Arndt Dibi

Comments

Die Aktivistengruppe 350.org orchestrierte Anfang des Monats eine Veranstaltung, die die Idee fördern sollte, dass die vom Menschen verursachte globale Erwärmung teilweise für den trockenen Winter in Colorado verantwortlich ist. Aber Wetterstationen baten die Bürger, sich auf heftige Schneestürme vorzubereiten, das war kurz vor der Veranstaltung der Gruppe.

„Wir bringen landesweite eine Aktion zusammen, um für das Klima zu tanzen und dass es in Colorado wieder schneit!“heißt es auf der Veranstaltungsseite der Aktivisten. „Das Hauptziel? Ermutigen Sie lokale Mandatsträger, Kandidaten und Organisationen, sich auf der Klimapolitik-Plattform von Colorado zu registrieren.“

Auf derselben Seite der Hinweis:

WICHTIGER HINWEIS: Viele Kulturen auf der ganzen Welt haben in der Vergangenheit um Schnee, Regen, in Not oder in der Feier getanzt. Tanz ist Teil unserer menschlichen Erfahrung und unseres Ausdrucks in allen Kulturen. Wir ermutigen alle, die kulturellen Traditionen anderer zu respektieren und nicht zu versuchen, andere kulturelle Tänze zu imitieren. Wenn deine Kultur schon einen Schneetanz hat – toll, benutze ihn! Wenn nicht, sei bitte kreativ und choreographiere deine eigenen!

Die Organisatoren rangen mit stürmischen Schneebedingungen bereits bei dem sogenannten Volks-Klima-Marsch im April des vergangenen Jahres, während 350.org, Sierra Club und NextGen Klima und andere, die sich zu einem ähnlichen Marsch in Washington DC versammelten, mildes Wetter genossen. Massive Schneestürme haben in der Vergangenheit Klima-Treffen verhindert. Aktivisten, die im vergangenen Jahr in Colorado einen Klimamarsch organisiert hatten, mussten ihre Veranstaltungen verschieben, nachdem ein Schneesturm mehr als einen Fuß Schnee [~ 30cm] auf Teile des Bundesstaates gebracht hatte.

Die Mitglieder von 350.org mussten die Veranstaltung verschieben.

„Manchmal wirft dir Mutter Natur einen kurvigen Ball zu!“ Schrieb 350 Colorado Springs damals auf Facebook. „Gefährliche Bedingungen und nasser Schneefall in der Wettervorhersage für morgen. Bleib in Sicherheit und warm zu Hause und kommt am Sonntagnachmittag zur gleichen Zeit und Ort! „

Offizielle, aktuelle Bilder des Verkehrsministerium in Colorado

Den Schneetanz der Aktivisten scheint das gleiche Schicksal zu treffen, der Schnee fällt und hat nicht aufgehört zu fallen, seit 350.org die Veranstaltung angekündigt hat. In den Bergen, an Orten wie Wolf Creek, fielen in den letzten Tagen fast einen Meter Schnee, was zu Colorados wachsender Schneedecke beitrug und die Schifahrer erfreute.

Es wird erwartet, dass es den ganzen Montag weiterhin schneien wird.

Erschienen auf The Daily Caller am 26.02.2018

Übersetzt durch Andreas Demmig

http://dailycaller.com/2018/02/26/snow-puts-damper-on-activist-event/

* * *

Die Aktivistengruppe 350.org bietet auch Unterstützung (zum Teil auch in anderen Sprachen)

Für den „wissenschaftlichen Teil“ erfährt die Gruppe Unterstützung durch Frau Dr. Kimberly Nicholas, Lund University, Südschweden

Auf der Uni-Webseite erfährt man von Ihren Ausarbeitungen: „Die Kluft beim Klimaschutz: Die Empfehlungen von Bildungseinrichtungen und Regierung lassen die effektivsten Einzelmaßnahmen vermissen.“

Während der Jahre 2016 und 2017 beispielsweise wurden in wissenschaftlichen Journalen über 250 Studien veröffentlicht (siehe hier und hier), in welchen eine starke Verbindung zwischen der Sonne und Klimawandel nachgewiesen wurde.

Vor weniger als 2 Monaten bis in das Jahr 2018 hinein wimmelt es immer noch von immer neuen Beweisen dafür, dass wenn es um Klimawandel bis zu einem substantiellen Ausmaß geht, die Sonne der maßgebliche Faktor ist. Die Liste des gerade begonnenen Jahres 2018 sah bisher bereits 20 derartige Studien, was in etwa gleich liegt mit den Jahren 2016 und 2017.

2 neue Studien (2018) zeigen das derzeitige Klima immer noch in einem ,kälteren Stadium‘, moduliert durch die Sonnenaktivität und die ENSO (hier)

3 neue Studien (2018) weisen eine Verbindung nach zwischen der derzeitigen Erwärmung sowie Abkühlungsphasen der Vergangenheit mit hoher bzw. niedriger Sonnenaktivität (hier).

Hier werden drei neue Studien vorgestellt, die allein während der vorigen Woche erschienen waren. Jede einzelne dokumentiert eine fundamentale Rolle der Sonnenaktivität beim derzeitigen Klimawandel:

Hemisphärische Temperaturtrends ,zeigen starke Relation mit der TSI‘ und ,eine kaum wahrnehmbare Relation mit dem globalen CO2-Gehalt

1. Rajesh and Tiwari, 2018

Die großen harmonischen Schwingungen um ~63 ± 5, 22 ± 2 und 10 ± 1 Jahre gleichen den solaren Periodizitäten und dürften folglich einen solaren Antrieb repräsentieren, während die Komponenten mit Spitzenwerten von 7,6; 6,3; 5,2; 4,7 und 4,2 Jahren offensichtlich in den Frequenzbändern der ENSO liegen in Verbindung mit den internen ozeanischen Prozessen. Unsere Analysen zeigen auch Beweise für die Amplituden-Modulation der solaren Zyklen von 9 bis 11 sowie 21 bis 22 Jahre bei den Wassertemperaturen der nördlichen und südlichen Hemisphäre jeweils über 104 und 163 Jahre (von 1850 bis 2014).

Das Fehlen der oben erwähnten periodischen Oszillationen des CO2-Gehaltes zeigt, dass dieses Spurengas keine Rolle bei den Wassertemperatur-Differenzen spielt. Die Cross-Plot-Analyse zeigte den starken Einfluss der Sonnenaktivität auf die linearen Trends der Wassertemperaturen (auf beiden Hemisphären) zusätzlich zu dem geringen Beitrag durch CO2. Unsere Studie kommt zu dem Ergebnis, dass 1) die langfristigen Trends der Variabilität der nord- und südhemisphärischen Wassertemperaturen eine deutliche Synchronizität zeigen mit zyklischen Erwärmungs- und Abkühlungsphasen und 2) die Differenz zwischen dem zyklischen Antrieb und nicht linearen Modulationen der solaren Variabilität geschuldet ist als mögliche Quelle hemisphärischer Wassertemperatur-Differenzen. … Die Trend-Komponenten der Wassertemperatur zeigen eine starke Relation mit Variationen der Gesamt-Sonneneinstrahlung TSI und kaum eine Relation mit dem globalen CO2-Trend.

—————————–

Änderungen der Temperatur der Welt-Ozeane von 1854 bis 2015 ,reflektieren solare und geomagnetische Aktivität‘

2. Zherebtsov et al., 2018

Auf der Grundlage einer komplexen Analyse hydrometeorologischer Daten wurde nachgewiesen, dass Temperaturänderungen in der Troposphäre und den Ozeanen eine Reaktion darstellen sowohl auf individuelle helio-geophysikalische Störungen als auch auf langfristige Änderungen (1854 bis 2015) solarer und geomagnetischer Aktivität. Es wird klar, dass die klimatische Reaktion auf solare und geomagnetische Aktivitäten charakterisiert wird durch eine nachweisbare räumlich-zeitliche Heterogenität, von regionaler Natur ist und von der allgemeinen Zirkulation der Atmosphäre abhängt. Der größte Beitrag der Sonnenaktivität zu globalen Klimawandeln wurde im Zeitraum 1910 bis 1943 beobachtet. … Während der letzten 1000 Jahre durchlief das Weltklima-Änderungen, die ziemlich eng korrelierten mit Variationen der Sonnenaktivität: vom 11. bis zum 13 Jahrhundert gab es bei hoher Sonnenaktivität eine Warmzeit (das „Mittelalterliche Klimaoptimum“) und zwei Kaltphasen der Kleinen Eiszeit im 16. und 17.Jahrhundert, welche mit dem Maunder- bzw. mit dem Spörer-Minimum korrelieren.

Zu einem allgemeinen Anstieg des Niveaus der Sonnenaktivität war es nach Ende des Maunder-Minimums gekommen (im 18. Jahrhundert), und das Weltklima ist über den größten Teil dieser Periode wärmer geworden. … Es wird gezeigt, dass die Sonnenaktivität signifikant zum globalen Klimawandel beigetragen hat, hauptsächlich während der ersten Erwärmung im 20 Jahrhundert (von 1910 bis 1943). Diese Periode ist charakterisiert durch einen signifikanten positiven Trend des Niveaus der geomagnetischen Aktivität, die während des gesamten betrachteten Zeitintervalls (1868 bis 2015) maximal war und mit einem verstärkten meridionalen Wärmetransfer im Nordatlantik einher ging.

