Active Directory - Fine-Grained Password Policy

So I have been doing quite a bit of consulting lately and thought I would document some of the more interesting tasks that I run across.  In the last couple of weeks I have dealt with software deployments through GPO and KACE boxes.  Exchange Troubleshooting, VMware Performance troubleshooting, and several other things. 

Got the opportunity to finally implement Fine-Grained password policies.  For those of you that don't know what that is, by default using an AD domain you set one password policy at the domain level and everyone inherits that.  So what if you want to set different policies on different OUs?  No big deal create a couple of GPOs with the policies that you want and apply them to the correct OUs - WRONG!!! That doesn't work.  You can't set password policies on an OU.  You have to set up what they call Fine-Grained Password Policies. 

I found a pretty good TechNet article that pointed me in the right direction.  The problem with a lot of Microsoft's direction is that they point you in the right direction and you are in Los Angeles and want to go to NYC and they say go East.  Now it is on you to figure out how to get there.  This article was exactly that way.  It left out lots of switches and several other things to make sure it was working correctly.

https://technet.microsoft.com/en-us/library/cc754461(v=ws.10).aspx

As I have started to delve more and more back into the Microsoft world I have really come to empower PowerShell quite a bit more than ever.  It started with Exchange where I did a complete migration from Exchange 2010 to Exchange 2013 via PowerShell from Setup to migration to tear down.  Maybe I was bored, maybe I was trying to be cool (As much as computer dorks can be cool).

So I accomplished a lot of this task using PowerShell.  The concept is pretty Easy.  You have to create what is called a PSO (Password Setting Object).  You create this by using the New-ADFineGrainedPasswordPolicy cmdlet.  You then have to specify things like MaxPasswordAge, MinPasswordAge, and a few other parameters.  Not all that hard. 

Once you create the PSO you can view it using ADSI Edit under the Password Settings Container.  You can also modify settings from here if needed.  Once you have gotten this far, it still doesn't work.  Now, you have to assign who is going to have this policy applied to them. 

You would think that you can apply this to an OU, but you would be wrong.  You have to create a Domain Security Group and then grant that group permissions to the PSO.  Now you would think just go to properties and the security tab add it in and you are done.  You are wrong.  You have to go to ADSI Edit, go to that Password Settings Container and locate the PSO you just created.  Click Properties and then click the Attribute Editor tab.  Look for the msDS-PsoAppliesTo attribute.  You then enter the full DN (Distinguished Name) of the Global Security Group.

After that add users to the Group and you are good.

So how do you test.  Well I picked a user (the wrong user) and added him to the group, we then did a bunch of restarts and nothing.  So I found out after some prodding that he changed his password last week but didn't think that would count.  So I checked his expiration date.  It showed a really long number.  Now I had no clue what that number meant.  It showed a regular date in the viewing box but when you tried to modify it (which you couldn't) it showed this long number. 

So what does that long number mean out of curiosity I looked it up.  This attribute is Integer8, a large 64-bit number that represents a date as the number of 100-nanosecond intervals since 12:00 AM January 1, 1601.  1601???  Wow, not quite sure why that number but OK.

Anyway I found a user whose password expired about 2 months ago (He had the password never expires on him, which I had to deselect to see this value).  I added him to the group and did a restart and he had to change his password.  It worked like it should.  So for those of you that want to accomplish this, it isn't really difficult, just play around in a test network like your customers production machines and play around.

Exchange 2013 Ultimate Bootcamp

We are excited to announce the arrival of a new class from VMTraining. Although this now means more work for me. The class has taken many months in the design and implementation to get the class ready.  We did our first delivery last week and it was a success. We only did a limited run to 10 students while the course was in beta.

The premise for the course is the following. How to properly run Exchange 2013 while running in a VMware environment.

