#Microsoft Azure Sentinel (Preview) Overview #Azure #Sentinel #Security #Analytics #SIEM

 

Microsoft Azure Sentinel

Microsoft Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.

• Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.
• Detect previously undetected threats, and minimize false positives using Microsoft’s analytics and unparalleled threat intelligence.
• Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.
• Respond to incidents rapidly with built-in orchestration and automation of common tasks.

In the following step-by-step guide you get a global overview of Azure Sentinel :

Search for Azure Sentinel in the Azure Portal.

Click on Create

Connect or add your Workspace.

Click on Add Azure Sentinel

Azure Sentinel is added to your workspace.

Azure Sentinel Overview

Security Analytics

Learn here more with Microsoft Azure Monitor analytics queries

Here you can play with Azure Log Analytics 😉

Here you can collect all your Security Cases

Azure Sentinel Build-In Dashboard Solutions

Azure AD Audit Logs

 

Linux Machines Security

When you have your Azure Sentinel Solutions in place with alerting rules and telemetry and analytics is coming to your workspace, Hunting is the next Threat management tool :

Azure sentinel Hunting

Working with Tags and Collaborate with Teammates

Launch Investigations and Bookmark

Working with Azure Notebooks for Azure Sentinel

Welcome to the Azure Sentinel repository! This repository contains out of the box detections, exploration queries, hunting queries, dashboards and playbooks to help you get ramped up with Azure Sentinel and provide you security content to secure your environment and hunt for threats. You can also submit any issues or feature requests as you onboard to Azure Sentinel. For questions and feedback, please contact AzureSentinel@microsoft.com

Azure Sentinel Notebooks on GitHub

 

Get started from here to Configure your Azure Sentinel Environment

Choose your Data Collections for Azure Sentinel Security

Lot of Choice already Build-in for you.

From here you can make your own Azure Sentinel Analytics Alert Rules.

Alert Rules

Create Alert rules with the right mappings, triggers, and scheduling, response automation.

Add your own playbooks for your Security

Unlock the power of AI for security with Machine Learning

Machine Learning in Azure Sentinel is built-in right from the beginning. We have thoughtfully designed the system with ML innovations aimed to make security analysts, security data scientists and engineers productive. One such innovation is Azure Sentinel Fusion built especially to reduce alert fatigue.

Building your Full Screen Dashboard for Monitoring

More information about Azure Sentinel Intelligent Security :

Start here free with Azure Sentinel Preview

Microsoft azure Sentinel Docs

Microsoft Azure Sentinel on GitHub

Join Microsoft Azure Monitor & Security for Hybrid IT Community

 

Optimize Security and Compliancy with #Azure Security Center #ASC #Cloud #GDPR

Microsoft Azure Security Center

When you have your Hybrid Cloud Enterprise Design ready in a Microsoft HUB-Spoke model and your Security in place, you can do your optimize on your Azure workloads and keep up-to-date for your compliancy. Microsoft Azure Security Center can support you in Security and Compliancy (GDPR). Here you see my former blogposts about Microsoft Azure HUB-Spoke model architecture and Security by design :

1. Microsoft Azure Hub-Spoke model by Enterprise Design 1 of 4
2. Microsoft Azure Policy and BluePrints Overview (Extra Blogpost)
3. Microsoft Azure Hub-Spoke model by Enterprise Design 2 of 4 “Lift and Shift”
4. Microsoft Azure Hub-Spoke model by Enterprise Design 3 of 4 Data Migration
5. Managing and Working with Azure Network Security Groups (NSG) 

Security in software is always on the move and changing in this world, when you think you are ready something has changed already. That’s why I love Microsoft Azure Security Center to keep you posted and giving you advise on Security but also on Compliancy.

From here you see a high-level overview of these new possibilities in Microsoft Azure Security Center :

Security Center Overview

Microsoft Azure Security Center is working with the following navigation menu’s on the left :

• General
• Policy & Compliance
• Resource Security Hygiene
• Advanced Cloud Defense
• Threat Protection
• Automation & Orchestration

Microsoft Azure Secure Score Dashboard

Microsoft Azure Security Center is working with Overall Secure Score. In my Test LAB we have some work to do 😉
The Azure secure score reviews your security recommendations and prioritizes them for you, so you know which recommendations to perform first. This helps you find the most serious security vulnerabilities so you can prioritize investigation. Secure score is a tool that helps you assess your workload security posture.
Improve your secure score in Azure Security Center

Azure Security Center Recommendations

Microsoft Azure Security Center gives you advise to make your Security Score higher and you can improve immediately.