—————————–

Die Sonne kann in diesem Jahrhundert zu einem Niveau des ,Maunder-Minimums‘ absinken, was das Klima ,erheblich beeinflussen‘ würde

Lubin et al., 2018

Während des vorigen Jahrzehnts gab es immer mehr die Bedenken weckende Erkenntnis, dass die stetige und hohe solare Leuchtkraft des vorigen 2. Jahrhunderts in eine noch größere Variabilität im weiteren Verlauf dieses Jahrhunderts übergehen kann (Abreu et al. 2008; Feulner & Rahmstorf 2010; Lockwood 2010). Vor allem könnte die Sonne in eine Phase geringer magnetischer Aktivität gleiten analog dem historischen Maunder-Minimum von etwa 1640 bis 1715 (Eddy 1976). Eine daraus folgende Abnahme der Gesamt-Sonneneinstrahlung TSI, welche den terrestrischen Energiehaushalt der unteren Atmosphäre beeinflussen würde, ist verbunden mit Änderungen der Zirkulation in höheren Breiten, welche erheblich das Klima in Europa und dem atlantischen Sektor der Arktis und Subarktis beeinflussen (Song et al. 2010; Meehl et al. 2013) und auch das Klima der Antarktis beeinflussen können. Andere Studien haben außerdem die Bedeutung der stratosphärischen Reaktionen auf ein Grand Minimum gezeigt (z. B. Gray et al. 2010; Bolduc et al. 2015; Maycock et al. 2015).

Über einen Sonnenzyklus hinweg und mit Sicherheit als Reaktion auf ein zukünftiges Grand Minimum ist die Strahlungs-Variabilität im mittleren UV-Bereich, welche die Sauerstoff-Photolyse und die Ozon-Chemie treibt, viel größer als die TSI. Daraus resultierende Änderungen des stratosphärischen Ozon-Gehaltes verändert den Temperaturgradienten zwischen Troposphäre und Stratosphäre und rückwirken auf die troposphärische Refraktion planetarischer Wellen. Dies ändert klimatisch relevante Zirkulations-Verteilungen noch mehr (Maycock et al. 2015). Mit der Erkenntnis, dass sowohl direkte Strahlungseinflüsse als auch indirekte stratosphärische Einflüsse das terrestrische Klima während eines solaren Grand Minimums beeinflussen, ist es wichtig zu verstehen, wie die UV-Strahlung auf eine so große und lang andauernde Änderung der solaren magnetischen Aktivität reagiert.

Anmerkung: Die Bildinschrift links ist bis auf ein paar Ergänzungen und Zusätzen identisch mit dem oben übersetzten Text.

Link: http://notrickszone.com/2018/02/22/its-the-sun-climate-science-steamrolls-into-2018/#sthash.GafRTb3X.dpbs

Übersetzt von Chris Frey EIKE

Indien, China, die Türkei und andere wichtige Länder, die zu den hohen Treibhausgasemissionen beitragen, tun nicht genug, um die Verpflichtungen zu erfüllen, die sie in dem Abkommen eingegangen sind, heißt es im Bericht. Die Volkswirtschaften der Welt erhöhen die Förderung von Erdgas, was zu einem Anstieg der Treibhausgase beiträgt, besorgt die Aktivisten.

„Es geht nicht schnell genug. es ist nicht ausreichend … Es wird nicht genügend getan“, sagte Corinne Le Quéré, Direktorin des Tyndall-Zentrums für Klimawandelforschung in England, gegenüber Reportern. „Es gibt Leute, die glauben die abkommen sind nicht das Papier wert, was der ehemalige Präsident Barack Obama und andere unterschrieben haben, um das unverbindliche Abkommen zu verfestigten.“

Berichte vom letzten Jahr zeigen, dass die Verpflichtungen der USA im Rahmen des Abkommens ihre Wirkung verfehlten. Obamas Ziel einer Reduzierung der Treibhausgasemissionen um 26 bis 28 Prozent bis zum Jahr 2025, auf der Grundlage des Emissionsniveaus von 2005, wird nicht ausreichen, um die Messgeräte zu bewegen.

hier eine Analyse der Rhodium-Gruppe vom Januar 2016

Bestandsaufnahme: Fortschritte bei der Erfüllung der US-Klimaziele

Von John Larsen, Kate Larsen , Whitney Herndon und Shashank Mohan
28. Januar 2016

…. Die USA haben ihre Emissionskurve erfolgreich geändert: Wir schätzen, dass die CO2-Emissionen der USA aus dem Energieverbrauch im Jahr 2015 um 11% unter dem Stand von 2005 lagen. Während das verlangsamte Wirtschaftswachstum eine Rolle bei diesem Rückgang spielte, lag der Hauptteil an der verbesserten Effizienz von Autos, Lastkraftwagen, Gebäuden und Geräten sowie der Verdrängung von Kohle und Öl durch erneuerbare Energien und Erdgas.

… Um das Versprechen von Paris zu erfüllen, bedarf es zusätzlicher Maßnahmen: Die Verringerung der Emissionen um 26 bis 28% unter das Niveau von 2005 bis 2025 wird nicht allein durch laufende und geplante Maßnahmen möglich sein.

Schließlich verließ Präsident Donald Trump für die USA das Abkommen aus der Überzeugung heraus, dass das Abkommen nicht angemessen ausgehandelt wurde und die amerikanischen Hersteller unfair dabei weggekommen sind. Der Präsident meinte, dass er eventuell eine Vereinbarung eingehen könnte, wenn der bisherige Deal verschrottet und neu verhandelt werden könnte.

Die Aktivisten werden jedoch nicht auf Aussichten eines neuen Abkommens Ruhe geben, selbst wenn Trump wieder beitritt.

Rob Jackson, Experte für Energie und Klima an der Stanford University, sagte Reportern, dass der Boom bei der Erdgasproduktion die Länder davon abhält, ihre Ziele zu erreichen. Er glaubt, dass jede Art von fossiler Brennstoffproduktion verlassen werden sollte, um das Potenzial des Abkommens zu realisieren.

„Enorme Zuwächse bei Energieeffizienz und Ausbau der erneuerbaren Energien reduzieren unseren globalen Hunger nach fossilen Brennstoffen, insbesondere nach Öl und Erdgas, noch lange nicht“, und beklagt die vermeintliche Bewegungslosigkeit seit der Klimarahmenkonvention von 1992. „Bis dahin werden die Treibhausgaskonzentrationen weiter steigen.“

Die Auswertungen zeichnen ein differenzierteres Bild über den Effekt von Erdgas auf die globalen Emissionen.

Die Methanemissionen zum Beispiel fielen zwischen 2011 und 2016 in den Erdgas fördernden Bundesstaaten, um über 211.000 Tonnen CO2 Äquivalent. Auch bei den zehn größten Erdöl produzierenden Landkreisen von Bundesstaten wurden ähnliche Reduktionsraten festgestellt.

Die Förderung stieg an, während die Emissionen deutlich zurückgingen. Midland County zum Beispiel produzierte im Jahr 2016 fast 73 Millionen Barrel Öl, rund 296 Prozent mehr als 2011, heißt es in dem Bericht, erstellt unter dem Greenhouse Gas Reporting Program der EPA.

EPA: Interactive Karte der unterschiedlichen CO2 Emittenten. Auswertung geht bis 2016, unterschiedliche Quellenauswahl und Anzeigen.

Erschienen auf The Daily Caller am 20.02.2018

Übersetzt durch Andreas Demmig

http://dailycaller.com/2018/02/20/activists-paris-climate-deal/

Comments

Die Bewegung Fünf-Sterne geht laut Hochrechnungen als Sieger aus der Wahl in Italien heraus. Eine Regierungsbildung wird dennoch kaum möglich sein.

Comments

Berlin (dpo) - Panik in der SPD-Bundeszentrale in Berlin! Unmittelbar nach der Bekanntgabe, dass die Parteibasis mit 66,02 Prozent eine neue Große Koalition befürwortet, hat sich die Statue von Altbundeskanzler Willy Brandt aus ihrer Verankerung gerissen und zu randalieren begonnen. SPD-Mitglieder und Pressevertreter flüchteten panisch, während die 3,40 Meter große Bronzeskulptur des

Kompletten Artikel auf www.der-postillon.com lesen.

„Das Dilemma ist, dass die Wissenschafts- und die Forschungsförderung eng zusammenhängen und es werden tatsächlich nur Studien veröffentlicht, die ein Risiko darstellen.“

„Es gibt Kollegen, die sagen: Du hast ja recht, aber wenn ich das sage, dann kann ich mein Institut zumachen.“

In this second part of the Demystifying Hybrid Free/Busy, we will cover troubleshooting of Hybrid Free/Busy scenarios, more specifically – how and where to find an actual error that will indicate where the problem is. Before venturing forth, please make sure that you have seen Part 1 of this demystifying series!

Here is the graphics we posted in the previous post; use this as a reference for users that we will be referring to when troubleshooting:

Do you really have a Free/Busy issue?

Usually when a user creates a new meeting in Outlook on the web (OWA) or Outlook, clicks on Scheduling Assistant, adds his or her colleague to the meeting, they try to see when the user is available to meet. If they see the hash marks \\\\\\\ instead of seeing if the other user is free or busy, there is an issue.

