Reviewing this week being at the Ignite conference I can say I was there because of the presentations Mark Wahl (http://goo.gl/yY0unq) has given about Identity Management. Here the highlights:
- Microsoft Identity Manager 2016 is still coming mid-year 2015 (actually the technical preview from April is saying 2015, but all new server apps are 2016 versions)
- Privileged Access Management (PAM, don't be confused with the Unix PAM - Pluggable Authentication Module) is integrated
- MS will not provide management agents for MIM for all SaaS applications as they provide that as functionality in Azure AD
- Cloud password reset will be supported only through the new Azure AD connect tool (you can think about it as Dirsync with more features) not through the FIM or MIM Azure AD management agent
- MIM certificate management works completed without ActiveX controls. The new Internet Edge web browser in Windows 10 - aka Spartan web browser - will cut the support for ActiveX controls anyway
- time-limited groups managed by MIM
- in-place upgrade from FIM 2010 to MIM 2016 is supported (no major changes e.g. no API changes)
Your are welcome to see the presentations on Channel9:
http://ignite.microsoft.com/session/sessionmoreinfo/?topicid=518ea07c-58a2-e411-b87f-00155d5066d7
http://ignite.microsoft.com/session/sessionmoreinfo/?topicid=f859bbd9-8ab0-e411-b87f-00155d5066d7
Showing posts with label AD. Show all posts
Showing posts with label AD. Show all posts
Friday, May 8, 2015
Monday, May 4, 2015
Microsoft Ignite - Identity and Access Management Everywhere
On my first day the most important session was BRK3863 - Identity and Access Management Everywhere.
The video on Channel9 is not yet available, but it might will when you read this. So check out http://channel9.msdn.com/Events/Ignite/2015/BRK3863
Here in short the highlights:
- Dynamic groups for app access - Yuppie, finally. E.g. groups for managers get automatically updated if someone works now for that manager or not any longer; or anyone in sales based on the user description field
The video on Channel9 is not yet available, but it might will when you read this. So check out http://channel9.msdn.com/Events/Ignite/2015/BRK3863
Here in short the highlights:
- Dynamic groups for app access - Yuppie, finally. E.g. groups for managers get automatically updated if someone works now for that manager or not any longer; or anyone in sales based on the user description field
- Group of people have access to a application with a
single user, e.g. Twitter Enterprise account, and with password rollover only Azure AD internally knows the password, not an admin
- Azure AD detects and tracks inconsistent access patterns, e.g.g log on s from the US and China at the same time. (Note: They will catch me a lot because I am accessing the system for several reasons from different places on the planet through proxies or VPN connections all the time)
- End user and social identity identities can be added
to Azure AD soon
- Workday is the first HR cloud app allowing user to
be added in Azure AD
- Approval for app access requests
- Adding B2B capabilities soon
- Windows 10 Workspace AD Join will work directly with Azure AD, that gives you now options of enrolling machines for your workforce
You might know that you can access thousands SaaS applications through Azure AD and all is configured in Azure AD and not on a onpremise federation server. Azure AD can also provision user accounts in SaaS applications, so that minimizes the lead time for connecting a SaaS application to your Azure or onpremise Active Directory.
Thursday, April 30, 2015
AD finduser project
Hi there.
I was just working on a project where we had to find user information by searching for SMTP address, or username, or GUID.
So instead of adding a paramter for everything I thought the script can find out itself if I have provided an SMTP address or an GUID. And if you work with Office 365/Azure AD you might have already received notifications about certain user accounts from MS and they provide the GUID, or here called Immutable, in a different format.
So the outcome of my thinking and lazyeness providing parameters all the time can now be found on CodePlex (https://adfinduser.codeplex.com/).
Examples:
finduser.ps1 userA
finduser.ps1 user.A@domain.com
finduser.ps1 5Gz/Z7McHEWGzHdUTs5Kuw==
finduser.ps1 67ff6ce4-1cb3-451c-86cc-77544ece4abb
finduser.ps1 "{67ff6ce4-1cb3-451c-86cc-77544ece4abb}"
The script can work with remote Active Directories as well as with AD LDS servers, just see the 2 lines you have to activate or to deactivate.
Feel free to use it and to adapt. You can also add some more error handling if you like.
I was just working on a project where we had to find user information by searching for SMTP address, or username, or GUID.
So instead of adding a paramter for everything I thought the script can find out itself if I have provided an SMTP address or an GUID. And if you work with Office 365/Azure AD you might have already received notifications about certain user accounts from MS and they provide the GUID, or here called Immutable, in a different format.
So the outcome of my thinking and lazyeness providing parameters all the time can now be found on CodePlex (https://adfinduser.codeplex.com/).
Examples:
finduser.ps1 userA
finduser.ps1 user.A@domain.com
finduser.ps1 5Gz/Z7McHEWGzHdUTs5Kuw==
finduser.ps1 67ff6ce4-1cb3-451c-86cc-77544ece4abb
finduser.ps1 "{67ff6ce4-1cb3-451c-86cc-77544ece4abb}"
The script can work with remote Active Directories as well as with AD LDS servers, just see the 2 lines you have to activate or to deactivate.