Open Subnet without NSG.

From here you can Enable a Network Security Group (NSG) on the Subnet and make your network more secure.

Creating NSG from Azure Security Center.

A subnet with NSG.

Azure Security Center Advise on Disk Encryption

1. Description on Applying Disk Encryption on your Virtual Machines
2. General Information, with Impact and Implementation Cost.
3. Threats, what can happen when you don’t implement the security.
4. Remediation Steps from Microsoft Azure Security Center
   Like this : Managing security recommendations in Azure Security Center

Security Center – Regulatory Compliance

I really like this feature in Azure Security Policy & Compliancy to help the business with GDPR and keep your Data Save by Security.

PCI DSS 3.2

ISO 27001

So now you can work on your Security and Compliance

SOC TSP

Here you find more information about Microsoft Azure Security Center

Microsoft Azure Security Center Playbooks

Integrate security solutions in Azure Security Center

 

Conclusion :

Security is a on-going process 24 hours -365 days to monitor, analyze, and prevent security issues. Working on Compliancy for your Business and making your own Security policies is important. Microsoft Azure Security Center can support you in this journey. When you Optimize your Azure workloads or make new solutions in Azure, keep it secure with Microsoft Azure Security Center.

Creating VM Cluster on Azure #Cloud with Terraform #IaC #Azure #Terraform #Linux #Winserv

Type az and you should see this Azure CLI

Type Terraform and you should see the terraform commands

 

Install and configure Terraform to provision VMs and other infrastructure into Azure

Before you begin with Terraform and deploying your solution to Microsoft Azure you have to install Azure CLI and Terraform for your OS.

In the following step-by-step guide we will deploy a VM Cluster with Terraform into Microsoft Azure Cloud Services.

First we open Powershell in Administrator mode :

You should have your Terraform script ready.

It’s great to edit your Terraform script in Visual Studio Code

Create a Terraform configuration file
In this section, you create a file that contains resource definitions for your infrastructure.
Create a new file named main.tf.
Copy following sample resource definitions into the newly created main.tf file:

---

resource “azurerm_resource_group” “test” {
name = “acctestrg”
location = “West US 2”
}

resource “azurerm_virtual_network” “test” {
name = “acctvn”
address_space = [“10.0.0.0/16”]
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”
}

resource “azurerm_subnet” “test” {
name = “acctsub”
resource_group_name = “${azurerm_resource_group.test.name}”
virtual_network_name = “${azurerm_virtual_network.test.name}”
address_prefix = “10.0.2.0/24”
}

resource “azurerm_public_ip” “test” {
name = “publicIPForLB”
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”
public_ip_address_allocation = “static”
}

resource “azurerm_lb” “test” {
name = “loadBalancer”
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”

frontend_ip_configuration {
name = “publicIPAddress”
public_ip_address_id = “${azurerm_public_ip.test.id}”
}
}

resource “azurerm_lb_backend_address_pool” “test” {
resource_group_name = “${azurerm_resource_group.test.name}”
loadbalancer_id = “${azurerm_lb.test.id}”
name = “BackEndAddressPool”
}

resource “azurerm_network_interface” “test” {
count = 2
name = “acctni${count.index}”
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”

ip_configuration {
name = “testConfiguration”
subnet_id = “${azurerm_subnet.test.id}”
private_ip_address_allocation = “dynamic”
load_balancer_backend_address_pools_ids = [“${azurerm_lb_backend_address_pool.test.id}”]
}
}

resource “azurerm_managed_disk” “test” {
count = 2
name = “datadisk_existing_${count.index}”
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”
storage_account_type = “Standard_LRS”
create_option = “Empty”
disk_size_gb = “1023”
}

resource “azurerm_availability_set” “avset” {
name = “avset”
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”
platform_fault_domain_count = 2
platform_update_domain_count = 2
managed = true
}

resource “azurerm_virtual_machine” “test” {
count = 2
name = “acctvm${count.index}”
location = “${azurerm_resource_group.test.location}”
availability_set_id = “${azurerm_availability_set.avset.id}”
resource_group_name = “${azurerm_resource_group.test.name}”
network_interface_ids = [“${element(azurerm_network_interface.test.*.id, count.index)}”]
vm_size = “Standard_DS1_v2”