You can often see an error message by hovering over hash marks, however we usually find that the error is not very specific. Instead we would need to take slightly more advanced steps to diagnose the issues by checking things like the Outlook logs, F12 Network tab, or Fiddler.

Before getting to actual Free/Busy errors it is worthy to know that there is a Free/Busy test on Remote Connectivity Analyzer, Office 365 tab that can help us with some configuration /functional issues.

This Free/Busy test is useful for checking DNS records, Autodiscover and EWS connectivity issues, pre-authentication for Autodiscover or EWS requests. It is, however not a relevant Free/Busy test per se, as it uses Basic authentication and not Federated authentication used in actual Free/Busy lookups. Therefore, don’t be surprised if you see this test as green (successful) but Free/Busy is not working in your Hybrid Organization.

I would also like to mention that there is a Free/Busy troubleshooter in Beta version, incorporated into SARA tool (Microsoft Support and Recovery Assistant for Office 365) which you can download it from here : https://diagnostics.outlook.com/#/

Open SARA and select Outlook, click Next, select I’m having problems with my calendar, input email address and password of the source mailbox (cloud mailbox if direction not working is cloud > on-premises) and then select I can’t see when someone is free or busy.

Due to underlying complexity of it all, this is not a completely reliable way of determining the cause of free/busy issues in Hybrid Deployments, but it is a good start when troubleshooting. This F/B test from SARA covers mostly cloud to cloud scenarios but I recommend it here because it does connectivity and additional checks on tenant, licensing and Autodiscover.

Where can we see actual Free/Busy error message?

First, we need to understand in which direction we have a lookup problem. Please see Part 1 for discussion of directionality. Sources of logs:

• Outlook logs
• OWA F12 Network Tab
• Fiddler – Outlook and OWA

These steps are important in order for us to see the relevant message error for Free/Busy issues. Once we know the error message, it’s much easier to resolve the issue.

OUTLOOK

Note: you will be able to see the Free/Busy error in plain text in Outlook 2010 logs only, if you are using Outlook 2013/2016, you can’t see the error in the Outlook log and you would need to provide the Outlook ETL log containing the error to Microsoft Support to parse it.

You will still be able to use Fiddler to see the Free/Busy error yourself if you have Outlook 2013/2016 or you can use OWA F12 method while reproducing issue in OWA client but that only works if the on-premises Exchange server version is 2013 or above for the Source Mailbox user.

For the Outlook F/B error, we need to first enable Outlook logging and after this we will reproduce issue (\\\\\\). After repro, we will collect Outlook logs.

1. Enable Outlook logging:

Follow this KB article and check the Enable troubleshooting logging (this requires restarting Outlook) option. Restart Outlook.

2. Reproduce the issue for the non-working direction.

Suppose Free/Busy direction not working is cloud to on-premises, logged on as a cloud user, add some on-premises users to a meeting until you see the hash marks (instead of Free/Busy information). You do not need to save or send a meeting request.

Note that if Outlook logging is turned on, you will see the following notification in Outlook:

Example:

In this screenshot, Jane is a cloud user mailbox. Jane logged on to a mailbox using Outlook 2016 and she is creating the meeting (organizer). She adds 3 participants: ex2010mbx1, ex2013mbx1 and Joe – who are all on-premises user mailboxes.

Jane cannot see Free/Busy for any of them.

3. Collect Outlook logs

Outlook 2010: we need the AS.log from %temp%\OlkAS folder (reference here)

Open the AS.log and look for the error.

(click thumbnail to view larger)

Outlook 2013 / 2016: we need Outlook-#####.etl log from %temp%\Outlook Logging folder (reference here). You would need to send the ETL file to Microsoft Support to get it analyzed as we are parsing this log with an internal tool.

You might not know this but Hybrid free/busy support cases are free of charge! Of course, you can still use the other methods (fiddler for Outlook/OWA or browser for OWA) to see Free/Busy error yourself, however we (Support) might ask you additionally to get this log as in the Outlook ETL log we have the best logging for the Free/Busy errors.

OWA / Outlook on the web

Cloud OWA F12 Network tab

You need to login to OWA as the source mailbox, hit F12 (Developer Tools for browser) and select the Network Tab. You would then lookup Free/Busy for the target mailbox (reproduce the issue). Once you see the hashmarks, look for GetUserAvailabilityInternal Action then look at Response Body to see the error message.

Note: The source mailbox needs to be hosted on Exchange 2013 or above in on-premises or in Exchange Online for us to be able to see the error message in OWA using F12. This method will not work for Exchange 2010 source mailboxes.

This is how this could look like in Internet Explorer (similar in other browsers):

(click thumbnail to view larger)

Fiddler – OWA or Outlook

You would need to download and install Fiddler tool and reproduce the Free/Busy issue in OWA or Outlook.

If you reproduce the problem in OWA, you would search for GetUserAvailabilityInternal Action for owa service.svc entry and then look at JSON /Raw tab to see the error message. If the source mailbox is on Exchange 2010 server, this is what you’ll need to do.

OWA View - Fiddler:

(click thumbnail to view larger)

If you are logged in with Outlook, you would search for GetUserAvailabilityResponse, check the Raw tab and you can click on “View in Notepad” button on the right bottom corner.

Outlook view Exchange Online - Fiddler:

(click thumbnail to view larger)

Outlook view Exchange 2010 Source Mailbox - Fiddler

(click thumbnail to view larger)

When troubleshooting Free/Busy issues, the following on-premises logs can be very useful, especially for Cloud to On-Premises Free/Busy direction.

IIS logs Default Web Site (DWS)
%SystemDrive%\inetpub\logs\LogFiles\W3SVC1
Example: C:\inetpub\logs\LogFiles\W3SVC1

Example of Autodiscover and EWS entries with IOC Enabled in IIS W3SVC1 logs:

Autodiscover – OAUTH (autodiscover.svc without /WSSecurity)

2016-01-06 17:45:27 10.0.0.5 POST /autodiscover/autodiscover.svc &CorrelationID=<empty>;&ClientId=QNFNHKEEKYENCJITQQ&cafeReqId=7972d1fc-a9d9-44c6-8851-480d3601cbd7; 443 S2S~00000002-0000-0ff1-ce00-000000000000 132.245.65.28 ASAutoDiscover/CrossForest/EmailDomain//15.01.0361.007 200 0 0 109

EWS – OAUTH (exchange.asmx without /WSSecurity)

2016-01-06 17:45:27 10.0.0.5 POST /ews/exchange.asmx &CorrelationID=<empty>;&ClientId=WSIVGUUAUWWRFACJBWDA&cafeReqId=6ce8864c-74a0-4ad2-a3dc-7b69e0415403; 443 <unverified>actas1(sip:joe@contoso.com|smtp:joe@contoso.com|upn:joe@contoso.com) 132.245.65.28 ASProxy/CrossForest/EmailDomain//15.01.0361.007 200 0 0 703

Example of EWS entry with Organization Relationship Enabled in IIS W3SVC1 logs:

EWS – DAUTH (exchange.asmx with /WSSecurity)

2016-01-06 18:04:41 10.0.0.5 POST /ews/exchange.asmx/WSSecurity &CorrelationID=<empty>;&ClientId=VOMGJKAWURSVKOXQLBVA&cafeReqId=18fd3a2e-7b1c-4828-8943-6b20912e2e44; 443 - 132.245.65.28 ASProxy/CrossForest/EmailDomain//15.01.0361.007 200 0 0 296

IIS logs Exchange BackEnd (BE)
%SystemDrive%\inetpub\logs\LogFiles\W3SVC2
Example: C:\inetpub\logs\LogFiles\W3SVC2

Example of EWS entry with Organization Relationship Enabled (DAUTH) in IIS W3SVC2 logs:

2016-01-06 18:04:41 fe80::f17f:beef:a5e3:7d3c%25 POST /ews/exchange.asmx/WSSecurity - 444 - fe80::f17f:beef:a5e3:7d3c%25 ASProxy/CrossForest/EmailDomain//15.01.0361.007 200 0 0 93

HTTPProxy logs for Autodiscover
%ExchangeInstallPath%Logging\HttpProxy\Autodiscover
Example: C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Autodiscover

Example of Autodiscover entry with Organization Relationship Enabled (DAUTH)

2016-01-06T18:05:20.552Z,bcdfbed5-f11f-4250-a616-e38cb475cd3f,15,0,1104,2,,Autodiscover,autodiscover.contoso.com,/autodiscover/autodiscover.svc /WSSecurity,,,false,,contoso.com,Smtp~joe@contoso.com,ASAutoDiscover/CrossForest/EmailDomain/ /15.01.0361.007,132.245.65.28,exch-2013,200,200,,POST,Proxy,exch-2013.contoso.com,15.00.1104.000,IntraForest,AnchorMailboxHeader-SMTP,[…],BeginRequest=2016-01-06T18:05:20.192Z;CorrelationID=<empty>;ProxyState-Run=None;FEAuth=BEVersion-1941996624;NewConnection=fe80::f17f:beef:a5e3:7d3c%25&0;

HTTPProxy logs for EWS
%ExchangeInstallPath%Logging\HttpProxy\Ews
Example: C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ews

Example of EWS entry with Organization Relationship Enabled (DAUTH):