Feel free to use it and to adapt. You can also add some more error handling if you like.
Tuesday, December 17, 2013
Network Discovery for Dummies
As a consultant I work several client projects over the year and sometimes I do not get a good/meaningful documentation before I start. Some environments are even so restricted that I cannot install tools or that I have to survive with a regular user account until I get clearance for a domain admin account.
So I checked out what built-in tools I could use on a Windows machine to do a basic discovery of the IT eco system.
1. Either I can connect my laptop or I get a machine fro the client and so I can run a command prompt and see the IP configuration with ipconfig.
2. Run ipconfig again with the /all parameter and find out the primary DNS suffix (what is most likely the DNS name of AD), here in this example it is frontoso.co
nslookup -querytype=SRV _ldap._tcp.dc._msdcs.frontoso.com
Nslookup should give you a list of all domaincontrollers of frontoso.com
3. Now I want see what other machines areound me in the same subnet.
The FOR /L command will fire up a ping command for each IP address in the range (10.0.1.1 - 10.0.1.250). Depending on the subnet this can be adjusted. We use it only to get the mac addresses in from the arp cache and if you scan more then the subnet range you will not get more hits from the arp cache.
so run FOR /L %v IN (1,1,250) DO start ping -n 1 10.0.1.%v from the command line
and then arp -a to see all entries from the arp cache
Example
Interface: 172.16.32.15 --- 0xa
Internet Address Physical Address Type
172.16.32.1 54-75-d0-e2-c5-42 dynamic
172.16.32.8 00-15-5d-20-08-35 dynamic
172.16.32.9 00-14-5e-45-6e-25 dynamic
172.16.32.10 68-ef-bd-93-82-04 dynamic
172.16.32.11 00-15-5d-20-0e-32 dynamic
.....
So event ping was not working because ICMP is disabled on the target machine the arp cache entry exist.
The mac address tells you also the vendor of the network card, so sometime this helps, e.g. in the example above all 00-15-... machines are virtual machines on Microsoft Hyper-V.
4. If you want the server names use ping -a to ask DNS for a reverse DNS resolution. Server names can tell a lot, e.g about location and purpose depending on the naming convention.
FOR /L %v IN (1,1,250) DO ping -a -n 1 10.0.1.%v > pinga.txt
5. If you just want check that you can access a SMB share through a firewall you can use
net use \\IPorServername\ipc$
even you do not have permissions to access the share, then you get an access denied message. But this tells you also that the firewall is mot likely not preventing SMB traffice to that machine.
Hope that helps,
Lutz
So I checked out what built-in tools I could use on a Windows machine to do a basic discovery of the IT eco system.
1. Either I can connect my laptop or I get a machine fro the client and so I can run a command prompt and see the IP configuration with ipconfig.
2. Run ipconfig again with the /all parameter and find out the primary DNS suffix (what is most likely the DNS name of AD), here in this example it is frontoso.co
nslookup -querytype=SRV _ldap._tcp.dc._msdcs.frontoso.com
Nslookup should give you a list of all domaincontrollers of frontoso.com
3. Now I want see what other machines areound me in the same subnet.
The FOR /L command will fire up a ping command for each IP address in the range (10.0.1.1 - 10.0.1.250). Depending on the subnet this can be adjusted. We use it only to get the mac addresses in from the arp cache and if you scan more then the subnet range you will not get more hits from the arp cache.
so run FOR /L %v IN (1,1,250) DO start ping -n 1 10.0.1.%v from the command line
and then arp -a to see all entries from the arp cache
Example
Interface: 172.16.32.15 --- 0xa
Internet Address Physical Address Type
172.16.32.1 54-75-d0-e2-c5-42 dynamic
172.16.32.8 00-15-5d-20-08-35 dynamic
172.16.32.9 00-14-5e-45-6e-25 dynamic
172.16.32.10 68-ef-bd-93-82-04 dynamic
172.16.32.11 00-15-5d-20-0e-32 dynamic
.....
So event ping was not working because ICMP is disabled on the target machine the arp cache entry exist.
The mac address tells you also the vendor of the network card, so sometime this helps, e.g. in the example above all 00-15-... machines are virtual machines on Microsoft Hyper-V.
4. If you want the server names use ping -a to ask DNS for a reverse DNS resolution. Server names can tell a lot, e.g about location and purpose depending on the naming convention.
FOR /L %v IN (1,1,250) DO ping -a -n 1 10.0.1.%v > pinga.txt
5. If you just want check that you can access a SMB share through a firewall you can use
net use \\IPorServername\ipc$
even you do not have permissions to access the share, then you get an access denied message. But this tells you also that the firewall is mot likely not preventing SMB traffice to that machine.
Hope that helps,
Lutz
Subscribe to:
Posts (Atom)