Wake on LAN in ConfigMgr 1810 and 802.1x authentication

I recently carried out some testing on the new Wake on LAN feature of ConfigMgr 1810 and published the result in this blog post. One of the things I pointed out was that the feature was not supported using 802.1x authentication. I wondered why so I carried out some additional research.

As with all Microsoft support statements, just because something is not supported doesn't mean that it will not work. It's either untested or will not work in all scenarios. This is the case with WoL and 802.1x authentication.

802.1x is a standard for port-based network access control that provides authenticated network access to 802.11 wireless networks and wired Ethernet networks. Port-based network access control uses the physical characteristics of a switched LAN infrastructure to authenticate devices that are attached to a LAN port and to prevent access to that port in cases where the authentication process fails. One of the features of 802.1x is that devices are quarantined when they are turned off. Therefore the switch ports becomes blocked in both directions and prevents the WoL magic packet from being delivered - a chicken and egg situation. 

I figured that this couldn't a new problem and that it would be possible to overcome this in the enterprise. I was right. I researched the main networking vendors and found that they had solutions.

Cisco

The 802.1X authentication with Wake-on-LAN (WoL) feature solves the problem. When a host that uses WoL is attached through an 802.1X port and the host powers off, the 802.1X port becomes unauthorized. The port can only receive and send EAPOL packets, and WoL magic packets cannot reach the host. When the PC is powered off, it is not authorized, and the switch port is not opened.

When the switch uses 802.1X authentication with WoL, the switch forwards traffic to unauthorized 802.1X ports, including magic packets. While the port is unauthorized, the switch continues to block ingress traffic other than EAPOL packets. The host can receive packets but cannot send packets to other devices in the network. 

• When you configure a port as unidirectional by using the dot1x control-direction in interface configuration command, the port changes to the spanning-tree forwarding state. The port can send packets to the host but cannot receive packets from the host. 
• When you configure a port as bidirectional by using the dot1x control-direction both interface configuration command, the port is access-controlled in both directions. The port does not receive packets from or send packets to the host.

Note: If PortFast is not enabled on the port, the port is forced to the bidirectional state.

https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-wake-lan-supp.html

HP

The aaa port-access controlled-direction in command allows Wake-on-LAN traffic to be transmitted on an 802.1X-aware egress port that has not yet transitioned to the 802.1X authenticated state; the controlled-direction both setting prevents Wake-on-LAN traffic to be transmitted on an 802.1X-aware egress port until authentication occurs.

Note: Although the controlled-direction in setting allows Wake-on-LAN traffic to traverse the switch through unauthenticated 802.1X-aware egress ports, it does not guarantee that the Wake-on-LAN packets will arrive at their destination. For example, firewall rules on other network devices and VLAN rules may prevent these packets from traversing the network.

http://h22208.www2.hpe.com/eginfolib/networking/docs/switches/WB/15-18/5998-8152_wb_2920_asg/content/ch13s05.html

Aruba Networks (not Procurve)

In Aruba AOS (not Procurve) there is a MAC pinning feature which basically adds a static MAC address to the port and associates it to the authentication as a pinned-MAC. All traffic to that MAC address would be pre-authenticated and anything else would need to be authenticated.

Summary

For enterprise grade edge switches I would expect a solution for this problem. You may not be so lucky with low end switches and your mileage may vary. That's why this solution is not officially supported by Microsoft.  
 
I hope this helps. Until next time.......

My second book

I am very pleased to be co-author for the latest book in the System Center Configuration Manager Unleashed series (published by Sams). The book is titled  "System Center Configuration Manager Current Branch Unleashed".

