Kurt Shintaku's Blog

We are very excited to announce an upcoming opportunity to ‘Ask Microsoft Anything’ (AMA) about Windows 10 management!

The AMA will take place on Tuesday, July 25th, 2017 from 9:00 AM to 10:00 AM Pacific Time in the Windows 10 management space.

If you aren’t familiar with the concept, an AMA is a live online question-and-answer event similar to a "YamJam" on Yammer or an "Ask Me Anything" on Reddit. The Windows 10 security AMA will give you the opportunity to connect with members of the Windows engineering and product teams, who will be on hand to answer your questions and listen to feedback about:

• Modern management scenarios: traditional, hybrid, and cloud-based
• Managing Windows devices with System Center Configuration Manager
• Managing Windows devices with Microsoft Intune
• Azure Active Directory
• Group Policy
• Microsoft Store for Business and application management

Don’t miss this opportunity. Add the event to your calendar. We hope to see you there!

• EVENT: “Windows 10 Management” – Ask Microsoft Anything (AMA) – July 25th, 9:00AM-10:00AM
  https://techcommunity.microsoft.com/t5/Windows-10-Management/bd-p/Windows10Management

This is worth installing… just in case you need it.  It’s a plugin for Microsoft Edge called “Translator”.

With Translator for Microsoft Edge, you can translate foreign language webpages and text selections for 50+ languages.

• Look for the Microsoft Translator icon in the address bar when visiting a foreign-language webpage.
• Click on the icon to instantly translate the webpage to your preferred language. You can also select text you want to translate and right-click to get in-line translations.

For a full list of supported languages, please visit https://www.microsoft.com/translator/languages.aspx.

If the extension does not work after install, please restart Microsoft Edge. If the extension still is not working, please provide feedback through the Feedback Hub.

• DOWNLOAD: Translator for Microsoft Edge
  https://www.microsoft.com/store/apps/9nblggh4n4n3

Get ready for a new way to deploy Windows 10, coming with the Fall Creators Update release.

Learn how to easily set up new PCs with a standard, corporate Windows image using Windows AutoPilot.

Windows AutoPilot, a suite of capabilities powered by cloud-based services, is designed to simplify deployment and management of new Windows 10 PC’s along with enhancements to Mobile Device Management and new Device Health features in Windows Analytics.

BACKGROUND:
Traditionally, IT Pros spend a lot of time on building and customizing images that will later be deployed to devices with a perfectly good OS already installed on them.

Windows AutoPilot introduces a new approach:

• From the users’ perspective, it only takes a few simple operations to make their device ready to use.
• From the IT Pros’ perspective, the only interaction required from the end-user, is to connect to a network and to verify their credentials. Everything past that is automated.

Windows AutoPilot allows you to:

• Automatically join devices to Azure Active Directory
• Auto-enroll devices into MDM services, such as Intune (Requires an Azure AD Premium subscription)
• Restrict the Administrator account creation
• Create and auto-assign devices to configuration groups based on the devices’ profile
• Customize OOBE content specific to the organization

In the video below, Principal PM Manager for Windows Enterprise and Security, Sidd Mantri, offers an overview of Windows Autopilot, a new cloud service from Microsoft that provides you with a zero-touch experience for deploying new Windows 10 devices to your organization. Sidd illustrates how you and hardware vendor can use Windows AutoPilot, to enable your users to easily setup new Windows 10 devices, and demonstrates the user’s set-up experience.

For more information on Windows Autopilot, visit the announcement page and the product page:

• NEWS: Delivering the Modern IT promise with Windows 10 https://blogs.windows.com/business/2017/06/29/delivering-modern-promise-windows-10/#HA24037BDwQKgXJv.97 
• DOCS: Overview of Windows AutoPilot http://aka.ms/WindowsAutoPilot

We’ve published a very exhaustive guide to tuning Windows Server 2016 that is available both online as well as a downloadable PDF.