# Uncomment this line to delete the OS disk automatically when deleting the VM
# delete_os_disk_on_termination = true

# Uncomment this line to delete the data disks automatically when deleting the VM
# delete_data_disks_on_termination = true

storage_image_reference {
publisher = “Canonical”
offer = “UbuntuServer”
sku = “16.04-LTS”
version = “latest”
}

storage_os_disk {
name = “myosdisk${count.index}”
caching = “ReadWrite”
create_option = “FromImage”
managed_disk_type = “Standard_LRS”
}

# Optional data disks
storage_data_disk {
name = “datadisk_new_${count.index}”
managed_disk_type = “Standard_LRS”
create_option = “Empty”
lun = 0
disk_size_gb = “1023”
}

storage_data_disk {
name = “${element(azurerm_managed_disk.test.*.name, count.index)}”
managed_disk_id = “${element(azurerm_managed_disk.test.*.id, count.index)}”
create_option = “Attach”
lun = 1
disk_size_gb = “${element(azurerm_managed_disk.test.*.disk_size_gb, count.index)}”
}

os_profile {
computer_name = “hostname”
admin_username = “testadmin”
admin_password = “Password1234!”
}

os_profile_linux_config {
disable_password_authentication = false
}

tags {
environment = “staging”
}
}

---

Type : terraform init

You should see this screen.

Type : az login

We now logging into Microsoft Azure subscription.

https://microsoft.com/devicelogin

Insert the code from your Powershell screen.

Now we have the Terraform INIT running and we are connected to our Azure Subscription 😉

Type : terraform plan

It will refreshing the state and getting ready for deployment.

Type : terraform apply

and then type : yes <enter>

Terraform is now creating the azure resources

Azure resource group acctestrg is made

Terraform deployment VM Cluster on Azure is Ready 😉

Azure VM Cluster is running.

When you want to remove the complete Azure VM Cluster with terraform, it’s really easy :

Type : terraform destroy

and then type : yes <enter>

Azure resources are being deleted via terraform script

Terraform destroyed the Azure VM Cluster

All Azure Resources of the VM Cluster are removed.

Hope this step-by-step guide deploying infrastructure as Code with terraform will help you with your own Cloud solutions in Microsoft azure.

Ps. don’t forget to install Visual Studio Code Azure Terraform extension and play !

#MVPbuzz

#Microsoft Azure #Security Center Standard for Hybrid Security #Azure #Cloud #SIEM

Azure Security Center Standard includes:

Hybrid security – Get a unified view of security across all of your on-premises and cloud workloads. Apply security policies and continuously assess the security of your hybrid cloud workloads to ensure compliance with security standards. Collect, search, and analyze security data from a variety of sources, including firewalls and other partner solutions.
Advanced threat detection – Use advanced analytics and the Microsoft Intelligent Security Graph to get an edge over evolving cyber-attacks. Leverage built-in behavioral analytics and machine learning to identify attacks and zero-day exploits. Monitor networks, machines, and cloud services for incoming attacks and post-breach activity. Streamline investigation with interactive tools and contextual threat intelligence.
Access and application controls – Block malware and other unwanted applications by applying whitelisting recommendations adapted to your specific workloads and powered by machine learning. Reduce the network attack surface with just-in-time, controlled access to management ports on Azure VMs, drastically reducing exposure to brute force and other network attacks.

To add On-premises Servers

When your workspace is added :

1. + Add Computers
2. Download the right agent for Windows or Linux
3. When you installed the agent you need the workspace ID and the key to finish the connection.
4. When your Server doesn’t have a Internet connection you can work with the OMS Gateway.

Connect computers without Internet access using the OMS Gateway

Here you see the 3 machines from On-Premises in Azure Security Center

Security Recommendations

Apply Azure Disk Encryption for example.

