Let’s see some more advanced scenarios in the next article.

The power of scripting with Forefront Identity Manger (Part 1)

Frédéric ESNOUF — Mon, 04 Jun 2012 19:38:31 GMT

Introduction

The FIM Portal is the web interface used by administrators (and users) to create all kind of configuration in Forefront Identity Manager.

FIM contains objects such as MPRs (Management Policy Rules), Sets, Workflows, email templates, etc. When you implement FIM, you need to teach FIM WHEN it is supposed to start a process, and also WHAT to do, I mean here a list of tasks to execute in order to automate from A to Z this process. As a good example “when a user arrive in the company” (the WHEN) “(Task 1) create an account in AD (Task 2) Create his mailbox on exchange (Task 3) send him a welcome email (Task 4) create a SharePoint site”, etc

All this configuration is set in FIM via the FIM portal, in the Administrator Section that you can see below

Of course, the web portal is “the” application to configure FIM, but I think it is important to know that you can also do exactly the same in command line, using PowerShell scripts.

It may sound weird/geek to you, but once you understand how it works, no matter what is your job, it may save you a lot of time.

Suppose that you are a consultant. After X FIM projects you already have identified a lot of powerful/interesting configurations in FIM that you would like to propose to your customer “by default”. Of course you could write a Word document saying “1) Create an email template 2) Create a notification workflow that use this template 3) Create an MPR that calls this workflow.. etc” and then follow the instructions each time you implement FIM at customer site. The bad side of this approach is that the job may become boring, you will spend a lot of time clicking the FIM portal, and maybe you will mistype something that will make the process to fail. At the end you lose time and potentially lower the quality.

Here comes scripting. Why don’t you spend 2 minutes to create a script that will do all this job for you in just a few seconds?

This is why you should review these articles, and as you will see it is very , and do not require strong expertise in “PowerShell”.

Introducing the “FIM PowerShell Module”

Scripting FIM in PowerShell is in fact documented for years on Microsoft Technet Web Site. You can also find a lot of “sample” scripts on the internet (search “FIM Scriptbox”. But the problem is that you need to be a PowerShell developer, and I would say a bit experimented, in order to interact correctly with FIM.

A few months ago, Craig Martin (a FIM/Scripting Specialist) decided to create functions that will make FIM/PowerShell script easier. At the same time I was leading a project to propose an implementation offer where we could do in 10 days what normally takes 50. So we started to collaborate and finally reached that goal.

These functions are regrouped in a “module” (a file with PSM1 extension) that you just need to load in your own PowerShell script. Once loaded, you can use the power of these functions.

As a feedback to you, using these functions automates now 90% of my job when I am facing a customer. I usually show the customer how to create something (for example create an MPR) manually via the portal, focus on the “transfer of expertise”, and then load all the remaining configuration (usually I build the script before the POC, based on customer RFP/RFI) via a script, in just a few seconds. Most of the time customers are impressed by this approach.

The Powershell module is available for download (FREE) on this web site: http://fimpowershellmodule.codeplex.com/. First of all, you need to download it and spend some times on this web site. Always interesting to see what the Author say about his baby.

Ready ? in the next articles I will show you how to use this module.

La protection numérique des documents : un sujet “plus” que d’actualité

Frédéric ESNOUF — Wed, 19 Oct 2011 17:30:06 GMT

Il est toujours très intéressant de voir comment une “technologie” (et non un produit) peut au fil du temps devenir moins prioritaire, puis tout à coup… en raison de l’actualité, devenir de nouveau le sujet chaud du moment.

Plus précisément, « on avait oublié » à quel point c’est fondamental, et les éléments extérieurs remettent cette discussion au-devant de la scène.

« Et si vos documents internes arrivaient ‘miraculeusement’ chez votre concurrent ? »… je préfère cette formule à «avez-vous des données importantes dans votre entreprise » qui souvent génère une hésitation dans la réponse. Que répondez-vous à cela ?

