About James

I am an Infrastructure Systems Administrator in the Infrastructure Systems Group (ISG) within ISS. We are responsible for a number of the core services which support the IT Infrastructure of the University including Active Directory, Exchange, DNS, Central Filestore, VMware and SQL. I hold number of current Microsoft Certifications and am also a Symantec Certified Specialist (Netbackup) http://twitter.com/JamesAPocock

The Importance of Protecting AD Objects against accidental deletion

I’ve recently had to go through the process of restoring a series of OU objects which is not at all fun even with the AD Recycle Bin feature that came along with Windows Server 2008 R2.

It’s easy to make mistakes though but most can be averted with the ‘Protect Object from Accidental Deletion’ flag. In order to toggle this value in the ADUC console select View > Advanced Features.

Once selected the object tab is available which allows you to toggle the object.

Any OUs in the University Active Directory that have been created using the Server 2008/Vista or later AD tools will have the value set by default. Other objects such as users and computers do not get the value automatically.

If you would like to set the property on all OUs or all Objects in given OU then you can run the following commands using the Quest AD Commandlets with appropriate rights:

For OUs only

get-qadobject -sizelimit 0 -type OrganizationalUnit -SearchRoot "OU=MyOU,OU=Departments,DC=campus,DC=ncl,DC=ac,DC=uk" | Add-QADPermission -Deny -Account Everyone -ApplyTo ThisObjectOnly -Rights DeleteTree,Delete

For Computers Only

get-qadobject -sizelimit 0 -type OrganizationalUnit -SearchRoot "OU=MyOU,OU=Departments,DC=campus,DC=ncl,DC=ac,DC=uk" | Add-QADPermission -Deny -Account Everyone -ApplyTo ThisObjectOnly -Rights DeleteTree,Delete

For Everything

get-qadobject -sizelimit 0 -SearchRoot "OU=MyOU,OU=Departments,DC=campus,DC=ncl,DC=ac,DC=uk" | Add-QADPermission -Deny -Account Everyone -ApplyTo ThisObjectOnly -Rights DeleteTree,Delete

REMEMBER TO TEST YOUR SCRIPT FIRST!

Share an Internet connection and turn a Windows 7 or 8 PC in to a Wireless Hotspot (even on a VPN)!

I recently needed to connect my phone to a wireless network and the only connectivity available was a wired VPN on my notebook. It turns out that in Windows 7 and Windows 8 it is possible to turn a wireless enabled machine into a hotspot that any device can use!

Instructions

1) Run an elevated command prompt (Right Click > Run as administrator) and run the command:

netsh wlan set hostednetwork mode=allow ssid=<networkname> key=<password>

Where  <networkname> is your choice of name for your Hotspot and <password>is a strong secure password.

For example

netsh wlan set hostednetwork mode=allow ssid="James WiFi" key="G0dBl3ssTheIntern3t"

2) This will create a connection called ‘Wireless Network Connection 2’ which is a Microsoft Virtual WiFi miniport adapter. Rename the connection as ‘Wifi Hotspot’

3) Browse to the properties of the adapter and uncheck all of the options apart from Internet Protocol Version 4 (TCP/IPv4)

4) Browse to the properties of the Internet connected adapter or VPN connection and select the sharing tab. Tick the first box as below and select Wifi Hotspot as the Home n.

5) Create a shortcut on the Desktop called ‘Start WiFi Hotspot. This will let you switch on the hotspot on without having to type the commands. In the location box type:

netsh wlan start hostednetwork

6) Create another shortcut on the Desktop called ‘Stop WiFi Hotspot. This will let you switch off the hotspot on without having to type the commands. In the location box type:

 netsh wlan stop hostednetwork

7) Note: The shortcuts must be run as an Administrator (Right Click > Run as administrator)

8) And that’s it! You should now be able to connect to your hotspot and use the internet wit other wireless enabled devices such as your Phone, Console or other laptops

To remove the settings run the command below and do change the WiFi Hotspot name or password just run the first command again with the new details.

netsh wlan set hostednetwork mode=disallow ssid=<networkname> key=<password>

Restoring permissions on an AD objects to Domain/Enterprise Administrators

I recently accidently set added Authenticated Users = Deny Read on GPO object. As ‘Deny’  ACEs take priority over ‘Allow’ everyone was blocked including Domain and Enterprise Administrators!