Azure Security Center Recommendations

Azure Security Center Overview
I have something to do in my Test LAB 😉

Here you find more Technical docs for Microsoft Azure Security Center 

Microsoft Intelligent Security Graph for Providers

Hope this information about Microsoft Intelligent Azure Security Center will help your Business to stay Secure.

Deploy #Azure WebApp with Visual Studio Code and Play with #Kudu and App Service Editor and #VSC

When you have installed Microsoft Visual Studio Code which is Free and Open Source with Git integration, Debugging and lot of Extensions available,
You activate the Microsoft Azure App Service extension in VSC.

Azure App Service Extension

You can install really easy more Azure Extensions here.

On the Left you will see your Azure Subscription and by pushing the + you will create a new Azure WebApp.

Enter the name of the Resource Group

Select your OS Windows or Linux

Add the Name of the New App Service Plan

Choose a App Service plan See more information here

Select Azure Region

After this it will install your Microsoft Azure Web App in the Cloud in a couple of seconds 🙂

 

When you open the Azure Portal you will see your App Service plan running.

From here you can configure your Azure Web App for Continues Delivery, and use different tools like VSC, Kudu or Azure App Service Editor.

Azure Web Apps enables you to build and host web applications in the programming language of your choice without managing infrastructure. It offers auto-scaling and high availability, supports both Windows and Linux, and enables automated deployments from GitHub, Visual Studio Team Services, or any Git repo.

Learn how to use Azure Web Apps with Microsoft quickstarts, tutorials, and samples.

Configure Continues Deployment from the Azure Portal.

Or
Continuous Deployment to Azure App Service

Developer tools from the Azure Portal with App Service Editor.

 

Azure App Services Editor

From here you can open Kudu to manage your Azure Web App and Debug via Console :

Kudu Debug console in CMD

Or Kudu Debug Console in Powershell 😉

Kudu Process Explorer

Here you find more information about Kudu for your Azure Web App on GitHub

And to come back at Microsoft Visual Studio Code, you can manage and Build your Azure Web App from here too :

Azure Web App Services in VSC

Hope this first step by step Guide is useful for you to start with Microsoft Azure Web App and Visual Studio Code to make your Pipeline.
More Information at Visual Studio Code

Azure Web Apps Overview

What is New in Microsoft System Center version 1801 #Sysctr #SCOM #SCVMM #SCDPM

What is New in Microsoft System Center Virtual Machine Manager version 1801 ?

• Nested virtualization
• Migration of VMware VM (EFI firmware-based VM) to Hyper-V VM
• Performance improvement in host refresher
• Enhanced console session in VMM

Networking :

• Configuration of guest clusters in SDN through VMM
• Configuration of SLB VIPs through VMM service templates
• Configuration of encrypted VM networks through VMM

Security :

• Support to Linux shielded VM
• Configuration of fallback HGS

Azure Integration :

• Management of ARM-based and region-specific Azure subscriptions

SCVMM 1801 supports management of ARM-based VMs, Azure Active Directory (AD) based authentication that is created by using the new Azure portal and region-specific Azure subscriptions (namely, Germany, China, US Government Azure regions).

Download here System Center Virtual Machine Manager version 1801 VHD

What is New in System Center Data Protection Manager version 1801 ?

The following features are either new to DPM, or are improved for DPM 2016.