When you run a server system in your organization, you might have business needs not met using default server settings. For example, you might need the lowest possible energy consumption, or the lowest possible latency, or the maximum possible throughput on your server. This guide provides a set of guidelines that you can use to tune the server settings in Windows Server 2016 and obtain incremental performance or energy efficiency gains, especially when the nature of the workload varies little over time.+

It is important that your tuning changes consider the hardware, the workload, the power budgets, and the performance goals of your server. This guide describes each setting and its potential effect to help you make an informed decision about its relevance to your system, workload, performance, and energy usage goals.

This guide organizes performance and tuning guidance for Windows Server 2016 across three tuning categories:

• Performance tuning guidelines for Windows Server 2016
• Server Hardware Tuning
• Performance considerations
• Power considerations
• Server Role Tuning
• Active Directory Server
• File Server
• Hyper-V Server
• Windows Server Containers
• Remote Desktop Services
• Web Server
• Server Subsystem Tuning
• Cache and memory tuning
• Network subsystem tuning
• Software Defined Networking (SDN) tuning
• Storage subsystem tuning
• PowerShell tuning
• Script authoring considerations
• Module authoring considerations
• Additional tuning resources

WARNING: Generating a downloadable version of this guide will produce a 200pg document.

• DOWNLOAD: Performance Tuning Guidelines for Windows Server 2016
  https://blogs.technet.microsoft.com/windowsserver/2017/04/26/performance-tuning-guidelines-for-windows-server-2016/

This user guide covers subscribing and activating Microsoft services for first-time users and for existing users.

It provides details on using the Microsoft Volume Licensing Service Center (VLSC) to reserve seats or add new services, view existing services, and change people’s roles.

The guide concludes with troubleshooting tips and where to get support for your services.

Table of Contents:

• Who is this guide for?
• Introduction
• If you are subscribing to Microsoft services for the first time
• If you are already using some Microsoft services
• Reserve seats of add new services in the VLSC
• Change a role in the VLSC
• Assign seats and manage your services
• Troubleshooting tips
• Get help and support for your services
• More information

Download the paper here:

• WHITEPAPER: VLSC User Guide to Online Services (2.3MB, 31pgs)
  https://www.microsoft.com/en-us/download/details.aspx?id=55185

UPDATE 6/29/17:
Guidance from support below updated with more recent content.

—-

ORIGINAL POST 6/28/17:
The recent outbreak known commonly as the Petya Ransomware, has been addressed by Microsoft in several areas.

MICROSOFT MALWARE PROTECTION CENTER: PETYA RANSOMWARE ANALYSIS
The Microsoft Malware Protection Center (MMPC) wrote a really exhaustive article on the new Petya Ransomware on their blog.

The post covers:

• Delivery and installation
• Multiple lateral movement techniques
• Lateral movement using credential theft and impersonation
• Lateral movement using EternalBlue and EternalRomance
• Encryption
• Detection and investigation with Windows Defender Advanced Threat Protection
• Protection against this new ransomware attack
• Resources
• Indicators of Compromise

If you’re interested in background on the malware, this is really good post to read:

• BLOG: New ransomware, old techniques: Petya adds worm capabilities
  https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

MICROSOFT SECURITY RESPONSE CENTER: UPDATE ON PETYA MALWARE
The Microsoft Security Response Center has written a post to address Petya, based on their own investigation.

The MSRC talks about it’s origins, initial targets, what previous security patch addresses the vulnerability it leverages, and general guidance around the malware – including protection technologies to leverage in the future.

• BLOG: Update on Petya malware attacks
  https://blogs.technet.microsoft.com/msrc/2017/06/28/update-on-petya-malware-attacks/

ENTERPRISE CUSTOMER GUIDANCE
The following was disseminated to our customers with Premier Support contracts.

Background
Microsoft’s antivirus software detects and protects against this ransomware. Our initial analysis found that the ransomware uses multiple techniques to spread, including ones which were addressed by a security update (MS17-010) previously provided for all platforms from Windows XP to Windows 10. We are continuing to investigate, and our support teams are fully mobilized and engaged globally to help any impacted customers.

