Showing posts with label Windows Azure. Show all posts
Showing posts with label Windows Azure. Show all posts

Windows 2025 Server #OSConfig and manage Security settings

Windows 2025 server has a new feature called OSConfig that permits you to configure Microsoft"s recommended security settings.

This can be done through powershell, Windows Admin center and Azure Policy

More details and command lines could be found here:

https://techcommunity.microsoft.com/blog/itopstalkblog/using-osconfig-to-manage-windows-server-2025-security-baselines/4415824

https://4sysops.com/archives/osconfig-manage-security-settings-in-windows-server-2025-and-revert-configuration-drift/

TEAMS #new for Virtualized Desktop Infrascructure (VDI) #deadline 30/06/2024 **no longer supported on 2016**

IMPORTANT

Microsoft announced that Classic Teams for VDI will reach end of availability on June 30th, 2024.

In case your VDI farm is on Windows Server 2016 this is no longer supported, consider previous announcement you must plan VDI migration asap.

Original article

https://learn.microsoft.com/en-us/microsoftteams/new-teams-vdi-requirements-deploy

Other important blog articles:

Teams #New Virtual Desktop Infrastructure solution #MC717969 **CITRIX**365**AZURE**

Office - Microsoft 365 Apps and operative system supported roadmap

  • Windows Server 2016: October 2025
  • Windows Server 2019: October 2025
  • Windows Server 2022: October 2026

[update 2024.06.24]

about this topic there these new dealines

https://learn.microsoft.com/en-us/microsoftteams/new-teams-vdi-requirements-deploy#requirements



Teams #New Virtual Desktop Infrastructure solution #MC717969 **CITRIX**365**AZURE**

Microsoft announced that The new Virtual Desktop Infrastructure (VDI) solution for Microsoft Teams is a redesigned version of the existing VDI optimization (WebRTC based) 

This release applies to Microsoft Windows endpoints connecting to Microsoft Azure Virtual Desktops, Microsoft Windows 365, and Citrix VDI environments only.

Citrix Workspace app for Windows (2203 Long Term Service Release [LTSR], or 2302 Current Release [CR] or higher)

When this will happen:

Targeted Release: We will begin rolling out early April 2024 and expect to complete by late April 2024.

Standard Release: We will begin rolling out in late April 2024 and expect to complete by early May 2024.

This message is associated with Microsoft 365 Roadmap ID 375418

more details might be found here:


Security - Cloud Hacker considerations

I would like to focalize on Trojan aspect applied to Cloud services and relative user accounts.

Trojan could be easily installed on any pc/devices (For example visiting an unknown hackered website)

The concept it is simple: If you have a Trojan that intercept your Cloud user credential you are going to be in a very critical situation. (risk would increase if double authentication would not active on your cloud account)

Credentials could be used to stole your critical data/access to your company servers and be sold from criminals.

A very useful mitigation actions could be start using  next generation antivirus providers that utilizes machine learning indeed than standard AV (this method use  signatures as the primary detection mechanism)

Full interview and details could be found reading this article:

https://www.techrepublic.com/article/how-trojans-steal-credentials-and-attack-cloud-services/



If you are interested you could review these old blog articles/sections:

Cloud

http://www.alessandromazzanti.com/search/label/Cloud

Microsoft Azure

http://www.alessandromazzanti.com/search/label/Windows%20Azure



[update 2018.06.17]

I would like to indicate this Micorosft security video/lessons:



https://mva.microsoft.com/en-US/training-courses/hybrid-cloud-workload-protection-with-azure-security-center-18173?l=Ld0LK42jE_006218965

Security - CPU Spectre and Meltdown Bug



During previously months it was revealed CPU bugs that are affecting near all produced CPU.

Security it is one of the most warm argument that is growing, correctly, day by day importance (First of all due to global internet devices interconnection).

At actual stage several vendors and O.S. providers released O.S. patches.
Some of these fixes was deployed to mitigate risks.

Consider that one of these bug (Spectre ) need devices firmware upgrade.
In other cases antivirus software upgrade it is necessary before patch/firmware installation.