Modern Backup Storage – Using Resilient File System (ReFS) block-cloning technology to store incremental backups, DPM 2016 dramatically improves storage utilization and performance. The storage consumed by backups grows and shrinks with the production data source, and there is no over-allocation of storage.
Resilient change tracking (RCT) – DPM uses RCT (the native change tracking in Hyper-V), which removes the need for time-consuming consistency checks. RCT provides better resiliency than the change tracking provided by VSS snapshot-based backups. DPM also uses RCT for incremental backup. It identifies VHD changes for virtual machines, and transfers only those blocks that are indicated by the change tracker.
Continued protection during cluster aware updates – Windows Server 2016 comes with the cluster OS rolling update, where a cluster can be upgraded to Windows Server 2016 without bringing it down. DPM 2016 continues to protect VMs during the upgrade, maintaining the backup service level agreement (SLA).
Shielded VM Backups – Shielded VMs in Windows Server 2016 help protect sensitive VMs from inspection, tampering, and data theft by malware and malicious administrators. DPM 2016 backups retain the protections provided by shielded VMs to ensure they can be recovered seamlessly and securely.
Hyper-V with Storage Spaces Direct – DPM recognizes and protects Hyper-V VMs deployed on Storage Spaces Direct, delivering seamless backup and recovery of VMs in disaggregated and hyper-converged scenarios.
Hyper-V with ReFS SOFS Cluster – DPM 2016 can back up Hyper-V VMs deployed on ReFS-based SOFS clusters. Backup and recovery of RCT-based VMs and non-RCT VMs is supported.
Upgrading a DPM production server to 2016 doesn’t require a reboot – When you upgrade to DPM 2016, you are not required to reboot the production server. To avoid rebooting the production server, upgrade to DPM 2016 and upgrade the DPM agent on the production servers. Backups continue and you reboot the production server when you want.

DPM to Azure Backup Vault.

Download here System Center Data Protection Manager version 1801 VHD

What is New in System Center Operations Manager version 1801 ?

• Enter product key from the Operation Console
• Linux monitoring
• Improved HTML5 dashboarding experience
• System Center Visual Studio Authoring Extension (VSAE) support for Visual Studio 2017
• Enhanced SDK Client performance
• Updates and recommendations for third-party Management Packs
• Linux Kerberos support
• Service Map integration

Microsoft Service Map automatically discovers application components on Windows and Linux systems and maps the communication between services. It automatically builds a common reference map of dependencies across your servers, processes, and third-party services. Integration between Service Map and System Center Operations Manager allows you to automatically create distributed application diagrams in Operations Manager that are based on the dynamic dependency maps in Service Map.

The Microsoft System Center Operations Manager Team published a great blogpost on the New SCOM Web Console version 1801

Download here System Center Operations Manager version 1801 VHD

Download here System Center Orchestrator version 1801 VHD

Download here System Center Service Manager version 1801 VHD

 

Here you find more information about System Center version 1801

Test today the new features of System Center version 1801 with the Evaluation VHD’s 😉

What’s New in Windows Server 2016 version 1709 #Winserv #Hyperv #Containers

Application containers and micro-services

• The Server Core container image has been further optimized for lift-and-shift scenarios where you can migrate existing code bases or applications into containers with minimal changes, and it’s also 60% smaller.
• The Nano Server container image is nearly 80% smaller.
  • In the Windows Server Semi-Annual Channel, Nano Server as a container base OS image is decreased from 390 MB to 80 MB.
• Linux containers with Hyper-V isolation

For more information, see Changes to Nano Server in the next release of Windows Server and Windows Server, version 1709 for developers.

Modern management

Check out Project Honolulu for a simplified, integrated, secure experience to help IT administrators manage core troubleshooting, configuration, and maintenance scenarios. Project Honolulu includes next generation tooling with a simplified, integrated, secure, and extensible interface. Project Honolulu includes an intuitive all-new management experience for managing PCs, Windows servers, Failover Clusters, as well as hyper-converged infrastructure based on Storage Spaces Direct, reducing operational costs.

Compute

Nano Container and Server Core Container: First and foremost, this release is about driving application innovation. Nano Server, or Nano as Host is deprecated and replaced by Nano Container, which is Nano running as a container image.

For more information about containers, see Container Networking Overview.

Server Core as a container (and infrastructure) host, provides better flexibility, density and performance for existing applications under a modernization process and brands new apps developed already using the cloud model.

VM Load Balancing is also improved with OS and Application awareness, ensuring optimal load balancing and application performance. Storage-class memory support for VMs enables NTFS-formatted direct access volumes to be created on non-volatile DIMMs and exposed to Hyper-V VMs. This enables Hyper-V VMs to leverage the low-latency performance benefits of storage-class memory devices.