After some research, trial and error we found that the following procedure can be used to restore permissions back to Domain Administrators.

  1. Log on the PDC emulator as Domain Admin.
  2. Get the DN of the problem object(s)
  3. Run an elevated command prompt
  4. Run dsacls <dn> /R “DOMAIN\Domain Admins”
  5. Run dsacls <dn> /G “DOMAIN\Domain Admins”:GA
  6. Locate the system object in the AD. GPOs are in the System Container.
  7. Restore permissions for the object.
  8. Check the  object’s folder within SYSVOL and verify the permissions are up to date. If not then restore the permissions here too (I actually did this between 5  and 6 but according to Internet sources step 7 will do this).

Our Journey to the Cloud (Office 365): Part 2 – Technical Overview

This post outlines the technical steps on the road to implementing our Federated Office 365 with SSO and Exchange Hybrid Deployment. Each of these steps will be expanded upon in subsequent posts.

About Our Environment

Active Directory

Our Active Directory Forest consists of three Domains. An ‘empty’ Forest Root Domain fangorn.ncl.ac.uk (this was best practice when the Forest was created), a resource domain ‘campus.ncl.ac.uk’ which contains all objects used to manage the campus in Newcastle UK. There is also a third domain which is used to manage computer objects at our campus in Malaysia. For the purposes of deploying Office 365 we can ignore this last domain.

Our DNS namespace .ncl.ac.uk runs on a UNIX BIND system and domain controllers for the zones mentioned above have delegated authority for these subdomains. The Forest and all domains are running at Server 2008 R2 Functional level.

Mail

We run a mixture of Exchange 2007 SP2 and Exchange 2010 SP2 and are in the midst of migrating our staff and postgraduate research students to Exchange 2010.  Exchange 2007 remains on SP2 due to an incompatibility with a third-party archiving solution.  All Exchange servers are separated by role (CAS, HUB and MBX) and generally multiple instances for site-based resilience.  The Exchange Client Access infrastructure is fronted by a hardware load balancer.

Office 365 Tenancy Configuration

Configuring the Office 365 tenancy involved running the Office 365 deployment readiness tool and contacting Microsoft in order to have the tenancy located in the appropriate location relative to the number of users (size of the organisation). Another important step at this stage is proof of ‘ownership’.

Active Directory Federation Services Configuration

Federation of the Active Directory means that users can access services in Microsoft Office 365 using the existing Active Directory credentials (user name and password). Just as importantly this means we can use our existing User lifecycle, provision and access configuration tools to manage users using both cloud and on premises services.

The setup of Identity Federation and single sign-on (SSO) for Office 365 requires Active Directory Federation Services (AD FS).

Directory Synchronisation Configuration

The Microsoft Online Services Directory Synchronisation Tool (DirSync) establishes a one way synchronization from the on-premise Active Directory Forest (all domains) to Microsoft Online.

Dirsync is a requirement for running an Exchange Hybrid Deployment and allows global address list (GAL) synchronization from the on premises Microsoft Exchange Server environment to Microsoft Exchange Online.

Exchange Hybrid Deployment Configuration

An Exchange Hybrid Deployment refers to the full-featured deployment of a cross-premises Exchange messaging solution with Office 365 for enterprises and Exchange Online.

The features that an Exchange Hybrid Deployment delivers are:

  • Mail routing between on-premises and cloud-based organisations
  • Mail routing with a shared domain namespace. For example, both on-premises and cloud-based organisations use the University’s standard @newcastle.ac.uk SMTP domain.
  • A unified global address list, also called a “shared address book”
  • Free/busy and calendar sharing between on-premises and cloud-based organisations
  • Centralised control of mail flow. The on-premises organisation can control mail flow for the on-premises and cloud-based organisations.
  • A single Outlook Web App URL for both the on-premises and cloud-based organisations
  • The ability to move existing on-premises mailboxes to the cloud-based organisation
  • Centralised mailbox management using the on-premises Exchange Management Console (EMC)
  • Message tracking, MailTips, and multi-mailbox search between on-premises and cloud-based organisations

Implementation

The team responsible for the implementation of Office 365 is the ISS Infrastructure Systems Group with our very own John Donaldson managing the project. A steering group with student representation provides strategic direction and sign-off.

