Brian Puhl's Weblog : Technical Stuff - Other

Identity and Access Webcast Series

bpuhl — Tue, 31 Oct 2006 08:09:00 GMT

Here's some info on some upcoming webcasts... This first series is for the "Technical Decision Makers", but I'll post the "IT Pro" series when they get announced.

-Brian

--------------

Microsoft offers a broad range of technologies and products to enable a customer’s identity and access infrastructure. This web-cast and virtual lab series is designed to educate Technical Decision Makers (TDMs), and IT Professionals about Microsoft’s IDA solution areas centered around the following products:

Windows Rights Management Services (RMS)
Active Directory Federation Services (ADFS)
Microsoft Identity Integration Server MIIS)
Certificate Lifecycle Manger (CLM)
Active Directory (AD)

These webcasts are structured under different categories. The categories take attendees from Product/Solutions Overview, what the product is and how it can help the customer’s infrastructure, to Deployment, and through the different categories to, “What is New for the Future”.

Our kickoff webcast by Peter Houston, and Product/Solution Overview webcasts are for the Technical Decision Makers, while the following webcasts categories will be for IT Professionals.

Join our webcast series to help plan for the future, deploy new solutions, manage and optimize your existing IT infrastructure

As Technical Decisions Makers you should attend (a) our kickoff webcast IDA Vision and Strategy, and (b) Product Overview webcasts segment, to see how our IDA products can be improve cost, increase protection for your IT infrastructure Then encourage your IT Professionals to attend our following webcasts on deeper IT content.

We will be announcing more upcoming webcasts for IT Professionals very soon.

First IDA Webcasts:

(a) IDA Vision Webcast

Title: Microsoft Identity and Access (IDA) Vision and Strategy

Description: Identity and access in connected systems has gone beyond a technical concern and become a top business issue as organizations look to reduce security risk, decrease operational costs, satisfy regulatory requirements, and deepen their electronic relationships with customers and partners. In this session, learn about Microsoft's vision for identity and access technology, including the evolution of Active Directory (AD), Microsoft Identity Integration Server (MIIS), 'CardSpace', and Certificate Lifecycle Manager (CLM). You will also gain insight into Microsoft's vision for IDA in the future.

Presenter: Peter Houston

Date/Time: 11/10/2006, 10:00Am - 11:00PM Pacific Time

Click here to Register: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032315361&Culture=en-US

(b) Product Overview Webcasts:

Title: Information Protection with Windows Rights Management Services (RMS)

Description: Protecting confidential information and intellectual property, such as e-mail and documents, is critical to the success of many organizations…

Presenter: Tim Upton

Date/Time: 11/16/2006, 1:00 PM – 2:00PM Pacific Time

Click here to Register: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032313768&Culture=en-US

Title: Introduction to Microsoft Certificate Lifecycle Manager

Description: Join this webcast to learn about the new Microsoft Certificate Lifecycle Manager (CLM)…

Presenter: Amesh Mansukhani

Date/Time: 11/20/2006, 1:00 PM – 2:00PM Pacific Time

Click here to Register: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032313484&Culture=en-US

Title: Web Single Sign-On and Identity Federation with Active Directory Federation Services

Description: As organizations extend their information technology (IT) infrastructures to provide partners with access to Web-based applications, they face difficult administrative and security challenges…

Presenter: Howard Ting

Date/Time: 11/27/2006, 11:00 AM – 12:00PM Pacific Time

Click here to Register: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032313783&Culture=en-US

Title: Identity Life-Cycle Management with Microsoft Identity Integration Server 2003

Description: Join this webcast to see how Microsoft Identity Integration Server (MIIS) 2003 enables the automation of identity life-cycle management in the enterprise…

Presenter: Lori Craw

Date/Time: 11/29/2006, 11:00 AM – 12:00PM Pacific Time

Click here to Register: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032313486&Culture=en-US

Regards,

ADFS & DFSR Webcast

bpuhl — Thu, 15 Dec 2005 01:40:00 GMT

Did the webcast on ADFS and DFSR yesterday morning with Dustin Fraser, another one of the Systems Engineers in MS IT. You can view the webcast "on demand" at http://go.microsoft.com/fwlink/?LinkId=55997

You need to "register for the webcast" link, and then you can download it in a couple of formats.

~Brian

Time, time, everyone wants time...

bpuhl — Fri, 09 Dec 2005 07:31:00 GMT

In a previous post about managing FSMO roles, I asked a question about who remembers to configure the new server as an authoritative time source when transferring the PDC FSMO role. The reason I ask this, is because when you look at managing the FSMO roles from an operational perspective, everything is automated or dynamic EXCEPT for the time service configuration.

In MS IT, we have 6 production forests, most of which have at least 2 domains and the main forest has an empty root with 8 child domains. Time service configuration both between forests, and within the forests is critical, and operationally we have had multiple instances where a root domain PDC has ended up on a misconfigured server.

For this reason, a couple of years ago we went through and configured all root domain DC's to be authoritative time servers. This way, no matter which server you transferred the PDC to, they were always "in synch" with each other. This works well for us, because our largest root domain only has 5 DC's in it, and most only have 3 DC's. Manually configuring these servers is a "fix and forget" operation. But what would we do if we were in a single domain environment, with a couple of hundred DC's?

To answer this, I look at how we manage the PDC role in our largest child domain, Redmond. The Redmond PDC is always under the highest load of any DC in that domain, so we take some extra steps to shield it from general auth traffic. Because we know that when we're dogfooding, the PDC is also the most likely candidate to be offline for debug, we also take an extra DC and pre-configure it the same way...the net result is that we have one really busy PDC, and a not-so-busy stand-by PDC. This may be an expensive way of managing failures, but then again we don't expect anyone else to dogfood the way we do either...so for us it's worth the extra cost.

How could our Redmond PDC configuration map to the time service configuration in your single domain forest with a lot of DC's? Simple, just take some subset of your servers...and identify those as the ones which you could transfer your PDC role to if necessary. Pre-configure them as authoritative time servers, then go sit back and relax. When the call comes in the middle of the night and you need to transfer the PDC role to another box, you won't go back to bed with that itchy feeling that you forgot something...instead you'll just relax and get a good nights sleep.

(I also wanted to note that Joe called this out as well in the comments of the previous post. If you haven't checked out his FREE tools (http://joeware.net) then you're probably working too hard...)