For those that don't know me I don't teach much any more, I primarily do consulting. I have been an Exchange consultant and Trainer for almost 18 years now. I have done Exchange migrations and/or implementations for some of the largest companies in the world to include SanDisk, PepsiCo Bottling Ventures, Yahoo, Smith & Nephew, American Kennel Club, BB&T Bank, Capital Broadcasting Company, and many more.

The idea for this class came when I was talking with one of my Exchange trainer friends.  We were talking about how most of the implementations are being rolled out on VMware and we were talking about some of the configurations that must be done to make it work correctly.  Needless to say he was unaware of any of these changes.  So here is a guy who has trained hundreds if not thousands of Exchange students and 85% of them are running on VMware however they have no clue how to truly configure it.

It made me wonder. Why are people taking classes using Microsoft Official Curriculum (MOC) and it is built on top of Hyper V when their environments are running on VMware?  The answer. There are no other options out there. When you are taking a MOC class it is the same whether you take it from Global Knowledge, or New Horizons or any other school.  Your sole basis of buying the class is based upon price. Schools will argue how much experience and how great their trainers are, but ask them what they have done.  As someone told me before trainers train, they don't consult. 

So here were numerous issues that we have addressed with our class.

1. We built our Exchange 2013 class on VMware vSphere 5.5.  We talk about how to configure storage, SANs, virtual and physical networking, backups, deployments, antivirus, and much more in a VMWare environment.
2. Our class is being taught with real world consultants.  So we are actually doing this not just talking about it.  I finished the first class on Friday and Monday I have a meeting with a customer to actually upgrade their Exchange 2010 servers to Exchange 2013.
3. Labs.  I believe that a student learns by doing, so we currently have 38 labs in our class, compared to 11 in the MS 20341 Core Solutions of Exchange class.  By the next class we will have at least 45 and my goal is over 50 high quality labs on live real equipment not on some desktop.
4. Lab Access.  Our labs are available to you 24 x 7 during class.  However, we have tons of labs and you might want to go through them more than once to reinforce learning new concepts.  We make our lab environment available to you after class so that you can continue to work on labs.  Also when new labs become available we let you have access to these.  Your learning doesn't stop on the last day of class.
5. Third party tools integration. We also talk about integration with products like Symantec Enterprise Vault (ask some of those trainers if they even know what that is without googling it).  We talk about complex backups using various scenarios and backup software like Commvault, Netbackup, Veeam, and many others.  How do you want to handle things if you are running a SAN like Netapp.  How are you going to manager SNAP drive, SNAP Mirror, Flexclones, and much more.   Is that darn BES thing still around?  How do you implement that with Exchange?  How about if I want to implement Mimecast?

Someone asked me a question.  "I am not running Exchange on VMware, so I guess this class isn't for me"  Absolutely not!!!  yes, we built this class with an emphasis of running it on VMware but we also talk about Hyper V and Physical.  So if you want the best Exchange class in the world we believe we have that.  If you want the ONLY class running and teaching on VMware we are that.

Another question I got was "I found an Exchange class from new Horizons for $2200 and that is cheaper than yours."  My response.  "Shop around I guarantee you that you could get it for under $2000."  We aren't competing against them on price, because we don't have an equivalent product.  The same way a Ferrari doesn't compete with a Ford Pinto. 

So you have to ask yourself if you are in the market for a class, do you want to settle for a mediocre class from a MS training center or pay a tad bit extra to get all of these benefits.

I hope to see you in a future class.