Our broad testing and implementation strategy are the creation of two test environments followed by production.

POC Environment: A simple proof of concept comprising of a single domain with the minimal infrastructure required for to test the concepts of Federated Office 365 with SSO and Exchange Hybrid Deployment.

Full Test Environment: A fully virtualised environment which mimics (as closely as possible) our production environment. This environment will be maintained in tandem with the production environment and any future changes will be tested here first.

Office 365/ADFS 2.0: Forms AND Integrated Authentication (SSO) based on the user agent string

Background

The ADFS Farm + ADFS Proxy Farm model that we are using for Office 365 requires that the CNAME of the ADFS service has to be the same for both the ADFS proxy server farm and the internal ADFS farm (in our case adfs.ncl.ac.uk). Users ‘inside’ our network need to be directed to the internal farm and external users to the proxy farm.

ADFS supports multiple authentication mechanisms including the ones we are interested in, Windows Integrated Authentication (WIA) and Forms Based Authentication (FBA). It seems however that there is no way to dynamically select which one is used when a request hits the farm based on client properties. Where Office 365 is concerned a farm uses WIA or FBA

The way our network is configured means that we do not have the network model of Internal/DMZ/Internet with the split-brain DNS that the Microsoft documentation seems to expect. Our systems point at a single zone (running on BIND) which is resolves both internal and external requests.  As such, private IP addresses such as that of the internal ADFS Farm can be resolved (but obviously not connected to) from the Internet.

Working with our Network team we were able to get around this by creating a work around in BIND so that anyone on the Internet receives the address of the proxy farm and anyone coming from one of our internal IP ranges receives the address of the ADFS farm.

The problem for us is that only around 70% of our internal clients are domain joined and as such able to take part in SSO using WIA. The other devices may be non-Windows machines, non-domain joined Windows machines and mobile devices. Because they are coming from one of our internal address ranges they are directed to the internal WIA enabled ADFS farm and get a non-user friendly ugly pop-up box requesting authentication.

Authentication Popup

We do not think that this is a good user experience so we sought a solution which would let us provide both authentication methods to internal clients.

Possible solutions

After discussions internally and with Microsoft we were presented with 3 possible ways to deal with this problem.

  1. Our Network team could define every IP range we have and point them at the relevant BIND DNS view. This is obviously an inelegant solution and would not cover all scenarios as many ranges in our environment contain both domain joined and non-domain joined clients. It would however work for wireless guests as they are on specific ranges.
  2.  Microsoft proposed pushing out a HOSTS file to all domain joined clients pointing them at the internal farm. This not a scalable or suitable option in our environment as we have development work going on all over the University and this would essentially remove people’s ability to use the HOSTS file due to it being overwritten by whatever mechanism we would put in place to the job
  3. The third option was suggested by a Microsoft representative on the Office 365 community forums. The ADFS Farm could be configured to read a custom attribute from the browsers User agent string.This value would be parsed server-side and if present the request would be authenticated by WIA. Other requests would be forwarded on to FBA.  This was particularly attractive to us as we already use a custom user agent string value for Shibboleth authentication.

What we lacked was the expertise to implement this solution but thanks to collaboration with our colleagues as well as working with members of the Microsoft TechNet community we were able to implement something that seems to do the job for us. We thought we would share this in the event others are running in to the same problem!

Out of the Box Authentication with ADFS 2.0

The mechanism that is used by default on an ADFS farm or proxy Farm can be toggled in the <localAuthenticationTypes> element of the ADFS web.config

<microsoft.identityServer.web>
 <localAuthenticationTypes>
 <add name="Forms" page="FormsSignIn.aspx" />
 <add name="Integrated" page="auth/integrated/" />
 </localAuthenticationTypes>

For WIA ‘Integrated’ is at the top of the list:

<microsoft.identityServer.web>
 <localAuthenticationTypes>
 <add name="Integrated" page="auth/integrated/" />
 <add name="Forms" page="FormsSignIn.aspx" />
 </localAuthenticationTypes>

Implementing Selective Authentication using the user agent string

Manipulation of the User Agent string on Internet Explorer, Firefox and Chrome

The first thing required is to append the user agent string to browsers. This can be done in Internet explorer using Group Policy

  1. Under User Configuration expand Windows Settings/Internet Explorer Maintenance
  2. Select ‘Connection’
  3. In the right-hand pane, double-click User Agent String.
  4. On the User Agent String tab, select the ‘Customize String To be Appended To User Agent String check box
  5. Type in the string (in our case campus-ncl).