Windows Defender, System Center Endpoint Protection, and Forefront Endpoint Protection detect this threat family as Ransom:Win32/Petya. Ensure you have a definition version equal to or later than:

• Threat definition version: 1.247.197.0
• Version created on: 12:04:25 PM : Tuesday, June 27 2017 (Pacific Time)
• Last Update: 12:04:25 PM : Tuesday, June 27 2017 (Pacific Time)

In addition, the free Microsoft Safety Scanner http://www.microsoft.com/security/scanner/ is designed to detect this threat as well as many others. If you use a solution from an antivirus provider other than Microsoft, please check with that company.

New guidance from the MMPC Blog
On Tuesday June 27, 2017, the Microsoft Malware Protection Center (MMPC) released a detailed analysis of the Petya Ransomware attack in a new blog post:

• Microsoft Malware Protection Center Blog:
  ​New ransomware, old techniques: Petya adds worm capabilities

This MMPC blog provides the most cogent and detailed analysis available on how the malware works and guidance for network administrators and security professionals concerning how to mitigate against specific attack methods.

New guidance from the MSRC Blog
On Wednesday June 28, 2017, the Microsoft Security Response Center (MSRC) released a new blog post to provide additional insights and guidance customers can use to improve protections in the enterprise:

• Microsoft Security Response Center Blog:
  ​Update on Petya Malware Attacks

Recommendations from the MSRC blog include:

• If for some reason you cannot apply the update, a possible workaround to reduce the attack surface is to disable SMBv1 with the steps documented at Microsoft Knowledge Base Article 2696547.
• Consider implementing techniques like network segmentation and least privileged accounts that will further limit the impact of these types of malware attacks.
• For those using Windows 10, leverage capabilities like Device Guard to lock down devices and allow only trusted applications, effectively preventing malware from running.
• Finally, consider leveraging Windows Defender Advanced Threat Protection, which automatically detects behaviors used by this new ransomware.

New guidance from the Azure Security Center Blog
On Wednesday June 28, 2017, the Microsoft Azure Security Center released a new blog discussing ​measures that Azure customers can take to prevent and detect Petya malware through Azure Security Center:

• Azure Security Center​ Blog:​ 
  Petya ransomware prevention & detection in Azure Security Center​​

Recommendations
In addition to the recommendations we included in our previous alert on Tuesday, we strongly recommend reviewing the information provided in these blogs for specific steps you can take to mitigate against Petya Ransomware.

Additional Resources

• Microsoft Security Bulletin: MS17-010 – Security Update for Microsoft Windows SMB Server (4013389)
• KB2696547 – How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server
• Whitepaper: Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, v1 and v2
• Windows Defender Advanced Threat Protection
• Windows IT Center: Device Guard Deployment Guide for Windows 10 and Windows Server 2016
• The Microsoft Security Tech Center: https://technet.microsoft.com/en-us/security/default
• The Microsoft Security Update Guide: http://aka.ms/securityupdateguide

Regarding Information Consistency
We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Microsoft’s security content posted to the web is occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in Microsoft’s web-based security content, the information in Microsoft’s web-based security content is authoritative

UPDATE 3/23/2020:
Here’s some details on retention of data post expiration of an Office 365 subscription:
https://docs.microsoft.com/en-us/office365/Enterprise/office-365-data-retention-deletion-and-destruction-overview 

ORIGINAL POST JUNE 17, 2017:
When a subscription to Office 365 expires, as an IT Professional, it’s important to understand what the implications are, i.e. what’s going to happen after the subscription lapses?

The information I’m highlighting below is written documentation / material that is publically available online & accessible as a reference for yourself & for your organization.

Note: This is simply the information I’ve collected from Microsoft online sources.  It may not be complete & may not represent all scenarios.