Top 10 vSphere 5.5 Improvements

Attending VMworld this year was very exciting, the release of their NSX product for true virtualization of the network was amongst its biggest announcements. I am looking forward to see this product in action, I believe we will see some very sold security mitigation techniques stem from this deployment, not to mention the ease of network implementation! We will discuss this in more detail in a future blog. Today we are going to look at the top 10 improvements in the upcoming release of vSphere 5.5, here they are:

1. vSphere Web Client Improvements
Why did I choose this for our #1? With the push to the web Client from VMware many of us were dealing with a slow interface that decreased our ability to get work done! I do not know about you but I really do not want to spend even an extra 15 minutes a day at work just because I am waiting! This new interface is fast in comparison and I do not feel like I am waiting, which was not the case in previous versions. This new web client has some additional filtering and navigation features and had the ability to manage the new 64TB VMDK (Yes it is really only 62TB).
2. Single Sign On (SSO) Improvements
The new release of SSO is easier to understand and use, I think you will actually like it now! It still provides a great resource for multiple authentication sources! Surprisingly it provides upgrading from 5.0 to 5.5!
3. vApp HA Additions
 vSphere 5.5 can now monitor applications you have running inside the VM! No need for a 3rd party tool now. I like the idea and in testing it works well, I am not 100% convinced yet but I will try this with clients on non-critical systems until I am confident in the results.
4. vSAN is now available
Software Defined Storage is one of the new hot topics and VMware is attempting to lead the pack, however there are other hardware vendors that have a similar implementation that has worked well. However I like where they are headed, I will need a lot more testing before I am ready to use this in any production environment but there are some details. This feature is enabled on the host and will provide redundant, supported storage across a maximum of 8 hosts. VMware states the primary use cases will be VDI, test/dev, big data, and a disaster recovery target. vSAN functionality will be sold as a standalone offering. The vSAN beta is in public beta and available at vSANbeta.com.
5. Flash Read Cache Solution Added
As expected server-side, host-based caching was a hot topic this year and VMware how their own solution. It requires local SSD on every host that has this feature enabled and support vMotion, HA, DRS and other features of vSphere. The virtual machines and applications are not aware of the Flash Read Cache similar to other implementations of features in vSphere like Transparent Page Sharing. This solution will provide a nice performance boost with read intensive solutions like VDI.
6. vCenter Multi-Hypervisor Manager (MHM)
Surprise, Surprise, vSphere now supports managing a Windows 2012 Hyper-V host! I did not see this one coming, however it does makes sense. With the improvement of the latest version of Hyper-V there are many companies wondering what they should do for the future. With this latest release VMware is at least making it possible for the users to continue working in their well known and loved vCenter. You can even perform a cold migration from Hyper-V to vSphere!
7. vCSA improvements
VMware has stated on many occasions that they are likely to dump the windows version of vCenter, personally I think this will be a huge mistake, but before that can even happen they must prove to the world that the vCenter Server Appliance is going to be a viable option. One that is easy and error free! The latest release allows us to manage 500 hosts and 5000 virtual machines with the embedded database! Yes you read that correctly, the embedded database can handle 500 hosts and 5000 virtual machines! Ready to give it a whirl? No need for a costly sql or oracle server, just download the applicane, run through the basic setup and you are ready. Another key item of note with the vCSA is that there is a new vSphere Update Manager plugin for the vSphere Web Client!
8. vSphere replication improvements
VMware continues to improve its replication solution, the current improvements to the per-VM replication include compatibility with Storage vMotion and Storage DRS along with the ability to have multiple point in time recovery options. You can now have up to 10 appliances per vCenter server which allows for more freedom in your design and lowers the overall cost of vCenter purchases. Site Recovery Manager is updated to support these features as well.
9. vCenter Orchestrator Additions
VMware views Orchestrator as a key component moving forward in the migration to the cloud and they have improved its scalability and availability to allow for that planned migration. It also added features which include a workflow debugger, health check, and auto-alerts
10. vCloud Director New Features
VMware has already announced that vCloud Director 5.5 will be the last release, choosing to migrate to vCloud Automation Center (vCAC) instead. But that did not stop them from improving upon the functionality of this release. It is now sold as part of the vCloud Suite. So what have they done? Added many features related to the vApp lifecycle management such as Open Virtualization Format (OVF) import and export, the option to add or modify virtual hardware that was created from a template, and the ability to clone a VM while preserving its memory state. There are many more but that will have to come in a later blog.