2016-01-06T18:04:41.490Z,4757ab2c-8ccc-4d1a-ae39-0780ecc8eabb,15,0,1104,2,{02CD833F-18AB-413A-83CB-0E86F4DA5362},Ews,mail.contoso.com,/ews/exchange.asmx/WSSecurity,,,false,,contoso.com, Smtp~joe@contoso.com,ASProxy/CrossForest/EmailDomain//15.01.0361.007,132.245.65.28,exch-2013,200,200,,POST,Proxy,exch-2013.contoso.com,15.00.1104.000,IntraForest,AnchorMailboxHeader-SMTP,[…],BeginRequest=2016-01-06T18:04:41.380Z;

EWS logs
%ExchangeInstallPath%Logging\Ews
Example: C:\Program Files\Microsoft\Exchange Server\V15\Logging\Ews

Example of EWS entry with Organization Relationship Enabled (DAUTH):

2016-01-06T18:04:41.490Z,4757ab2c-8ccc-4d1a-ae39-0780ecc8eabb,15,0,1104,2,{02CD833F-18AB-413A-83CB-0E86F4DA5362}, External,true,jane@contoso.mail.onmicrosoft.com,, ASProxy/CrossForest/EmailDomain//15.01.0361.007,Target=None;Req=Exchange2012/Exchange2013; ,132.245.65.28,exch-2013,exch-2013.contoso.com,GetUserAvailability,200,12150,,,,,,ebd34d71ac7342c19d947d881db4ad55,f866c73e-6c91-475e-bdec-0428bdeaa423,PrimaryServer; Requester=jane@contoso.mail.onmicrosoft.com; Failures=0

Event Viewer Application logs on Exchange Server
References here and here.

Example of Event ID 4002 for MSExchange Availability:

Log Name: Application
Source: MSExchange Availability
Event ID: 4002
Task Category: Availability Service
Level: Error
Description:
Process 4568: ProxyWebRequest CrossSite from S-1-5-21-391720751-1508397712-925700815-508779 to https://hybrid.contoso.com/ews/exchange.asmx failed. Caller SIDs: NetworkCredentials. The exception returned is Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequestProcessingException: System.Web.Services.Protocols.SoapException: You have exceeded the available concurrent connections for your account. Try again once your other requests have completed.
at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)

IIS tracing for the error code in the IIS logs
Reference here.

Free/Busy errors and fixes

Ray Fong and I made a table (ATTACHED) with the Free/Busy errors encountered so far in Support and their possible resolutions. We cannot cover all possible scenarios and errors even though we have a good-sized list. This is meant to illustrate ways we can resolve specific errors and these suggestions might not work for you even if you have the same error.

If you know the exact Free/Busy error that you get and checked configuration as discussed in part 1 of this series, this is already a tremendous progress, and this will help us resolve your issue faster.

Of course, you can follow these suggestions on your own as most of the actions are harmless but if you don’t feel confident in troubleshooting on your own or you fear that actions are dangerous or irreversible, please contact us.

Free/Busy Errors discussed in the attached table:

FB_Errors.FixesV4

• “An internal server error occurred. The operation failed”
• "The remote user mailbox must specify the the explicit local mailbox in the header"
• "An error occurred when verifying security for the message"
• "Unable to connect to the remote server"
• “Autodiscover failed for email address <> with error ‘The request failed with HTTP status 404: Not Found’ ”
• “The request failed with HTTP status 401: Unauthorized - The user specified by the user-context in the token is ambiguous”
• "An existing connection was forcibly closed by the remote host - An unexpected error occurred on a receive "
• "An existing connection was forcibly closed by the remote host - An unexpected error occurred on a send ”
• "Configuration information for forest/domain could not be found in Active Directory"
• "Proxy web request failed.,inner exception: The request failed with HTTP status 401: Unauthorized."
• "The response from the Autodiscover service at 'https://autodiscover/autodiscover.svc/WSSecurity' failed due to an error in user setting 'ExternalEwsUrl'. Error message: InvalidUser."
• “The caller does not have access to free/busy data"
• “The request failed with HTTP status 403: Forbidden (The server denied the specified Uniform Resource Locator (URL). “
• “Unable to resolve e-mail address user@notes.domain.com to an Active Directory object”
• “An error occurred when processing the security tokens in the message.”
• “The cross-organization request for mailbox yyy@contoso.com is not allowed because the requester is from a different organization”
• “The request failed with HTTP status 401: Unauthorized - Microsoft.Exchange.Security.OAuth.OAuth TokenRequestFailedException: Missing signing certificate “
• “The application is missing a linked account for RBAC roles, or the linked account has no RBAC role assignments, or the calling users account is logon disabled”
• “The entered and stored passwords do not match“
• “The password has to be changed.”
• “The password for the account has expired”
• “Provision is needed before federated account can be logged in”
• “The request timed out”
• “The specified member name is either invalid or empty”
• “The result set contains too many calendar entries”
• “The request failed with HTTP status 401: Unauthorized - The token has an invalid signature.”
• “The request failed with HTTP status 401: Unauthorized - Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: 'XXX’ “
• “Proxy web request failed., inner exception: Response is not well-formed XML “

Thanks to all that contributed to this content: Ray Fong, Nino Bilic, Tim Heeney, Greg Taylor and Brian Day.

Mirela Buruiana

In Microsoft Dynamics 365, by default, database is optimized for database record storage and not for files or attachment storage. Hence, cost effective storage management of huge sized data files becomes one of the most critical aspects for the organizational users. This blog narrating the process of optimizing storage capabilities of Microsoft Dynamics 365 CRM using Azure Blob and SharePoint.

Azure Blob is much known for storing large amounts of unstructured object data including images, audios and multimedia. Whereas apart of its document storage, management and other offerings, SharePoint also allows the record wise sorting of the documents. Hence, optimizing the Microsoft Dynamics 365 CRM storage using both Azure Blob and SharePoint could be an easy, efficient and viable solution.

Azure Blob Storage Configuration

Let’s be clear with our basic requirements:

• The Web Resources to create custom UI to add and view the data files
• Azure Blob configuration into the CRM in order access the information of the blob storage. We will create a setting entity to add azure account name and key there

Following the process described below to configure Azure Blob storage

[1] Setup the Environment

Use the URL https://portal.azure.com and search for ‘storage’ in search panel. Select the Storage accounts (Blob) from the displayed search results.

Once you are navigated to ‘Storage accounts’ dashboard, click ‘Add’ in order to create a new account.

Either key in or select from dropdown options the relevant details for to each field.

• Name
• Account kind: Blob Storage – Must be Blob Storage
• Replication: Keep Default
• Subscription: Usage-Based
• Resource Group: Select the Resource Group

Assure that the created storage is available in the list of storage account.

Create an Image Blob to store the image contents

• Name: Key in the Blob name
• Public access level: Select Blob

Accumulate the relevant Access Key details from the storage account and store into the CRM.

• Storage account name
• Key1
• Key2

Once we done with the above configuration we need to create JavaScript or .Net plugin to integrate Azure API.

[2] Upload the File to Azure

function UploadFileToBlobStorage(pByteData, pFileType, pSize, pName, pFileUrl) {
      var bRes = false;
      var currentDateTime = (new Date()).toGMTString();
      var req = new XMLHttpRequest();
      req.open("PUT", pFileUrl, false);
      req.setRequestHeader("x-ms-version", sVersion);
      req.setRequestHeader("x-ms-date", currentDateTime);
      req.setRequestHeader("Content-Type", pFileType);
      req.setRequestHeader("Content-Length", pSize);
      req.setRequestHeader("x-ms-blob-type", sBlobType);
      req.setRequestHeader("x-ms-blob-content-type", pFileType);
      //Prepare String for Signature----------------------------------------
      var strSign = "PUT\n\n\n" + pSize + "\n\n" + pFileType + "\n\n\n\n\n\n\nx-ms-blob-content-type:" + pFileType + "\nx-ms-blob-type:" + sBlobType + "\nx-ms-date:" + currentDateTime + "\nx-ms-version:" + sVersion + "\n/" + sAccountName + "/" + sContainerName + "/" + GetFileNameFromURL(pFileUrl);
      req.setRequestHeader("Authorization", "SharedKey " + sAccountName + ":" + GetAuthorizationSignature(strSign));
      req.onreadystatechange = function () {
          if (this.readyState == 4 /* complete */) {
              req.onreadystatechange = null;
              bRes = true;
          }
      };
      req.send(pByteData);
      return bRes;
  }

[3] Delete the File from Azure

function DeleteFileToBlobStorage(pFileUrl) {
      var bRes = false;
      var currentDateTime = (new Date()).toGMTString();
      var req = new XMLHttpRequest();
      req.open("DELETE", pFileUrl, false);
      req.setRequestHeader("x-ms-version", sVersion);
      req.setRequestHeader("x-ms-date", currentDateTime);
      req.setRequestHeader("x-ms-blob-type", sBlobType);
      var strSign = "DELETE\n\n\n\n\n\n\n\n\n\n\n\nx-ms-blob-type:" + sBlobType + "\nx-ms-date:" + currentDateTime + "\nx-ms-version:" + sVersion + "\n/" + sAccountName + "/" + sContainerName + "/" + GetFileNameFromURL(pFileUrl);
      req.setRequestHeader("Authorization", "SharedKey " + sAccountName + ":" + GetAuthorizationSignature(strSign));
      req.onreadystatechange = function () {
          if (this.readyState == 4 /* complete */) {
              req.onreadystatechange = null;
              bRes = true;
          }
      };
      req.send();
      return bRes;
  }

SharePoint Configuration

[1] Enable server-based integration from CRM

To Integrate SharePoint with the CRM, we need to enable the server-based integration from CRM Setting.