“ONLINE SERVICES TERMS” DOCUMENTATION ON OFFICE 365 EXPIRATION
The Online Services Terms is a reference similar to the old “Product Use Rights”, except it’s for cloud services.  It’s a monthly updated Word document that you can download (see below) and contains the latest terms of service.  (Think of stuff like “SLAs”, “Usage rights”, “Microsoft’s obligations”, “customer obligations”, etc.)

• Online Services Terms
  https://www.microsoft.com/en-us/Licensing/product-licensing/products.aspx

Regarding the expiration of an Office 365 subscription, according to the Online Services Terms, there are 3 bullets that standout to me around the expiration/termination of an Office 365 subscription:

• Page 4: Data Retention
  “Microsoft will retain Customer Data stored in the Online Service in a limited function account for 90 days after expiration or termination of Customer’s subscription so that Customer may extract the data. After the 90-day retention period ends, Microsoft will disable Customer’s account and delete the Customer Data.”
• Page 10: Privacy
  “No more than 180 days after expiration or termination of Customer’s use of an Online Service, Microsoft will disable the account and delete Customer Data from the account.”
• Page 14: Data Retention after Expiration or Termination
  “The expiration or termination of Customer’s Online Service subscription will not change Customer’s obligation to pay for hosting of Customer Data during any Extended Term.”

STATES OF OFFICE 365 ACCESS POST EXPIRATION
From the Office support web site, there is an article that describes the states that a tenant goes through once an Office 365 subscription expires.

• SUPPORT: “What happens to my data and access when my Office 365 for business subscription ends?”
  
  If your Office 365 subscription ends—either because it expires, or because you decide to cancel—your access to Office 365 services, applications, and customer data go through multiple states before the subscription is fully turned off, or deprovisioned. If you are aware of this progression, you’ll be better equipped to return your subscription to an active state before it’s too late, or—if you’re leaving Office 365—back up your data before it is ultimately deleted.
  …
  https://support.office.com/en-us/article/What-happens-to-my-data-and-access-when-my-Office-365-for-business-subscription-ends-4436582f-211a-45ec-b72e-33647f97d8a3?ui=en-US&rs=en-US&ad=US

OFFICE APPLICATION REDUCED FUNCTIONALITY MODE & EXPIRATION NOTICE
According to the Office support site, deployed Office applications will be affected as well, as described below:

• A subscription notice appears when I open an Office 365 application
  “After your subscription expires, Office will run in reduced functionality mode and will show Unlicensed Product notifications. You’ll still be able to open and print your documents but you won’t be able to edit them or to create new ones. You can reactivate your subscription at any time to get back to full functionality.”
  https://support.office.com/en-us/article/A-subscription-notice-appears-when-I-open-an-Office-365-application-4CABE32C-F594-4C0E-9191-3D3ADE10CCEB

If you’re interested in learning Power BI, the following should be helpful.

WEBINARS
The following webinars can help you to understand and use Power BI. To watch the webinars, click the link to register or watch.

• Power BI visualization best practices
• Power BI Best Practices from the Power BI Operations Team
• Deep dive on PowerApps formulas
• Data Visualization Design Discussion Lab
• Unleash the Power of Power BI – tips and tricks
• …

View the entire list here:

• Power BI Webinars list
  https://powerbi.microsoft.com/en-us/documentation/powerbi-webinars/

WHITEPAPERS
Whitepapers allow you to explore Power BI topics at a deeper level. Here you can find a list of available whitepapers for Power BI.

• Microsoft Power BI Premium
• Planning a Power BI Enterprise Deployment
• Plan capacity for embedded analytics with Power BI Premium
• Best design practices for reports and visuals
• Advanced Analytics with Power BI
• Bidirectional filtering
• DirectQuery in SQL Server 2016 Analysis Services
• Governance
• Security
• Securing the Tabular BI Semantic Model
• …

View the entire list here:

• Power BI Whitepapers list
  https://powerbi.microsoft.com/en-us/documentation/powerbi-whitepapers/

The future isn’t random. It’s the result of the choices that we make now. We’ll be talking about technologies and industries that will define the next decade and beyond.