We have this value set in the ‘Default Domain Policy’ though it could be set lower down.

For Firefox and Chrome things have to be done in the application deployment package. Obviously people will have to use a managed version of the product as it’s not exactly a user friendly setup!

In Firefox the prefs.js file requires to extra lines:

user_pref("network.negotiate-auth.trusted-uris", "<ADFS FQDN>");
user_pref("general.useragent.override", ",<actual agent string> <customstring>")

So in our environment:

user_pref("network.negotiate-auth.trusted-uris", "adfs.ncl.ac.uk");
user_pref("general.useragent.override", ",<actual agent string> campus-ncl")

Chrome needs to be run with some extra switches:

--auth-server-whitelist="ADFS FQDN" --user-agent=" <actual agent string> + <customstring>

So in our environment

--auth-server-whitelist="adfs.ncl.ac.uk" --user-agent=" <actual agent string> + campus-ncl"

Disable Extended Protection must be disabled on the ADFS Farm in IIS (for Firefox and Chrome only)

In order to get SSO working with Firefox and Chrome Extended Protection must be disabled on the ADFS Farm in IIS. Lots of information on this feature and the consequences of disabling it can be found with a simple Google search.

ADFS Farm modifications

There are 2 steps required on the ADFS farm.

  1. Enable Forms Based Authentication as the default method.
  2. Modify the FormsSignIn.aspx.cs source code file

To turn on FBA edit the <localAuthenticationTypes> element of the ADFS web.config file and make sure FBA ‘Forms’ is at the top of the list:

<microsoft.identityServer.web>
 <localAuthenticationTypes>
 <add name="Forms" page="FormsSignIn.aspx" />
 <add name="Integrated" page="auth/integrated/" />
 </localAuthenticationTypes>

Next open the FormsSignIn.aspx.cs Source Code File.

The default out of the box, the code looks like this:

using System;

using Microsoft.IdentityServer.Web;
using Microsoft.IdentityServer.Web.UI;

public partial class FormsSignIn : FormsLoginPage
{
 protected void Page_Load( object sender, EventArgs e )
 {
 }
…

We need to add some code to the Page_Load event which will forward the request to integrated authentication if the campus-ncl user agent string is present. In order to do this we had to add System.Web to the namespace list.

using System;
using System.Web;
using Microsoft.IdentityServer.Web;
using Microsoft.IdentityServer.Web.UI;

System.Web supplies the classes that enable browser-server communication which are needed to get the user agent string and the query string generated by Microsoft Online Services.

protected void Page_Load( object sender, EventArgs e )
 {
 //Get the raw query String generated by Office 365
 int pos = Request.RawUrl.IndexOf('?');
 int len = Request.RawUrl.Length;
 string rawq = Request.RawUrl.Substring(pos + 1, len - pos - 1);

 //Convert query string (qs) to a string
 string qs = HttpUtility.ParseQueryString(rawq).ToString();

 //Get the user agent value
 string uagent = Request.UserAgent;

 //Check if the string campus-ncl appears in the User Agent
 //If it is there forward to WIA along with the Query String

 if(uagent.IndexOf("campus-ncl") > -1)
 {
 Response.Redirect("/adfs/ls/auth/integrated/?" + qs, true);
 }
 else
 {
 //Carry on and do Forms Based Authentication
 }
 }

And that’s it! Anyone using a managed browser with the custom string will be forwarded for WIA and get the SSO experience and all others will get FBA.

Things to note

  1. This method is not officially supported by Microsoft and there are potential issues around future ADFS upgrades (there is no guarantee that the same configuration will be in future versions of ADFS). We are also developing the fall back plan of pointing different clients and the different farms in DNS in case it is needed.
  2. There may very well be a better way to do this! If you find one please let us know 🙂

Special mention

Although we knew what we wanted to do we were having trouble getting the query string and putting it in a usable form (I’m not a programmer!) This information was provided by another TechNet forum member

 

Secure destruction of data

We’ve recently been asked how we dispose of our hard disk drives/tapes while ensuring that sensitive data is protected.  Depending on the nature of the data we use a 2 stage method.