Follow the path: CRM Instance >> Setting >> Document Management >> Enabled Server Based SharePoint Integration

(a) Define Deployment

(b) Prepare Sites

(c) Validate Sites

(d) Finish Sever Based integration

[2] Power Attachment Integration

There are several methods to configure SharePoint. Here is the one with Power Attachment integration. In order to upload documents to SharePoint, you can use Power Attachment, the add-on from PowerObjects. You need to add relevant information to the Power Attachment solution. Follow the described steps for the same.

• Enable SharePoint Integration
  • Go to Setting Document Management >> Document Management Setting
  • Select Entities
  • SharePoint Site : https://<instance>.sharepoint.com/sites/documents
  • Click Next and allow CRM to Create Folder Structure
  • Finish the document creation
• Go to Setting Solutions >> PowerAttachment Solution
• Configure Profile Tab and check with “Test CRM Credentials”
• Configure Setup Tab and check with “Test SharePoint Credentials”
  • Location Type: Share Point
  • URL : https://<instance>.sharepoint.com
  • Username: Enter CRM Admin User
  • Password: Enter Password
  • Document Liabrary: Create Sharepoint Document Library
  • SharePoint Type: Online
  • Attachment Types: “doc,docx,xls,xlsx,ppt,pptx,zip,rar,pdf”
  • Overwrite File: No
  • Service Provider: Central
  • Save To Regarding Folder: Yes

Once the Power Attachment configuration is completed successfully, we can attach any document of the selected entities and the document will automatically be uploaded to SharePoint

[If you find any difficulties with configuration of Power Attachment, you can find the help at https://www.powerobjects.com/guides/powerattachment/]

[3] Facilitate to read Documents from SharePoint using Customized/Coding Flow

In order to facilitate the reading of documents from the SharePoint, we need to integrate an API that can access the data. Hence, the relevant setup and authentication process is required. Follow the described steps for the same.

[a] Register Add-In

It is necessary to register the Add-In in SharePoint where you want to access the information. Follow the steps described below to register the Add-In in SharePoint site.

• Login to SharePoint online site
• Use the URL https://<sitename>.SharePoint.com/_layouts/15/appregnew.aspx to Register Add-In page
• Visit App Information section, click the Generate button displayed next to Client Id and Client Secret textboxes to generate the respective values
• Title: Enter Add-In Title
• App Domain: as a localhost
• Redirect URL: as https://localhost (Need to keep as localhost)

Click on Create button. The Add-In will be registered followed by the success message pop up. Carefully note down the displayed information.

[b] Grant Permissions to Add-In

Once you are done with registration Add-In, you need to set the permissions for that Add-In to access the SharePoint data. We will set the Read permission level to the web scope, so that we will be able to read the web information.

Navigate to the SharePoint site and enter the URL: “https ://< sitename>.sharepoint.com/_layouts/15/appinv.aspx” in the browser to get redirected to Grant permission page.

Enter the Client ID noted from Add-In registration success message in AppId textbox and click Lookup button. That will populate the value to other textboxes in Title, App Domain and URL

Enter the below permission request in XML format

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest
Scope="http://sharepoint/content/sitecollection/web" Right="Read" /> 
</AppPermissionRequests>

Then click on Create button. This will redirect to you to the page displayed below as image. Here, you need to authorize the add-in as trusted to read items from website.

[c] Retrieve the Tenant Id and Resource Id

Once you are done with registration of the Client Id along with relevant the permissions, you are ready to access the SharePoint information from the external system or tools.

As a process, first you need to know the Tenant Id. Follow the steps described below to obtain that information from postman.

• Launch Postman Or other REST Client (chrome extension)
• Select Get Method, enter the URL given below in Request URL textbox “https://<sitename>/sharepoint.com/_vti_bin/client.svc/”
• Configure the below information in the header section to send along with the url requestMethod = Get Headers

Key	Value
Authorization	Bearer

• Collect the relevant information required for the configuration such as
  • Client Id: 45df14e8-1948-4ac2-aa01-8bb87b90862f
  • Client Key: 9q+5iXvdExjoDFxmSKUy2EooSz9auxk8hXbh3u72v+0=
  • Tenant Id: cf29bdef-c7f8-4b5f-9dad-d088ea24a441
  • Resource Id: 00000003-0000-0ff1-ce00-000000000000
  • We have to add this information under the Setting, same as below image.

Once we done with the above configuration we need to create JavaScript or .Net plugin to integrate SharePoint API.

Sample Code to Read File

string accessTocken = Utility.GetAccessTockenForSharePoint(siteURL, companyProfile);

// To Get AccessTocken For SharePoint
public static string GetAccessTockenForSharePoint(string siteURL, Entity myentity)
        {
            string tenentID = string.Empty;
            if (myentity.Attributes.Contains(AppConstants.EntityLogicalName.myentity_imm_sharepoint_tenantid))
            {
                tenentID = myentity[AppConstants.EntityLogicalName.myentity_imm_sharepoint_tenantid] as string;
            }
            string clientId = string.Empty;
            if (myentity.Attributes.Contains(AppConstants.EntityLogicalName.myentity_imm_sharepoint_clientid))
            {
                clientId = myentity[AppConstants.EntityLogicalName.myentity_imm_sharepoint_clientid] as string;
            }
            string clientKey = string.Empty;
            if (myentity.Attributes.Contains(AppConstants.EntityLogicalName.myentity_imm_sharepoint_clientkey))
            {
                clientKey = myentity[AppConstants.EntityLogicalName.myentity_imm_sharepoint_clientkey] as string;
            }
            string resourceId = string.Empty;
            if (myentity.Attributes.Contains(AppConstants.EntityLogicalName.myentity_imm_sharepoint_resourceid))
            {
                resourceId = myentity[AppConstants.EntityLogicalName.myentity_imm_sharepoint_resourceid] as string;
            }
            string accessTocken = string.Empty;
            HttpWebRequest request = (HttpWebRequest)WebRequest.Create("https://accounts.accesscontrol.windows.net/" + tenentID + "/tokens/OAuth/2");
            request.ContentType = "application/x-www-form-urlencoded";
            //request.Accept = "application/json; odata=verbose";
            // request.Headers.Add("Authorization", "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlZXVkljMVdEMVRrc2JiMzAxc2FzTTVrT3E1USIsImtpZCI6IlZXVkljMVdEMVRrc2JiMzAxc2FzTTVrT3E1USJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbGF1cnVzaXRpbnNwaXJhdGlvbi5zaGFyZXBvaW50LmNvbUBjZjI5YmRlZi1jN2Y4LTRiNWYtOWRhZC1kMDg4ZWEyNGE0NDEiLCJpc3MiOiIwMDAwMDAwMS0wMDAwLTAwMDAtYzAwMC0wMDAwMDAwMDAwMDBAY2YyOWJkZWYtYzdmOC00YjVmLTlkYWQtZDA4OGVhMjRhNDQxIiwiaWF0IjoxNTAzMzgwNTUxLCJuYmYiOjE1MDMzODA1NTEsImV4cCI6MTUwMzM4NDQ1MSwiaWRlbnRpdHlwcm92aWRlciI6IjAwMDAwMDAxLTAwMDAtMDAwMC1jMDAwLTAwMDAwMDAwMDAwMEBjZjI5YmRlZi1jN2Y4LTRiNWYtOWRhZC1kMDg4ZWEyNGE0NDEiLCJuYW1laWQiOiI5NTdjOGNkYy0yMGY1LTQ3NjQtYmQyMi1lN2I5YjlhMTZlZjhAY2YyOWJkZWYtYzdmOC00YjVmLTlkYWQtZDA4OGVhMjRhNDQxIiwib2lkIjoiY2M0NzQ0ZjQtZDJkNC00OWY3LWEwMWItY2ZmZDYyMDY4Y2NkIiwic3ViIjoiY2M0NzQ0ZjQtZDJkNC00OWY3LWEwMWItY2ZmZDYyMDY4Y2NkIiwidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiJmYWxzZSJ9.Mwu6NvV1a9gUg7rvMBjFuV78Z7mci1eL6M4ObZ7VrcPNsHzvVNtd_vVeoMnOqNvyqkbPNM3xEKhbBGJlYd2PO-HBTWNGFD16q4g0ctyRWgGQlr0KlNMVvXflqqE0Fes50b6rSjqBM1-XZEKhEk8_Zn_I6K2vNfrVTUxRtAhaNQEPKGn-mtTbusHqE2yxMuOA4oqM6XvTwN9ZW5s_2qcm7m6EewS2wGuu4CPya40QD3p8eWKUqzAsGfiPHOkPDASsGWP4zct7Hn8qpg_5v_xTKAa18uvVed3CUEbeBXS8XFtwfxZllFXb-mryexhWHazF_Q8Q3bTGT3FFcgUJFqb8hA");
            request.Method = "POST";

            byte[] byteData = null;
            Stream postStream = null;

            string postData = "grant_type=client_credentials" +
                "&client_id=" + clientId + "@" + tenentID +
                "&client_secret=" + clientKey +
                "&resource=" + resourceId + "/" + siteURL.ToLower().Replace("http://", "").Replace("https://", "") + "@" + tenentID;

            byteData = UTF8Encoding.UTF8.GetBytes(postData);
            // Set the content length in the request headers  
            request.ContentLength = byteData.Length;
            postStream = request.GetRequestStream();
            postStream.Write(byteData, 0, byteData.Length);