So I am going to create a blog article with info collected reading several technical documents/articles (indicated at end of article for easily reading)

My idea it is to release minor revisions article updates, during next months, adding fresher information.

  1. Intel CPU produced during these last 10 years are affected from security critical issues.
  2. On these CPUs Intel left an open channel between kernel protected memory and normal user processes.
  3. This design error could permit, to access this memory area, to programs executed at user level permissions, (Java scripts browser app too), permitting sensible data read/stolen (including login and passwords).
  4. It seems that Intel was already aware about this problem but did not notify this information to major O.S. players to strictly work to fix it.
  5. ServerWorkstationPCTabletSmartphone and Smart Devices are impacted. 
    1. Affected chips include those manufactured by IntelAMD, and ARM, which means all devices running Windows operating systems are potentially vulnerable (e.g., desktops, laptops, cloud servers, and smartphones).
    2. Devices running other operating systems such as AndroidChromeiOS, and MacOS are also affected.
  6. CLOUD is impacted too. 
    1. Meltdown could be particularly dangerous on unpatched cloud platforms, due to the possibility of malicious code inside a virtual machine being able to read data from the memory of the underlying host computer, with the threat that one cloud customer could steal data from another.
    2. CPU performances decrease would be between 5% up to 30%. (these performances problems would be a big issue for cloud providers like Azure, Amazon....)
  7. REMARK: 
    1. Hotfix need to have kernel code partially rewritten:
      1. Furthermore kernel and end user memory process separation (Kernel Page Table Isolation (KPTI)) would deeply impact on performances too.
    2. Some old CPUs could not be upgradable.
    3. Patches released are working so deep at kernel level that some AV are not compatible (a.e. Microsoft if informing customers that before begin patching process, you should verify that your antivirus (AV) software is up to date and compatible (check your antivirus software manufacturer's website for their latest compatibility information).

MICROSOFT :
Starting in January 2018, Microsoft released updates for Windows operating systems, Internet Explorer and Edge browsers to help mitigate these vulnerabilities and help to protect customers. They also released updates to secure their cloud services.
Here they are  Microsoft Articles:
Protect your Windows devices against Spectre and Meltdown
https://support.microsoft.com/en-us/help/4073757/protect-your-windows-devices-against-spectre-meltdown
Update to disable mitigation against Spectre, Variant 2
https://support.microsoft.com/en-us/help/4078130/update-to-disable-mitigation-against-spectre-variant-2

From Microsoft January 2018 Security Updates

Operative SystemUpdate KB
Windows Server, version 1709 (Server Core Installation)4056892
Windows Server 20164056890
Windows Server 2012 R24056898
Windows Server 2012not yet available
Windows Server 2008 R24056897
Windows Server 2008not yet available
Windows 104058702
Windows 8.14056898
Windows 74056897

NOTES

Patches released are working so deep at kernel level that some AV are not compatible (a.e. Microsoft if informing customers that before begin patching process, you should verify that your antivirus (AV) software is up to date and compatible (check your antivirus software manufacturer's website for their latest compatibility information)
LINUX has released patches.

APPLE Has indicated that all iPhones, iPads and modern Mac devices are affected by Meltdown. Bullettin link.

ANDROID/GOOGLE bullettin link.
TECHNICAL PART:
  1. This bug has two variant types:
    1. Meltdown (32/64 bit - It permit to read private kernel memory):
    2. It impact all Intel CPUs produced from 1995 to 2013 -Haswell Xeon series included.
    3. CPU ARM Cortex A15, A57 A72 e A75 impacted
    4. REMARK:Patches was released to fix Meltdown and Spectre 1 variant bugs for o.s. and virtual machine vendors.
    5. You can learn more about these vulnerabilities at Google Project Zero
  2. Spectre (32/64 bit - It permit to user-mode applications to estract processess information) 
    1.  It impact all Intel CPUs produced till now.
    2.  It impact some ARM CPUs Cortex A15, A17, A57 A72, A73, A75, R7, R8, A7, A8.
    3.  It impact some AMD CPUs Ryzel, FX ed Pro.
    4. REMARK: Fixes about bug Spectre variant 2 require computer firmware update.These updates are being issued by chip manufacturers and designers such as Intel and Arm. Sometimes  it may require also operating system kernel update.
    5. REMARK 2: Because of the difficulty in addressing Spectre, patches generally mitigate risks from attacks, rather than blocking them completely.
    6. You can learn more about these vulnerabilities at Google Project Zero.