The author list is:

• Kerrie Meyler (MVP) (Co-author)
• Greg Ramsey (MVP) (Co-author)
• Kenneth van Surksum (MVP) (Co-author)
• Michael Wiles (Dell) (Co-author)
• Gerry Hampson (MVP) (Co-author)
• Saud Al-Mishari (Microsoft) (Co-author)
• Garth Jones (MVP) (Contributing author)
• Byron Holt (MVP) (Contributing author)

The chapter list is as follows:

1. Configuration Management Basics
2. Configuration Manager Overview
3. Looking Inside Configuration Manager
4. Architecture Design Planning
5. Network Design
6. Installing System Center Configuration Manager
7. Migrating to System Center Configuration Manager
8. Using the Configuration Manager Console
9. Client Management
10. Managing Compliance
11. Creating and Managing Applications and Deployment Types
12. Creating and Managing Packages and Programs
13. Distributing and Deploying Applications and Packages
14. Managing Software Updates
15. Integrating Intune Hybrid into Your Configuration Manager Environment
16. Managing Mobile Devices
17. Conditional Access
18. Endpoint Protection
19. Configuration Manager Queries
20. Configuration Manager Reporting
21. Operating System Deployment
22. Security and Delegation in Configuration Manager
23. Backup, Recovery, and Maintenance

Writing a book can be a very time-consuming process. However I've submitted my four chapters ahead of schedule after several re-writes (Kerrie is a tough taskmaster). The chapters will then undergo technical and editorial reviews (probably more re-writes). The book is scheduled to be published in early 2017 and will be available on Amazon.

Currently it is available for pre-order

Azure RMS and SharePoint Online

EMS Landing page

Have a look a this document which describes in detail how to configure Information Rights Management for SharePoint Online.

Set up Information Rights Management (IRM) in SharePoint admin center

Sign in to the Office 365 Admin Center

http://portal.microsoftonline.com

 

Choose Admin > SharePoint. You’re now in the SharePoint admin center.

Choose Settings. On the Settings page, in the Information Rights Management (IRM) section, choose "Use the IRM service specified in your configuration".

Then choose Refresh IRM Settings.

Go to the list or library for which you want to configure IRM.

On the ribbon, click the Library tab, and then click Library Settings (If you are working in a list, click the List tab, and then click List Settings).

Under Permissions and Management, click Information Rights Management.

On the Information Rights Management Settings page, select the "Restrict permission to documents in this library on download" check box.

To apply additional restrictions to the documents in this list or library, click Show Options.

That's it. You have now configured Information Rights Management to protect SharePoint Online documents - simple.

 

RMS Protection Tool

EMS Landing page

Have a look at the RMS Protection Tool which was announced as generally available this week. See the announcement here 

"The RMS Protection Tool contains PowerShell Cmdlets designed for developers and IT professionals who want to use scripting mechanisms to bulk protect and unprotect documents".

With this release, you can do the following:

• Use admin-defined templates and ad-hoc policies to protect documents.
• Protect documents of any type - Office file formats, PDFs, text, images, and generic file protection.
• Use the Cmdlets on Azure RMS and on-premises AD RMS.
• Service-to-service authentication for Azure RMS scenarios - for server workloads, it is important that the application is authenticated silently, which can be achieved using these Cmdlets.

Download the tool from:

https://www.microsoft.com/en-us/download/details.aspx?id=47256

The download includes x86 and x64 installers and a PDF file explaining the PoSH cmdlets.

Prerequisites
.Net 3.5
AD RMS Client 2.1

Now run the appropriate installer for the tool and the cmdlets are installed under the module "RMSProtection". Get-Help gets you further information on each cmdlet.

The available cmdlets are as follows:

Get-RMSFileStatus (returns RMS protection status of the specified file or files)

Get-RMSServer (returns the list of all AD RMS servers that can issue templates for the user)
  
Get-RMSTemplate (returns a list of AD RMS templates)

New-RMSProtectionLIcense (creates and returns a new ad-hoc license from scratch. The license object returned can be used by Protect-RMSFile to encrypt a file or files)

Protect-RMSFile (protects using RMS encryption the specified file or the files in a specified folder)

Unprotect-RMSFile (unprotects using RMS encryption the specified file or the files in a specified folder)

Get-RMSServerAuthentication (gets the status of the S2S credentials - shows the credentials previously set by Set-RMSServerAuthentication)

Set-RMSServerAuthentication (sets the status of the S2S credentials)


 

 

An Overview of Azure RMS including custom templates

EMS Landing page

Simon May presented an excellent Microsoft Virtual Academy session yesterday. The session described and demonstrated Azure Rights Management Services. You can find the video in the Enterprise Mobility Core Skills section.