            WebResponse webResponse = request.GetResponse();

            StreamReader reader = new StreamReader(webResponse.GetResponseStream());
            //' Console application output  
            string response = reader.ReadToEnd();
            using (MemoryStream DeSerializememoryStream = new MemoryStream())
            {
                DataContractJsonSerializer serializer = new DataContractJsonSerializer(typeof(SharepointAccessClass));

                //user stream writer to write JSON string data to memory stream
                StreamWriter writer = new StreamWriter(DeSerializememoryStream);
                writer.Write(response);
                writer.Flush();

                DeSerializememoryStream.Position = 0;
                //get the Desrialized data in object of type Student
                SharepointAccessClass SerializedObject = (SharepointAccessClass)serializer.ReadObject(DeSerializememoryStream);
                accessTocken = SerializedObject.access_token;
            }

            return accessTocken;
        }

----------------------------------------------------------- Actual reading of the file
string fileUrl = (oEntity[AppConstants.EntityLogicalName.ANNOTATION_NoteText] as string).Trim();
                            string surl = siteURL + "/_api/SP.AppContextSite(@target)/web/getfilebyserverrelativeurl('" + fileUrl.Replace(siteURL, "") + "')/$value?@target='" + siteURL + "'";

                            // Get File From Sharepoint Server
                            HttpWebRequest request = (HttpWebRequest)WebRequest.Create(surl);
                            request.Accept = "application/json; odata=verbose";
                            request.Headers.Add("Authorization", "Bearer " + accessTocken);
                            request.Method = "GET";

                            // Manage Response To Get Base 64 of file
                            WebResponse webResponse = request.GetResponse();
                            MemoryStream memoryStream = new MemoryStream();
                            using (Stream responseStream = request.GetResponse().GetResponseStream())
                            {
                                byte[] buffer = new byte[0x1000];
                                int bytes;
                                while ((bytes = responseStream.Read(buffer, 0, buffer.Length)) > 0)
                                {
                                    memoryStream.Write(buffer, 0, bytes);
                                }
                            }
                            var resultValue = memoryStream.ToArray();
                            string encodedGeneratedDocument = Convert.ToBase64String(resultValue);

Conclusion

In this blog I have narrated the entire process of optimizing the storage capabilities of Microsoft Dynamics 365 using Azure Blob Storage and SharePoint Storage along with detailed configuration process. This integrated solution can optimize the storage capabilities of Microsoft Dynamics 365 largely.

The post Microsoft Dynamics 365 Storage Pitfalls – Here is the Cost Effective Solution appeared first on Simple Talk.

Comments

Comments

The February update for Azure IoT Edge contains improvements to the runtime, documentation, and tooling.

As part of the Windows 10 Creators Update, we shared our goal to bring 3D to everyone and to empower you to create, play and share in a new dimension with the launch of Paint 3D.

Whether you’re a professional or just wanting to express yourself creatively, Paint 3D is available to all skill levels and backgrounds, and with the Remix 3D online community, you can choose to start from scratch or be inspired by others. Now with editing in 3D View mode, creating in 3D has never been easier.

3D View enables you to edit from any angle, which means even more accurate and intuitive 3D creation. You can now orbit around your 3D designs and continue doodling, painting or stickering without having to switch back to the 2D camera. This means, if you’re creating a 3D replica of Earth, you can continue rotating around the planet with no interruptions in your work! Today, we’re sharing some quick tips for getting started with this new update.

View and edit your creation from multiple angles

Switching to 3D View is a great way to admire your work from different perspectives. In 3D View, you can orbit, pan and zoom around your 3D creation to get a better look at it.

As you move around, you’ll see our familiar selection box, which will automatically twist so that it’s always facing you.

The angle of the box shows you the direction your models will move and scale.

You will also see the new selection highlight, which enables you to always see your models, even if they are behind something else.

You can keep adding new objects, continue painting with different brushes, or put stickers on your work – all while remaining in your desired viewpoint.

Start working in 3D View today

To access the 3D View mode, you’ll just need to be on the Windows 10 Fall Creators Update and ensure you have the latest app update to Paint 3D. Then, go to the top of your tool bar within Paint 3D and click 3D View. To learn how to get the Windows 10 Fall Creators Update, check out this blog post.

Let 3D View give you a new perspective on creativity and get started today!

The post New 3D View mode in Paint 3D improves ease and accuracy of editing appeared first on Windows Experience Blog.

Comments

Comments

Comments

Howdy folks,

Recently a security vulnerability was discovered in a number of SAML SSO implementations which makes it possible for a signed SAML token to be manipulated to impersonate another user or to change the scope of a users authorization in some circumstances. The vulnerability is described in the finders blog, here. Many of you have been asking whether this affects Microsoft identity servers and services.

We can confirm that Microsoft Azure Active Directory, Azure Active Directory B2C and Microsoft Windows Server Active Directory Federation Services (ADFS) are NOT affected by this vulnerability. The Microsoft account system is also NOT affected.Additionally, we can confirm that neither the Windows Identity Foundation (WIF) nor the ASP.NET WS-Federation middleware have this vulnerability.

While Azure Active Directory and ADFS arent affected by this for incoming SAML tokens, you should ensure that any applications you use that consume SAML tokens issued by arent affected. We recommend you contact providers of your SAML based applications.

Best Regards,
Alex

Attackers have seized on a relatively new method for executing distributed denial-of-service (DDoS) attacks of unprecedented disruptive power, using it to launch record-breaking DDoS assaults over the past week. Now evidence suggests this novel attack method is fueling digital shakedowns in which victims are asked to pay a ransom to call off crippling cyberattacks.

On March 1, DDoS mitigation firm Akamai revealed that one of its clients was hit with a DDoS attack that clocked in at 1.3 Tbps, which would make it the largest publicly recorded DDoS attack ever.

The type of DDoS method used in this record-breaking attack abuses a legitimate and relatively common service called “memcached” (pronounced “mem-cash-dee”) to massively amp up the power of their DDoS attacks.

Installed by default on many Linux operating system versions, memcached is designed to cache data and ease the strain on heavier data stores, like disk or databases. It is typically found in cloud server environments and it is meant to be used on systems that are not directly exposed to the Internet.

Memcached communicates using the User Datagram Protocol or UDP, which allows communications without any authentication — pretty much anyone or anything can talk to it and request data from it.

Because memcached doesn’t support authentication, an attacker can “spoof” or fake the Internet address of the machine making that request so that the memcached servers responding to the request all respond to the spoofed address — the intended target of the DDoS attack.

Worse yet, memcached has a unique ability to take a small amount of attack traffic and amplify it into a much bigger threat. Most popular DDoS tactics that abuse UDP connections can amplify the attack traffic 10 or 20 times — allowing, for example a 1 mb file request to generate a response that includes between 10mb and 20mb of traffic.

But with memcached, an attacker can force the response to be thousands of times the size of the request. All of the responses get sent to the target specified in the spoofed request, and it requires only a small number of open memcached servers to create huge attacks using very few resources.

Akamai believes there are currently more than 50,000 known memcached systems exposed to the Internet that can be leveraged at a moment’s notice to aid in massive DDoS attacks.

Both Akamai and Qrator — a Russian DDoS mitigation company — published blog posts on Feb. 28 warning of the increased threat from memcached attacks.

“This attack was the largest attack seen to date by Akamai, more than twice the size of the September, 2016 attacks that announced the Mirai botnet and possibly the largest DDoS attack publicly disclosed,” Akamai said [link added]. “Because of memcached reflection capabilities, it is highly likely that this record attack will not be the biggest for long.”

According to Qrator, this specific possibility of enabling high-value DDoS attacks was disclosed in 2017 by a Chinese group of researchers from the cybersecurity 0Kee Team. The larger concept was first introduced in a 2014 Black Hat U.S. security conference talk titled “Memcached injections.”

DDOS VIA RANSOM DEMAND

On Thursday, KrebsOnSecurity heard from several experts from Cybereason, a Boston-based security company that’s been closely tracking these memcached attacks. Cybereason said its analysis reveals the attackers are embedding a short ransom note and payment address into the junk traffic they’re sending to memcached services.

Cybereason said it has seen memcached attack payloads that consist of little more than a simple ransom note requesting payment of 50 XMR (Monero virtual currency) to be sent to a specific Monero account. In these attacks, Cybereason found, the payment request gets repeated until the file reaches approximately one megabyte in size.

Memcached can accept files and host files in temporary memory for download by others. So the attackers will place the 1 mb file full of ransom requests onto a server with memcached, and request that file thousands of times — all the while telling the service that the replies should all go to the same Internet address — the address of the attack’s target.