  3. Modern processors accelerate the rate at which they execute instructions by loading data into the processor's on-board cache memory ahead of when it's needed. Data can be retrieved from this on-board cache far more rapidly than from the computer's main memory.

  4. If a processor is executing a set of instructions that branches depending on the input, then processors will try to guess which branch of instructions is most likely to be executed and load the necessary data into the processor's cache. These processes, called Branch Prediction and Speculative Execution, are what can be exploited by Spectre attacks.
  5. Meltdown works slightly differently, taking advantage of a privilege escalation flaw that allows any user able to execute code on the system to access protected memory. 

[original articles]

https://www.achab.it//achab.cfm/it/blog/achablog/meltdown-e-spectre-cosa-deve-sapere-e-fare-un-msp


http://www.lastampa.it/2018/01/09/tecnologia/news/lultima-patch-di-sicurezza-windows-non-fa-pi-avviare-i-computer-amd-microsoft-sospende-gli-aggiornamenti-44j9a7tUG3GsQ1m1T6vxjO/pagina.html


https://www.techrepublic.com/article/spectre-and-meltdown-cheat-sheet/


https://meltdownattack.com/#faq-advisoryhttps://meltdownattack.com/#faq-advisory


https://support.microsoft.com/en-us/help/4073757/protect-your-windows-devices-against-spectre-meltdown


Protect your Windows devices against Spectre and Meltdown

https://support.microsoft.com/en-us/help/4073757/protect-your-windows-devices-against-spectre-meltdown
    Update to disable mitigation against Spectre, Variant 2
    https://support.microsoft.com/en-us/help/4078130/update-to-disable-mitigation-against-spectre-variant-2


    You can learn more about these vulnerabilities at Google Project Zero.


    [update 2018.02.17]

    Oracle is impacted too, I forgot to mention previously

    Oracle Linux (ELSA Security Advisory):

    [update 2018.02.19 ]

    Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems

    https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/

    [update 2018.03.04]

    Microsoft has published guidance for IT Pros that outlines the steps Microsoft has taken as well as steps you can take to take advantage of all available protections.

    One action that you can take immediately is to ensure that your computers are able to reach the following endpoint:

    http://adl.windows.com



    This may involve adding this URL to your company’s whitelist which may require approval from your security group.  This endpoint is used to communicate updates to Microsoft’s compatibility information with client computers.  By ensuring your computers can reach this endpoint, you can help them get the most up-to-date information Microsoft has available about supported antivirus solutions and versions, security update statuses, etc.

    more details here

    Server - How to Execute RSAT snapins with different users without server/client logon necessity

    If you need to launch some mmc snapins with different AD account (without logging on server/pc with that credentials) you could follow these steps:


    1. Execute command prompt start --> cmd.exe
    2. Copy and paste this command text:
      C:\Windows\System32\runas.exe /netonly /user:aduser@domain.suffix "mmc %SystemRoot%\system32\xxxx_command.msc
    3. where command.msc is any command with .msc.
      Usually any .msc command that is included in your RSAT tool (win 7, Win 10)  installed on your pc 

    You can review these blog articles too:


    Scripting - Tutti i comandi .cpl, .msc ed altri dal menu start --> Esegui


    2012 Server – RSAT anche in 2008 R2 SP1 e 2008 SP2


    Scripting - Lista di comandi di start --> Esegui di Microsoft Windows

    DigitalOcean Cloud Alternative

    I would like to highlight this Cloud service that is particularly good and with nice prices.