Media for disposal or reuse within the University

Hard disks are wiped using the freely available DBAN. I’ll use their own description of the software:

Darik’s Boot and Nuke (“DBAN”) is a self-contained boot disk that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction. DBAN is a means of ensuring due diligence in computer recycling, a way of preventing identity theft if you want to sell a computer, and a good way to totally clean a Microsoft Windows installation of viruses and spyware.

Tapes are erased using the built in library features. Completing this stage would make media suitable for internal transfer and reuse within the University.

In order to use DBAN yourself you simply need to burn a copy of the ISO which creates a bootable CD/DVD. After that simply follow the on screen instructions.

Disposal (WEEE)

If the media holding the data is to be disposed of or recycled the University has a contract for WEEE contractor- www.secondbyteit.co.uk.

Second Byte provide Hard drive erasure and Certificates of data destruction. Each piece of equipment is given a reference by the contractor and certificates of destruction are provided. These are stored electronically centrally.

Hard drives are removed from machines during booking in, placed in secure containers and moved to a separate area of their warehouse. Only specific members of staff are allowed to handle hard drives. All hard drives are sanitized again using DBAN working to DOD 5220.22-M with 7 passes even if clients have sanitized them or if they have asked for disposal. All hard drives that clients have asked to be destroyed are recycled after being sanitized.

Any tapes or other media are physically destroyed certificates of destruction provided.

Our Journey to the Cloud (Office 365): Part 1 – Introduction

Newcastle University has made the decision to move some of its Student email services to the cloud using Microsoft’s Office 365 platform.  We have decided to share our journey as we go through it explaining the reasons why along with detailed technical information which we hope may be of use to other institutions.

Introduction

The University’s current undergraduate (UG) and postgraduate taught (PGT) student Email hosting service resides upon a mature ISS hosted Exchange 2007 platform that is four years old. The hosting hardware will reach end of life during 2012. ISS planned to review student Email hosting options as this hardware approached end of life with a view of comparing an internally provisioned replacement service against a Cloud based solution or the “no provision” option.

The University’s current Email hosting provision is split into two services, one for UG/PGT and the other for staff/PGR. The UG/PGT service serves over 30,000 student mailboxes with an overlapping group of graduating students where mailboxes are retained for a period of time post-graduation. The current staff Email hosting platform serves around 10,000 staff and postgraduate research (PGR)   mailboxes. Both staff and student hosting platforms are inter-linked using Microsoft Active Directory which permits a seamless integration of calendaring, address list and message tracking functionality.

The Email hosting platform for UG/PGT resides upon six servers and six directly attached disc arrays (each with 12 mirrored hard discs). The servers are deployed in an active/passive configuration between two data-centres (that is although data is replicated between the two data-centres, only servers in one data-centre provide service to students at any one time). Student access to the service is via Outlook Web Access and personal mobile devices only. UG/PGT students have a quota of 200MB, although they cannot send Email when a 150MB limit is reached.

Choices

We believed there were three alternatives for UG/PGT Email hosting provision: in-house; outsourced to the Cloud; no provision.

In-house Provision

ISS estimate that the non-staff cost of replacing the current UG/PGT hardware platform in 2012 will require a capital investment of £160K with a recurrent element of £5K pa. The electrical usage and carbon impact of in-house provision is estimated to be 68,000 KWh and 36,500 Kg of CO2 pa. In addition to this, staff costs must be taken in to account.

Cloud Provision

Both Microsoft and Google provide their respective services to education establishments free at the point of use Other cloud-based options are available, generally with different services levels, but at a financial cost to the institution.

No Provision

The final alternative is that the University does not provide any Email hosting facilities to UG/PGT students. Given nearly all students arrive at the University with an existing personal Email account (e.g. Yahoo, Gmail, and Hotmail), does the University need to provide another Email account for UG/PGT students to monitor and use? To ease communications between staff and students, the University could provide a forwarding service whereby a @ncl.ac.uk Email address is available for each student that simply forwards to their personal Email account, such forwarding addresses made available in the University’s global address list.