“The payload is the ransom demand itself, over and over again for about a megabyte of data,” said Matt Ploessel, principal security intelligence researcher at Cybereason. “We then request the memcached ransom payload over and over, and from multiple memcached servers to produce an extremely high volume DDoS with a simple script and any normal home office Internet connection. We’re observing people putting up those ransom payloads and DDoSsing people with them.”

Because it only takes a handful of memcached servers to launch a large DDoS, security researchers working to lessen these DDoS attacks have been focusing their efforts on getting Internet service providers (ISPs) and Web hosting providers to block traffic destined for the UDP port used by memcached (port 11211).

Ofer Gayer, senior product manager at security firm Imperva, said many hosting providers have decided to filter port 11211 traffic to help blunt these memcached attacks.

“The big packets here are very easy to mitigate because this is junk traffic and anything coming from that port (11211) can be easily mitigated,” Gayer said.

Several different organizations are mapping the geographical distribution of memcached servers that can be abused in these attacks. Here’s the world at-a-glance, from our friends at Shadowserver.org:

Here are the Top 20 networks that are hosting the most number of publicly accessible memcached servers at this moment, according to data collected by Cybereason:

DDoS monitoring site ddosmon.net publishes a live, running list of the latest targets getting pelted with traffic in these memcached attacks.

What do the stats at ddosmon.net tell us? According to netlab@360, memcached attacks were not super popular as an attack method until very recently.

“But things have greatly changed since February 24th, 2018,” netlab wrote in a Mar. 1 blog post, noting that in just a few days memcached-based DDoS went from less than 50 events per day, up to 300-400 per day. “Today’s number has already reached 1484, with an hour to go.”

Hopefully, the global ISP and hosting community can come together to block these memcached DDoS attacks. I am encouraged by what I have heard and seen so far, and hope that can continue in earnest before these attacks start becoming more widespread and destructive.

Here’s the Cybereason video from which that image above with the XMR ransom demand was taken:

Fahrverbote könnten wesentlich mehr Dieselautos betreffen als bislang erwartet. Die Bundesregierung befürchtet laut einem Medienbericht, dass nur Wagen mit der ganz neuen Schadstoffklasse 6d sicher sind. (Auto, Technologie)

Der 50-jährige Hamburger über seine Arbeit als Naturreporter, seine Show „Planet Erde“ und Heimweh auf Dienstreisen.

Es ist schon mehr als ein ganzes Jahr her, dass Microsoft ein Update für Windows 10 auf der HoloLens ausgerollt hat. Im Zuge des HoloDevelopers Summit hat Microsoft angekündigt, dass man an einem neuen Update für die Software arbeitet, das einige Neuerungen für die HoloLens-Brille mitbringt.

Diese neuen Funktionen sind nicht nur große Veränderungen für HoloLens und entsprechend auch für die Entwickler, sondern sind generell ein großer Schritt im AR-Bereich. Schließlich ist Microsoft auch das einzige Unternehmen, das im Augmented Reality-Bereich mit einem eigenen Produkt auf dem Markt vertreten ist.

Wir haben sämtliche Neuerungen des Updates für euch im Folgenden zusammengefasst:

• 3D Live Tiles für eine interaktivere Shell
• Zwei-Hand-Manipulation von 3D-Objekten
• Research Modus gibt Entwicklern Vollzugriff auf Sensordaten der HoloLens
• Fluent Design im Interface
• WebVR wird unterstützt dank eines Updates für den Edge Browser

Das Update wird bald für HoloLens Insider erhältlich sein, jedoch handelt es sich um eine sehr frühe Version mit entsprechend vielen Fehlern. Es könnte sein, dass manche Anwendungen momentan schlichtweg nicht funktionieren. HoloLens-Besitzer können sich für das Insider-Programm anmelden und schon bald das neue Update testen.

> Die Development Edition bestellen

> Die Commercial Suite Edition bestellen

---

via mspu / Quelle: Reality News / Enthält Partnerlinks.

Der Beitrag HoloLens-Update bringt mehrere neue Funktionen erschien zuerst auf WindowsArea.de.

Ist der gebührenfinanzierte Rundfunk in einer Demokratie verzichtbar? Ist es zeitgemäß, wenn die Bürger ihn zahlen müssen, ob sie wollen oder nicht? In der Schweiz entscheidet nun das Volk darüber. Viele in Deutschland erwarten das Ergebnis mit gemischten Gefühlen.

Comments

Office 365 groups span over various Office 365 services and provide a great way for collaborating. By default, every user can create an Office 365 group. While self-service is a good thing and many businesses adopted into that direction, some companies still prefer the controlled approach.

 

In real world environments, organizations usually want to restrict the group provisioning so that IT can control the wild growth of groups. This article series shows how to create an Office 365 group with an attached approval process with SharePoint Online, Flow and Azure functions. See how this works here!

 

This is part 1 of a 3 part series. This article series was written by Martina Grom and Toni Pohl.

 

For showing all the technics behind that requirement we developed a demo scenario showing all necessary steps. You need to have a SharePoint Administrator, a Flow license and an Azure subscription and some basic knowledge about web technologies. There are some steps required, but the process is simple. Follow these steps to get your solution up and running.

 

The scenario

The following graphics delivers the planned steps for the approval workflow. The blue steps require a user interaction, the orange ones are automatic processes. Green and red show an accept or deny decision.

 

 

If a user requests to create an Office 365 group (which can be requested f.e. in a PowerApp or in a SharePoint list) and it gets accepted, the function provisions the group and the initiator gets a notification email. In this sample, we start with the base part that does the work: provisioning the Office 365 group, first as a demo, then in part two the code follows.

 

First, see how group operations work with Microsoft Graph Explorer

Open developer.microsoft.com/graph/graph-explorer, sign in and accept the consent for the Microsoft Graph App.

 

 

Now, try to access the Microsoft groups with a GET request of this URL:
https://graph.microsoft.com/v1.0/groups

 

If you get an error as here, your account (even if it's the global administrator) does not have the necessary permissions.

 

 

The error says "Authorization_RequestDenied", and "Insufficient privileges to complete the operation."

You need to modify the permissions. Open the link in the red message box (or on the left below your account). In the Modify Permissions dialog, click "access to your entire organization" and confirm the "Modify Permissions" button. Alternatively, you can add the required permissions "Read and write all groups" manually.

 

 

Then, sign in again (which happens automatically that you get redirected to the login page again). Now, you get a new consent with all possible permissions. Accept the new consent for your organization.

 

 

Another box informs about the newly granted permissions, and yes, it can take some minutes before the consent takes effect, but mostly it works instantly.

 

We're done with the permissions for our administrator user.

Update December 2017: All App permissions

Since we got some feedback on the required permissions for the app, see the following screenshots for all activated permissions of that app:

 

For AAD, the following app permissions were used:

 

For Graph, these permissions have been set.

 

We hope, this clarifies the permissions.

Accessing groups through the Microsoft Graph API

Ok, now we should be able to use the API for Office 365 groups. For our demo, we are using Microsoft Graph API version 1.0 (which is the current version). The next attempt against https://graph.microsoft.com/v1.0/groups works as expected: We get all groups of the tenant - which is one single existing Office 365 group in our sample.

 

 

Since the API represents an OData interface, we can use expressions as filtering, paging and more. Here we reduce the output to the relevant properties with $select as parameter:

 

https://graph.microsoft.com/v1.0/groups?$select=displayName,description,groupname,groupTypes,
mailNickname,mailEnabled,securityEnabled,proxyAddresses

 

For a list of more OData options, see Use query parameters to customize responses and Supported queries, filters, and paging options | Graph API concepts.

Create a new Office 365 group with the Microsoft Graph API

We can create a new Office 365 group with a POST operation and the necessary data as follows. First, we simply copy the JSON output from above and adapt it as needed. We create a new group "My Demo 1" with some description and the necessary properties as here:

{
     "displayName": "My Demo 1",
     "description": "This is a demo group",
     "groupTypes": ["Unified"],
     "mailEnabled": true,
     "mailNickname": "mydemo1",
     "securityEnabled": false
}

An Office 365 group is defined by the group type "Unified". This JSON-description must be pasted into the "Request Body". So, let' s execute this operation against https://graph.microsoft.com/v1.0/groups with a POST as here:

 

 

You should get a HTTP status code 201 (which means Ok, the request has been fulfilled and has resulted in one or more new resources being created.) and the runtime of the operation and some output.

 

To see, what properties can be used for a POST operation and what properties are read only check out the list at group resource type.

Set the owner of a group

When we create a new group with the Global Administrator with Graph Explorer, that user is automatically owner of the new group which is fine. If we do it (in part 2) with an app, there is no owner set. This means, that the user who requested the new group will not be able to access or to manage it. So, it's essential, that we are able to set the owner of a group programmatically as well.

 

The good story is that we are able to do this with the Microsoft Graph API. See https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/group_post_owners how this works. Basically, we need to get the User Id of the owner first. We can get it by asking for the user by his UPN:

https://graph.microsoft.com/v1.0/users/admin@M365x127892.onmicrosoft.com

In our sample, the User ID is be2cab0f...

 

Also, we need the Group ID. To get a quick list of all groups, use this GET query:

 

https://graph.microsoft.com/v1.0/groups/?$select=displayName,id

 

...and copy the Group ID from the output as we did before with the User ID. Here it's 79744859...