    An interesting alternative to Azure and any other Cloud services.

    https://www.digitalocean.com/

    Consider that:

    1. All plans are standard with solid state drives (SSD)
    2. a flexible API, and the ability to select the nearest data center location
    3. About any question and pricing here is FAQ Link https://www.digitalocean.com/help/

    Intune - Migration from XP to Windows 8.1

    [Original Article http://blogs.technet.com/b/italy/archive/2013/10/15/upgrade-di-windows-xp-pro-windows-8-1-enterprise-con-windows-intune.aspx]

    Windows Intune is Microsoft's cloud solution for the management of all Growtyp of devices: Windows PC , Surface, Windows Phone , iOS devices , Android devices can be managed from a single console and a single product.
     
    scenarioWindows Intune offers :

    [Original Article http://blogs.technet.com/b/italy/archive/2013/10/15/upgrade-di-windows-xp-pro-windows-8-1-enterprise-con-windows-intune.aspx]     


    Portal Access Windows Intune to manage all the devices listed above : software distribution, hardware and software inventory , policies , notices and monitoring , publishing apps for mobile devices, remote assistance, etc.

    - System Center Configuration Manager 2012, integrated with Windows Intune to obtain a single management console
    -
    20 GB of space for application deployment
    - PC Endpoint Protection , the anti-virus software from Microsoft- Upgrade to Windows Enterprise and future versions : this means that you have the right to upgrade your fleet Windows XP Pro to Windows Enterprise subsequent versions up to Windows 8.1. The update of the old Windows XP can be configured and managed directly by Operating System Deployment , System Center Configuration Manager features 2012 included in the offer


        
    Right to purchase the Microsoft Desktop Optimization Package ( MDOP ) . MDOP , for those not familiar , is a suite of technologies that help an IT administrator to improve compatibility and management, reduce support costs , improve resource management and policy control in your environment. For more information, visit http://technet.microsoft.com/it-it/windows/bb899442.aspxconclusionWith this offer you update all your Windows XP machines while preserving the existing data with the help of all the tools needed upgrade of the operating system , but not only included in the offer for each user you manage paid up to five devices associated with it. To deepen your knowledge about Windows Intune go to the product page .To familiarize yourself with Windows Intune , you can activate a free 30-day subscription to the link.





    [Articolo originale http://blogs.technet.com/b/italy/archive/2013/10/15/upgrade-di-windows-xp-pro-windows-8-1-enterprise-con-windows-intune.aspx]

    Windows Intune è la soluzione cloud di Microsoft per la gestione di tutti i itipi di devices: Windows PC, Surface, Windows Phone, IOS devices, Android devices potranno essere gestiti da una unica console e con un unico prodotto.

    Scenario

    Windows Intune offre:
    1. Accesso al portale Windows Intune per la gestione di tutti i devices sopra elencati: distribuzione del software, Hardware e Software Inventory, policies, avvisi e monitoraggio, pubblicazione apps per dispositivi mobile, assistenza remota, etc
    2. System Center Configuration Manager 2012, integrabile con Windows Intune a ottenere una unica Console di gestione
    3. 20 GB di spazio per la distribuzione delle applicazioni
    4. PC Endpoint Protection, il software anti-virus di Microsoft
    5. Aggiornamento a Windows Enterprise e alle versioni future: questo vuol dire che avrete il diritto di aggiornare il vostro parco macchine Windows XP Pro a versioni Windows Enterprise successive fino a Windows 8.1. L’aggiornamento dei vecchi Windows XP potrà essere configurato e gestito direttamente da Operating System Deployment, funzionalità di System Center Configuration Manager 2012 incluso nell’offerta
    6. Diritto di acquistare Microsoft Desktop Optimization Package (MDOP). MDOP, per chi non lo conoscesse, è una suite di tecnologie che aiutano un amministratore IT a migliorare la compatibilità e la gestione, ridurre i costi del supporto tecnico, migliorare la gestione delle risorse e il controllo dei criteri nel proprio ambiente. Per ulteriori informazioni consultare il sito

    Conclusione

    Grazie a questa offerta aggiorni tutte le tue macchine Windows XP preservando i dati esistenti con l’aiuto di tutti gli strumenti necessari all’upgrade del sistema operativo, ma non solo: compreso nell’offerta gestirai per ogni utente pagato fino a cinque devices associati ad esso. Per approfondire le tue conoscenze su Windows Intune vai alla pagina di prodotto.
    Per familiarizzare con Windows Intune è possibile attivare una sottoscrizione gratuita per 30 giorni al link.