Microsoft vs Google

Microsoft’s current Cloud service in the education arena is branded as “Live@Edu”; Microsoft plan to upgrade and re-brand the offering as “Office 365 for Education” early in 2012. Given the timescales only the “Office 365 for Education” offering will be discussed. It offers (to students):

  • Online version of Microsoft Exchange 2010;
  • 25GB Email quota
  • Office Web Apps (online versions of Microsoft Word, Excel, PowerPoint and OneNote);
  • Instant messaging/video conferencing via Lync Online;
  • Collaborative web sites via SharePoint Online;
  • Linkage with the University’s Active Directory infrastructure to permit calendaring and address list integration between the University’s staff/PGR Email infrastructure and Office 365 for Education;
  • Secure use of University authentication system (students will use their Campus password);
  • Use post-graduation facilitating alumni communications.

Google

The Google Cloud service in the education arena is branded “Google Apps for Education”. It offers:

  • Online version of Gmail;
  • 25GB Email quota and 1GB of storage for Google Docs;
  • Google Docs (online word processor, spread sheet and drawing packages);
  • Instant messaging via Google Talk;
  • Collaborative web sites via Google Sites;
  • Secure use of University authentication system (students will use their Campus password);
  • Use post-graduation facilitating alumni communications.

The Decision

Both Microsoft and Google provide similar functional offerings. The primary differentiators between the offerings are the integration with the University’s infrastructure and, from a student experience perspective, the familiarity of the Online Office applications compared to those currently deployed on student cluster desktops.

Following consultation with student representatives and the University Teaching, Learning and Student Experience Committee, Strategic Information Systems Group agreed to proceed with a project based upon Microsoft Office 365.

NEXT: Our Journey to the Cloud (Office 365): Part 2 – Technical Overview

Updated the Information security guidance on the ISS website + InfoSec Workshops

There is now updated information security guidance on the ISS web site.

This new guidance, along with a printer-friendly desktop companion, can be accessed here

Published information includes…

  • Understanding Information Security
  • Accessing ICT Services
  • Protecting your data and devices
  • Encryption
  • Scam Emails
  • Email and Internet
  • Protecting ICT services

A web link is also provided to the University’s Information Security Policy.

This guidance is aimed at all users of ICT across the University. More technical guidance for ICT personnel will be published in the near future and will be based on the feedback received through the planned Information Security Workshops.

The information security workshops for computing officers will be taking place on the dates and times shown below. If you are interested in attending, please reserve your place using the links:

The workshops will take place in Claremont Tower, room 701. Please see the attachment for more information.

1. InfoSec Workshop, Mon 19 March, 09:30 – 11:30
2. InfoSec Workshop, Wed 21 March, 09:30 – 11:30
3. InfoSec Workshop, Mon 26 March, 09:30 – 11:30
4. InfoSec Workshop, Wed 28 March, 09:30 – 11:30

http://www.ncl.ac.uk/iss/support/security/

Shift & Right Click!

Thought I would blog on something that I only learnt last year but has been a great time saver for me.

Holding down ‘Shift’ when right clicking in explorer gives some extra very handy options including ‘Open a Command Window here’ and ‘Copy as Path.’

Also, several files types have other contact sensitive options for instance Office files can ‘Open as read only’.

CAP

Ten Immutable Laws Of Security

Interesting article on TechNet:

Law #1:

If a bad guy can persuade you to run his program on your computer, it’s not solely your computer anymore.

Law #2:

If a bad guy can alter the operating system on your computer, it’s not your computer anymore.

Law #3:

If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.

Law #4:

If you allow a bad guy to run active content in your website, it’s not your website any more.

Law #5:

Weak passwords trump strong security.

Law #6:

A computer is only as secure as the administrator is trustworthy.

Law #7:

Encrypted data is only as secure as its decryption key.

Law #8:

An out-of-date antimalware scanner is only marginally better than no scanner at all.

Law #9:

Absolute anonymity isn’t practically achievable, online or offline.

Law #10:

Technology is not a panacea.

http://technet.microsoft….y/hh278941.aspx