Join our host Cristina Quinn, a science and technology reporter, as she dives into everything from Minecraft to cyber warfare. You can wait for the future to happen to you or engage with it right now and ahead of the curve on .future— a branded podcast from Microsoft, produced in partnership with Gimlet Creative.

• SUBSCRIPTIONS:
• RSS for Podcast subscriptions: http://feeds.gimletcreative.com/dotfuture
• Apple Podcasts:
  https://itunes.apple.com/us/podcast/id1250638446?mt=2
• Google Play Music:
  https://play.google.com/music/listen#/ps/Il3w36mtcjcqg3s5dy4uirlsdly
• WEBSITE: .future – A new series from Microsoft & Gimlet Creative about making the future happen
  http://creative.gimletmedia.com/shows/future/

On Oct 31, 2017, RPC over HTTP will be deprecated in Exchange Online in favor of MAPI over HTTP, a modern protocol that was launched in May 2014.

This change affects you if you’re running Outlook 2007 because it won’t work with MAPI over HTTP. (The successor protocol to RPC over HTTP)

It also affects Outlook 2016, Outlook 2013, and Outlook 2010 users who aren’t running updated versions of the products that may still leverage RPC over HTTP instead of the current MAPI over HTTP standard.

Why MAPI over HTTP?
MAPI over HTTP provides the following benefits:

1. Provides faster connection times to Exchange
2. Improves the connection resiliency when the network drops packets in transit
3. Enables more secure login scenarios like Multi-factor authentication for Office 365
4. Provides the extensibility foundation for 3^rd party identity providers
5. Removes the complexity of RPC over HTTP’s dependency on the legacy RPC technology

How do we address the sunsetting of RPC over HTTP?
To continue email connectivity:

• Outlook 2007 customers will have to update to a newer version of Outlook or use Outlook on the web.
• Outlook 2016, Outlook 2013, and Outlook 2010 users must make sure that the latest cumulative update for the version of Office installed is applied.

Microsoft recommends customers keep their users updated to the most recent product update, as several MAPI over HTTP bugs have been fixed between since December 2015. Office 365 customers should review this how-to article which outlines the steps necessary to upgrade users to the latest version of Office.

Additionally, customers may need to ensure their Outlook clients are not using a registry key to block MAPI over HTTP. Details about this registry key can be found in this KB article on our support site.

Lastly, customers should ensure that they do not have any Outlook add-ins or 3^rd party apps that rely on the RPC over HTTP protocol to connect to Office 365 data.

How can I confirm a client is enabled for MAPI over HTTP?
By default, when a mailbox is created in or migrated to Exchange Online, it is enabled for MAPI. You can confirm/verify that your mailboxes are enabled for MAPI connections using the following command from a Remote EXO PowerShell session to your tenant:

• Get-CasMailbox <mailbox> | fl *Mapi*
  (https://technet.microsoft.com/en-us/library/bb124497(v=exchg.150).aspx.)

This might come in handy if you find someone is connecting via RPC/HTTP instead of MAPI/HTTP.

Another way to check is to look at Outlook’s Connection status (for older versions of Outlook): How to Check Outlook’s connection status – Connecting RPC will show RPC/HTTP in the Protocol column, Connecting MAPI/HTTP will show HTTP in the Protocol column.

Does this deprecation affect Outlook for Mac, iOS, Android, Windows 10 Mobile or the web?
No. This only applies to Outlook for Windows.

Does this deprecation in Office 365 affect customers using Exchange on-premises (Exchange 2007-2016)?
No. Customers using RPC over HTTP to connect Outlook and Exchange on-premises can continue to do so. This only affects mailboxes in Exchange Online.

For official information about what steps to take, or for a greater explanation of why this is happening, go to:

• INFO: RPC over HTTP deprecated in Office 365 on October 31, 2017
  https://support.microsoft.com/en-au/help/3201590/rpc-over-http-deprecated-in-office-365-on-october-31,-2017