 

Now we can add that User Id to the list of owners. Create a POST operation in Graph Explorer wit the address of the desired group as follows:

 

https://graph.microsoft.com/v1.0/groups/79744859-fb99-4a09-8b15-0f3a3d7bb117/owners/$ref

 

The Request body needs to contain the JSON data of our new owner (the user's address endpoint):

 

{"@odata.id": "https://graph.microsoft.com/v1.0/users/be2cab0f-1891-41d3-b153-ad15a62d68c9"}

 

This sets the owner of the new group to a specific user. We also need to add the owner as a member of the group. This is exactly the same method (the same JSON body with the same user), just the endpoint is members instead of owners:

 

https://graph.microsoft.com/v1.0/groups/79744859-fb99-4a09-8b15-0f3a3d7bb117/members/$ref

 

The owner now can fully manage the group container object.

Create a new Office 365 group with PowerShell

Of course, we can use PowerShell as well. First, we connect to Exchange Online.

 

Connect-MsolService -Credential $cred
$session = New-PSSession -ConfigurationName Microsoft.Exchange `
-ConnectionUri https://ps.outlook.com/powershell/ `
-Credential $cred -Authentication Basic -AllowRedirection
Import-PSSession $Session -AllowClobber

 

To see a list of all existing Office 365 groups, use Get-UnifiedGroup.

 

Now we can create a new group as described in https://technet.microsoft.com/en-us/library/mt219359%28v=exchg.160%29.aspx?f=255&MSPPError=-2147217396 . There are a bunch of possible options, but this basic syntax is sufficient for the new group:

 

New-UnifiedGroup -DisplayName "My Demo 2" -Alias "mydemo2" `
-PrimarySmtpAddress "mydemo2@M365x127892.onmicrosoft.com" `
-Owner "admin@M365x127892.onmicrosoft.com"

 

The group gets provisioned in the same way as before with the Microsoft Graph API.

Check it in Outlook

Open https://outlook.office.com/ and discover the modern groups. "My Demo 1" should show up in the list of Office 365 groups.

 

 

It worked! The mail nickname is the email address with the primary domain defined in that Office 365 tenant. The email address can be changed later with PowerShell. To do that, see the details at Why we moved away from Exchange distribution groups to Office 365 groups and "Setting custom email addresses for the Office 365 group".

 

 

Get an Office 365 group with Microsoft Graph

To access one specific group, we can filter that easily: To identify one group, the ID is added to the request. So you can get the ID from the Graph Explorer Request above.

 

 

So, in our case that's an operation as here:

 

https://graph.microsoft.com/v1.0/groups/35766673-5f6f-432c-b442-d9114e4ddf62

 

...and we get just this group.

 

Delete an Office 365 group

Now, deleting that specific group is easy. The HTTP operation is changed to DELETE.

 

When the query is executed, it delivers HTTP status code 204 (The server has successfully fulfilled the request and that there is no additional content to send in the response payload body).

 

The group has been deleted and should no longer be present in Outlook.

 

Deleted Office 365 groups are (nowadays) soft deleted. This means, you can undelete a group with the Active Directory Module and the PowerShell Cmdlet
Restore-AzureADMSDeletedDirectoryObject -Id <objectId>
as described in Restore a deleted Office 365 Group.

 

The choice is yours

As we have seen, you can use tools as CURL, Fiddler, Postman, PowerShell or similar or any other programming language as C# to manage Office 365 groups programmatically.

 

In part two, we develop the code for our planned automation.

In part one, we saw how the Microsoft Graph API enables programmatic access to Office 365 groups. Now it's time to let Azure Functions help us with the desired workflow.

 

For the following steps, an Azure subscription and a Global Admin in the target Office 365 tenant is required.

 

The plan

 

We want our provision group function to be able to create a new Office 365 group without any user interaction. So, we need an app with the permission to accomplish the operations in our Office 365 tenant, in the same way as did for the administrator account in part 1. The key is, to create such an application first and to use that access data in our code. The workflow will execute our function, pass the parameters, and the function will do the work. So, these are the necessary steps.

 

Create a new App

 

Open the Azure portal (in the target Office 365 tenant) with a Global Admin and click on the the "Azure Active Directory" service. Go to "App registrations". In here, click "New application registration".

 

 

...and fill out the new app "provisiongroupfunction" as Web app/API with a fake Sign-on URL as https://localhost:40000 (we won't need that) as follows:

 

 

After the app was created, go to "Keys".

 

 

Add a new key "clientSecret", make it valid for 1 year and click "Save". Keys can be generated for 1 year, 2 years or without any expiration date. If you chose an expiration (which is usually a good idea), you need to renew the key from time to time.

 

Now the key is generated. You will not get any access to that key later, so save the key value, best to your OneNote, Notepad or similar tool.

 

 

We also need the "Application ID" property: 516b...

 

 

And of course, we need to set the permissions: Go to "Required Permissions", select the "Microsoft Graph" and select "Application Permissions" for "Read and write all groups". "Save" the app permissions.

 

 

Select more permissions depending on the desired features of the function if needed. We're done with the app, but...

 

Get the tenant ID

..we need the "Tenant ID" as well. You get that in the "Properties" of the AAD with the "Directory-ID" property as shown here.

 

 

The Directory-ID d302... needs to go to our note. Now we're done with the AAD. So we have this data collected:

string tenantId = "d302f5cf-00b3-44af-aff1-2cf91673813d";
string clientId = "516b6d70-05e4-43a7-bab1-6fa2060b04fa";
string clientSecret = "IQBz/fSblC...";

 

Create the Azure function as a container

The idea is to use server-less technology to provision an Office 365 group. No worries, we won't need Visual Studio, Visual Studio Code (which BTW are great tools and highly recommended for larger code projects...) or any similar environment. We can perform all necessary steps online directly in the Azure Portal.

 

So, let's create the new Azure function and fill it out... We are working with loose coupled architecture, so we can use any Azure subscription which must not be associated with the Office 365 tenant. This approach allows to build "black boxes" and to tie them together as needed easily. In our case, we let the function run in another Azure subscription.

 

 

Of course, Azure functions are a wide topic with many details, but this article concentrates on the solution. To learn more about Azure functions, see here and the videos on channel9.

 

Use a programing language - PowerShell is good enough

In Azure functions, there are several programing languages supported. We could use C#, F#, Javascript or ... PowerShell. So, let's keep it simple and use PowerShell, so that IT-Admins who are familiar with PowerShell can easily follow and understand this sample. (In my GitHub repository, you find the solution in C# and in PowerShell) , So, we create a new Azure function of type "HttpTrigger - PowerShell" as here.

 

The function name shall be "ProvisionGroup". Let's create that with the default authorization level "Function" - we don't want to use a user authorization in our scenario.

 

 

...and we get the new function with some default code from a template. When clicking "Run", the function shows the basic concept with an HTTP POST operation, a JSON input and a text output as here:

 

 

 

Develop the function and configure it

The function needs to perform several operations. Keep in mind that Azure functions run in a sandbox, to be more specific, in an App service in a Virtual machine. You can use default functionality, but you need to take care if you need to integrate other libraries or modules that by default are not installed in the Windows environment. We don't have any dependencies in our sample. Currently, PowerShell version 4.0 is available.

 

Ok, we also need to store the app data somewhere. Instead of having these values in the code, it's more elegant (and safe) to save these as App Settings. In here, we need to add keys for the TenantID. the AppID and the AppSecret as here. The values must be inserted from the app we created above.

 

 

Now we're good to code...

 

The PowerShell code

Get the code from my GitHub repository Officde365scripts at https://github.com/martinagrom/Office365Scripts (directly here)  and paste it into the code window.

 

 

The functions reads two parameters from the HTTP body: groupname and upn. groupname is the name of the new group and since this is also the email address of the group, this must be compliant. upn is the login name of the group owner who shall be responsible for the group.

 

Then, it calls the Initialize-Authorization PowerShell function to authenticate with the app values from our AppSettings. If this works, we get an AccessToken that is stored in the global variable $script:APIHeader. This is the key we need to add to each Graph API operation. It must be sent in the HTTP header with the Bearer key name. So, this header is fully generated by the Initialize-Authorization function and can be added for each call.

 

Now back to the literal functionality. We need to do four operations:

1. Create the group and get back the GroupID
2. Get the UserID of the UPN passed as parameter
3. Add the UserID as owner of the group with the GroupID
4. Add the UserID as member of the group with the GroupID

Each request is sent as a HTTP POST operation with the PowerShell command $result = Invoke-RestMethod -Method Post and a JSON body as described in part 1. If the HTTP result of the operation is OK or Created, we know that the operation was successful and continue. In all cases, the function itself returns HTTP OK for not stopping the Flow (which will be described in part 3).

 

Test it

Add the parameters in the "Test" request body textbox.

{
"groupname":"DeathStar",
"upn":"admin@<mytenant>.onmicrosoft.com"
}

Now click "Run".

 

 

The group will now be created and the user will become owner of the new group. Check the mailbox of the owner. The new group will show up in the groups list as here.

 

 

So, if this function works, we get the address of the function.

 

Get the function endpoint

As last step in this part, we need to save the function URL to use it in the workflow. You get it with the" Get function URL" link as here:

 

 

Off to the flow...

After we created and tested the Azure function, we can finish this workflow in part 3.