    Microsoft - Microsoft Assessment and Planning (MAP) Toolkit

    If you need inventory your organization License and Software installation you'll find this tool very useful and complete.

    I used it for a corporate who need to inventory all its Microsoft licenses.

    "The Microsoft Assessment and Planning (MAP) Toolkit is an agentless inventory, assessment, and reporting tool that can securely assess IT environments for various platform migrations—including Windows 8, Windows 7, Office 2013, Office 2010, Office 365, Windows Server 2012 and Windows 2008 R2, SQL Server 2012, Hyper-V, Microsoft Private Cloud Fast Track, and Windows Azure."


    Microsoft Assessment and Planning (MAP) Toolkit 9.0 is now available for download!
    Download MAP 9.0:
    downloadDownload now!
    Or visit the MAP Download Center page for more information including install instructions and system requirements.
    Learn more about the business scenarios that MAP supports:

    Learn more technical information about MAP in the TechNet Library.

    Manuals - Free Ebook from Microsoft Press

    Free Microsoft Press E-book

    http://www.microsoftvirtualacademy.com/ebooks#?fbid=SlmUJbkV6yo

    New ebooks
    Introducing Microsoft System Center 2012 R2
    Introducing Microsoft System Center 2012 R2
    Mitch Tulloch with Symon Perriman and the System Center team
    January 2014
    180 pages
    Get a high-level overview of System Center 2012 R2—and get a running start transforming your datacenter and cloud-optimizing your business. This guide introduces core features and functionality, with technical advice and under-the-hood insights from a Microsoft MVP and members of the System Center team at Microsoft.
    Download the PDF (12.4 MB)
    Windows Server ebooks
    Introducing Windows Server 2012 R2
    Introducing Windows Server 2012 R2
    Mitch Tulloch
    November 2013
    242 pages
    Get a head start evaluating Windows Server 2012 R2—with technical insights from a Microsoft MVP and members of the Windows Server product team. Based on final Windows Server 2012 R2 release-to-manufacturing (RTM) software, this guide introduces new features and capabilities, with scenario-based advice on how the platform can meet the needs of your business. Get the high-level overview you need to begin preparing your deployment now.
    Download the PDF (8.0 MB)
    Windows Azure ebooks
    Introducing Windows Azure for IT Professionals
    Mitch Tulloch with the Windows Azure Team
    October 2013
    142 pages
    Get a high-level overview of Windows Azure—and get a running start with this flexible cloud platform. Designed for IT professionals, this guide introduces core features and functionality, with technical insights and advice from a Microsoft MVP and members of the Windows Azure team. Topics include Windows Azure solutions, Compute services, Network services, Data services, and App services.
    Download the PDF (8.0 MB)
    Rethinking Enterprise Storage: A Hybrid Cloud Model
    Marc Farley
    July 2013
    120 pages
    Discover how a hybrid cloud model—combining cloud storage services with traditional on-premise storage—can solve multiple storage challenges cost-effectively, all under a single data management system. Focusing on the Microsoft hybrid cloud storage solution, this book offers concise insights on technical, strategic, and practical considerations—so you can begin evaluating potential benefits to your organization.
    Download the PDF (3.0 MB)
    Windows ebooks
    Introducing Windows 8.1 for IT Professionals
    Ed Bott
    October 2013
    140 pages
    Get a head start evaluating Windows 8.1—with early technical insights from award-winning journalist and Windows expert Ed Bott. This guide introduces new features and capabilities, providing a practical, high-level overview for IT professionals ready to begin deployment planning now.
    Download the PDF (8.0 MB)
    App Development ebooks
    Programming Windows Store Apps with HTML, CSS, and JavaScript, Second Edition (Second Preview)
    Kraig Brockschmidt
    October 2013
    750 pages
    Microsoft Press is pleased to offer the second preview of Kraig Brockschmidt’s in-depth ebook on writing Windows Store apps using HTML, CSS3, and JavaScript on the Windows 8.1 platform.