Storage-class memory support for VMs enables NTFS-formatted direct access volumes to be created on non-volatile DIMMs and exposed to Hyper-V VMs. This enables Hyper-V VMs to leverage the low-latency performance benefits of storage-class memory devices. Virtualized Persistent Memory (vPMEM) is enabled by creating a VHD file (.vhdpmem) on a direct access volume on a host, adding a vPMEM Controller to a VM, and adding the created device (.vhdpmem) to a VM. Using vhdpmem files on direct access volumes on a host to back vPMEM enables allocation flexibility and leverages a familiar management model for adding disks to VMs.

Virtualized Persistent Memory (vPMEM) is enabled by creating a VHD file (.vhdpmem) on a direct access volume on a host, adding a vPMEM Controller to a VM, and adding the created device (.vhdpmem) to a VM. Using vhdpmem files on direct access volumes on a host to back vPMEM enables allocation flexibility and leverages a familiar management model for adding disks to VMs.

Container storage – persistent data volumes on cluster shared volumes (CSV). In Windows Server, version 1709 as well as Windows Server 2016 with the latest updates, we’ve added support for containers to access persistent data volumes located on CSVs, including CSVs on Storage Spaces Direct. This gives the application container persistent access to the volume no matter which cluster node the container instance is running on. For more info, see Container Storage Support with Cluster Shared Volumes (CSV), Storage Spaces Direct (S2D), SMB Global Mapping.

Container storage – persistent data volumes with SMB global mapping. In Windows Server, version 1709 we’ve added support for mapping an SMB file share to a drive letter inside a container – this is called SMB global mapping. This mapped drive is then accessible to all users on the local server so that container I/O on the data volume can go through the mounted drive to the underlying file share. For more info, see Container Storage Support with Cluster Shared Volumes (CSV), Storage Spaces Direct (S2D), SMB Global Mapping.

Security and Assurance

Windows security baselines have been updated for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings and explains their security impact. For more information, and to download the Policy Analyzer tool, see Microsoft Security Compliance Toolkit 1.0.

Network encryption enables you to quickly encrypt network segments on software-defined networking infrastructure to meet security and compliance needs.

Host Guardian Service (HGS) as a shielded VM is enabled. Prior to this release, the recommendation was to deploy a 3-node physical cluster. While this ensures the HGS environment is not compromised by an administrator, it was often cost prohibitive.

Linux as a shielded VM is now supported.

For more information, see Guarded fabric and shielded VMs overview.

Storage

Storage Replica: The disaster recovery protection added by Storage Replica in Windows Server 2016 is now expanded to include:

• Test failover: the option to mount the destination storage is now possible through the test failover feature. You can mount a snapshot of the replicated storage on destination nodes temporarily for testing or backup purposes. For more information, see Frequently Asked Questions about Storage Replica.
• Project Honolulu support: Support for graphical management of server to server replication is now available in Project Honolulu. This removes the requirement to use PowerShell to manage a common disaster protection workload.

 

SMB:

• SMB1 and guest authentication removal: Windows Server, version 1709 no longer installs the SMB1 client and server by default. Additionally, the ability to authenticate as a guest in SMB2 and later is off by default. For more information, review SMBv1 is not installed by default in Windows 10, version 1709 and Windows Server, version 1709.
• SMB2/SMB3 security and compatibility: Additional options for security and application compatibility were added, including the ability to disable oplocks in SMB2 for legacy applications, as well as require signing or encryption on per-connection basis from a client. For more information, review the SMBShare PowerShell module help.

 

Data Deduplication:

• Data Deduplication now supports ReFS: You no longer must choose between the advantages of a modern file system with ReFS and the Data Deduplication: now, you can enable Data Deduplication wherever you can enable ReFS. Increase storage efficiency by upwards of 95% with ReFS.
• DataPort API for optimized ingress/egress to deduplicated volumes: Developers can now take advantage of the knowledge Data Deduplication has about how to store data efficiently to move data between volumes, servers, and clusters efficiently.

Remote Desktop Services (RDS)

RDS is integrated with Azure AD, so customers can leverage Conditional Access policies, Multifactor Authentication, Integrated authentication with other SaaS Apps using Azure AD, and many more. For more information, see Integrate Azure AD Domain Services with your RDS deployment.

For a sneak peek at other exciting changes coming to RDS, see Remote Desktop Services: Updates & upcoming innovations

Networking

Docker’s Routing Mesh is supported. Ingress routing mesh is part of swarm mode, Docker’s built-in orchestration solution for containers. For more information, see Docker’s routing mesh available with Windows Server version 1709.