La technologie pour protéger numériquement par « droit d’usage » vos documents d’entreprise se trouve dans Windows : Le service AD Right Management Services. Elle vous permettra non seulement d’éviter les erreurs de manipulation des collaborateurs (mauvais destinataire ou re-routage de mail avec éléments privés), perte de support de stockage (clé usb, tablette, ordinateur) et vol de donnée (piratage).

D’un simple clic vous donnez à l’utilisateur la possibilité de protéger à la source ces documents (qui mieux que lui connait la valeur de cette donnée, les destinataires, …), mais également à travers des règles de gestion dans des logiciels de « partage d’informations » comme le sont Microsoft Exchange et Sharepoint.

Voici quelques liens que je trouve intéressant pour creuser ce sujet :

· En 3 mn, une vidéo qui vous montre le lien entre gestion des identités et protéction numérique des documents : http://www.youtube.com/watch?v=SexrGOslROY

· Introduction à RMS : http://www.microsoft.com/france/serveur/forefront/securite-reseau.aspx

· Et toutes les vidéos d’installation et de configuration de RMS (en anglais) : http://technet.microsoft.com/en-us/edge/video/installing-ad-rms.. Petit extrait :

o Installer AD RMS : http://technet.microsoft.com/en-us/edge/video/installing-ad-rms

o Créer ses politiques de sécurité : http://technet.microsoft.com/en-us/edge/video/creating-an-active-directory-rms-rights-policy-template

o Logging et rapports : http://technet.microsoft.com/en-us/edge/video/reports-and-logging-in-the-ad-rms-console

· FAQ technique sur AD RMS : http://social.technet.microsoft.com/wiki/contents/articles/ad-rms-faq.aspx

· Le blog de l’équipe produit : http://blogs.msdn.com/b/rms/

N’oubliez pas : AD RMS est un service de Windows qui peut « ET DOIT » protéger vos documents d’entreprise contre des erreurs de manipulation, la perte et le vol de données confidentielles.

Installer RMS est très rapide et permet donc très efficacement de protéger votre entreprise.

Votre entreprise est protégée par vous !

Shalom ‘Haver Eli

Frédéric ESNOUF — Thu, 28 Jul 2011 10:10:54 GMT

For all the good moments we had together.

Steve Ballmer support Microsoft emplyees bone marrow registration drive

video :

How DA makes you more productive and makes the IT infrastructure less expensive? Need your input !

Frédéric ESNOUF — Thu, 03 Mar 2011 08:28:06 GMT

In the last past weeks, I had several meetings with customers about remote access in general, and had the opportunity to present Direct Access. Not too much on the protocol angle but more on the vision of DA.

There are always 2 questions that are asked by the customers

* what about productivity ? especially because DA is in the Operating System and starts automatically (versus manual connection with VPN), they want to understand more the “positive” impact for the users, especially non IT ones.

* What about TCO ? this comes in the discussion when they see that implementing DA usually takes more professional services since it is an architecture not a product (work on the client side, on the gateway side (UAG), on the infrastructure side (NAP)… beyond the cost of the licenses, the cost of implementation, then on a day to day activity, is it easy, complex.. what are the tasks to execute.. is it at the end easier or more complex to administrate the “DA” infrastructure ?

Here comes the idea of this POST. Since I don’t have studies like this and that it may take “time” to gather information I ask the community to help…, just add your own comment to this blog, on these 2 approach : “Productivity for the users” and “Total Cost of Ownership”.

In order to gather all the information, .. if you could follow sort of “template”… and I will be the first to answer this POST to make it clear.

Thanks a lot for your input !.. and yes I use DA for now 2 years, and love it every day !

Problems with search on Win7 ? I love this gadget !

Frédéric ESNOUF — Sun, 27 Feb 2011 19:04:03 GMT

Sometimes, you search an email.. and you don’t find it. Outlook sais it is indexing.. but you don’t know where you are in this process.

You can download this gadget :http://gallery.live.com/liveItemDetail.aspx?li=45c441a6-edbc-454d-9262-d264728d6a3a&bt=1&pl=1

It gives you the status, you can force indexing, even put indexing at a higher level in terms of priority.

Very nice tool !!