    We’ll be publishing the final ebook (with 20 chapters and 4 appendices) in March/April in PDF, EPUB, and Mobi for Kindle formats. In the meantime, enjoy this preview!
    Download the PDF (16.40 MB)
    .NET Technology Guide for Business Applications
    Cesar de la Torre and David Carmona
    November 2013
    This guide will help you select the right Microsoft development technologies and approaches for your custom .NET application development, depending on the priorities you have for your application and business domain. It is targeted to decision makers, software architects, development leads, and developers who are involved in selecting which technologies to use for their applications and projects, and specifically covers custom enterprise application development, although independent software vendors (ISVs) might also find the information and recommendations useful.
    Download the PDF (6.0 MB)
    Microsoft System Center ebooks
    Introducing Microsoft System Center 2012 R2
    Mitch Tulloch with Symon Perriman and the System Center team
    January 2014
    180 pages
    Get a high-level overview of System Center 2012 R2—and get a running start transforming your datacenter and cloud-optimizing your business. This guide introduces core features and functionality, with technical advice and under-the-hood insights from a Microsoft MVP and members of the System Center team at Microsoft.
    Download the PDF (12.4 MB)
    Microsoft System Center: Designing Orchestrator Runbooks
    David Ziembicki, Aaron Cushner, Andreas Rynes and series editor Mitch Tulloch
    September 2013
    186 pages
    Part of a series of specialized guides on System Center—this book delivers a focused drilldown on designing Orchestrator runbooks for workflow management solutions. Written by experts on the System Center team and with Microsoft MVP Mitch Tulloch as series editor, these titles provide concise technical guidance as they step you through key design concepts, criteria, and tasks.
    Download the PDF (8.8 MB)
    Microsoft System Center: Configuration Manager Field Experience
    Rushi Faldu, Manish Raval, Brandon Linton, Kaushal Pandey and series editor Mitch Tulloch
    September 2013
    92 pages
    Part of a series of specialized guides on System Center—this book delivers a focused drilldown on using Configuration Manager for queries and custom reporting, with scenario-based guidance for deployment success. Written by experts on the Microsoft System Center team and with Microsoft MVP Mitch Tulloch as series editor, this title provides concise, from-the-field guidance as you step through key concepts and tasks.
    Download the PDF (4.5 MB)
    Microsoft System Center: Cloud Management with App Controller
    Yung Chou, Keith Mayer, and series editor Mitch Tulloch
    November 2013
    118 pages
    Part of a series of specialized guides on System Center—this book focuses on core tasks for App Controller to implement and manage hybrid cloud solutions. Written by experts on the Microsoft System Center team and with Microsoft MVP Mitch Tulloch as series editor, this title delivers concise technical guidance as you step through key concepts, processes, and tasks.
    Download the PDF (14.8 MB)
    Microsoft System Center: Troubleshooting Configuration Manager
    Rushi Faldu, Manoj Kumar Pal, Andre Della Monica, Kaushal Pandey, and series editor Mitch Tulloch
    November 2013
    108 pages
    Part of a series of specialized guides on System Center—this book addresses the most common pain points for Configuration Manager administrators, providing insider and from-the-field insights to help you succeed. Written by experts on the Microsoft System Center team and with Microsoft MVP Mitch Tulloch as series editor, this title delivers concise technical guidance as you step through key concepts and tasks.
    Download the PDF (6.4 MB)
    Microsoft System Center: Optimizing Service Manager
    Thomas Ellermann, Kathleen Wilson, Karsten Nielsen, John Clark, and series editor Mitch Tulloch
    December 2013
    96 pages
    Part of a series of specialized guides on System Center—this book provides a framework for planning and delivering a successful Service Manager project. Written by experts on the Microsoft System Center team and with Microsoft MVP Mitch Tulloch as series editor, this title delivers concise guidance, from-the-field insights, and best practices for optimizing and maintaining your Service Manager environment.
    Download the PDF (3.2 MB)