New features for Docker are available. For more information, see Exciting new things for Docker with Windows Server 1709.

Windows Networking at Parity with Linux for Kubernetes: Windows is now on par with Linux in terms of networking. Customers can deploy mixed-OS, Kubernetes clusters in any environment including Azure, on-premises, and on 3rd-party cloud stacks with the same network primitives and topologies supported on Linux without the need for any workarounds or switch extensions.

Core network stack: Several features of the core network stack are improved. For more information about these features, see Core Network Stack Features in the Creators Update for Windows 10.

• TCP Fast Open (TFO): Support for TFO has been added to optimize the TCP 3-way handshake process. TFO establishes a secure TFO cookie in the first connection using a standard 3-way handshake. Subsequent connections to the same server use the TFO cookie instead of a 3-way handshake to connect with zero round trip time.
• CUBIC: Experimental Windows native implementation of CUBIC, a TCP congestion control algorithm is available. The following commands enable or disable CUBIC, respectively.

netsh int tcp set supplemental template=internet congestionprovider=cubic

netsh int tcp set supplemental template=internet congestionprovider=compound

• Receive Window Autotuning: TCP autotuning logic computes the “receive window” parameter of a TCP connection. High speed and/or long delay connections need this algorithm to achieve good performance characteristics. In this release, the algorithm is modified to use a step function to converge on the maximum receive window value for a given connection.
• TCP stats API: A new API is introduced called SIO_TCP_INFO. SIO_TCP_INFO allows developers to query rich information on individual TCP connections using a socket option.
• IPv6: There are multiple improvements in IPv6 in this release.
  • RFC 6106 support: RFC 6106 which allows for DNS configuration through router advertisements (RAs). You can use the following command to enable or disable RFC 6106 support:

netsh int ipv6 set interface <ifindex> rabaseddnsconfig=<enabled | disabled>

• Flow Labels: Beginning with the Creators Update, outbound TCP and UDP packets over IPv6 have this field set to a hash of the 5-tuple (Src IP, Dst IP, Src Port, Dst Port). This will make IPv6 only datacenters doing load balancing or flow classification more efficient. To enable flowlabels:

netsh int ipv6 set flowlabel=[disabled|enabled] (enabled by default)

netsh int ipv6 set global flowlabel=<enabled | disabled>

• ISATAP and 6to4: As a step towards future deprecation, the Creators Update will have these technologies disabled by default.

• Dead Gateway Detection (DGD): The DGD algorithm automatically transitions connections over to another gateway when the current gateway is unreachable. In this release, the algorithm is improved to periodically re-probe the network environment.
• Test-NetConnection is a built-in cmdlet in Windows PowerShell that performs a variety of network diagnostics. In this release we have enhanced the cmdlet to provide detailed information about both route selection as well as source address selection.

Software Defined Networking

• Virtual Network Encryption is a new feature that provides the ability for the virtual network traffic to be encrypted between Virtual Machines that communicate with each other within subnets that are marked as “Encryption Enabled”. This feature utilizes Datagram Transport Layer Security (DTLS) on the virtual subnet to encrypt the packets. DTLS provides protection against eavesdropping, tampering and forgery by anyone with access to the physical network.

Windows 10 VPN

• Pre-Logon Infrastructure Tunnels. By default, Windows 10 VPN does not automatically create Infrastructure Tunnels when users are not logged on to their computer or device. You can configure Windows 10 VPN to automatically create Pre-Logon Infrastructure Tunnels by using the Device Tunnel (prelogon) feature in the VPN profile.
• Management of Remote Computers and Devices. You can manage Windows 10 VPN clients by configuring the Device Tunnel (prelogon) feature in the VPN profile. In addition, you must configure the VPN connection to dynamically register the IP addresses that are assigned to the VPN interface with internal DNS services.
• Specify Pre-Logon Gateways. You can specify Pre-Logon Gateways with the Device Tunnel (prelogon) feature in the VPN profile, combined with traffic filters to control which management systems on the corporate network are accessible via the device tunnel.

Release Notes: Important Issues in Windows Server, version 1709