Azure Rights Management Services Core Skills Jump Start
 
The following areas were discussed:

• Activating Azure RMS
• Protecting the files your users share
• Tacking and revoking usage of protected files
• Building and managing templates
• Integrating with on-premises services

This is the Microsoft description of that particular session:

Learn how to protect your organization's data with Azure Rights Management Services (RMS), and share securely inside and outside your organization. Plus, find out why information protection is a 100-percent "must have" for your organization, and get hands-on experience and technical know-how from Microsoft experts. 

Azure RMS looks like a really exciting technology. Have a look at some TechNet Library documents for some RMS details.

What is RMS

Activating RMS
 
As soon as the service is activated, you have two default templates that administrators and users can select to quickly and easily apply information protection to files. But you can also create your own custom templates for additional options and settings.

After I watched the session I dived right in to test the technology and it's really cool. Let's see what it looks like. It's so easy to configure and use. I've separated this blog into the following sections:

• Activate RMS
• Assign Licenses to user
• Create RMS template
• Use RMS template to protect email 

Activate RMS

Launch your Azure Portal and open Azure Active Directory.

Select "Rights Management".

Select "Activate". I have already Activated in the screenshot above. Note that you can also "deactivate" RMS if you wish. You are now ready to assign RMS licenses to users.


Assign RMS Licenses to users

There are two ways to do this.

Assign licenses associated with your Office 365 subscription...... or.....

......you can assign your Enterprise Mobility Suite (EMS licenses). Just drill into the EMS license.....

.....and add the required users.


Create RMS Template

OK. let's get started. Open Rights Management again and select your organization.

 The "Getting Started with Rights Management" wizard is launched. Choose to create a new template.

Choose your language and enter a name and description.

The template has been created. Now choose to "Manage templates". 

See the default templates and the custom template that we created. Select the new template for configuration.

Choose "Configure rights for users and groups".

Click "Get Started Now".

Select the users or groups that will be allowed to use the template. Note that Groups must be mail-enabled to be available for selection.

I've chosen some test users.

Now we must assign the required RMS rights to our users. You can choose one of the pre-configured roles (or create a custom role) 

Viewer: View, Reply, Reply All

Reviewer: View, Edit, Reply, Reply All, Forward

Co-Author: View, Edit, Copy, Print, Reply, Reply All, Forward

Co-Owner: All Rights

Custom: Assign Right Individually

I've chosen Custom this time as I want to see how securely I can send emails. 

I've chosen the very minimum here. I just want the recipient to be able to "View Content".

Now select Configure so that we can publish the template. Click to Publish.

We can configure other options like "Content Expiration" and "Offline Access".

 

The template status is now "Published". We're not quite finished yet. I have to refresh the templates so that my users can see them. I'm testing with Outlook Web App so I need to use PowerShell.

 

Launch Azure PowerShell and connect to your subscription. Execute the following command to refresh the templates:
  

Import-RMSTrustedPublishingDomain -Name "RMS Online - 1" -RefreshTemplates -RMSOnline 

Verify that the template has been added:

Get-RMSTemplate -TrustedPublishingDomain "RMS Online - 1" -Type All

Finally, for each imported template that you want to be available in the Outlook Web App, you must use the Set-RMSTemplate cmdlet and set the Type to Distributed

Set-RMSTemplate -Identity "<name of the template>" -Type Distributed 

To refresh templates for Office 2013 users: 

Office 2013 refreshes templates every 7 days by default. You can speed that up by using a registry editor and deleting the data for the LastUpdatedTime value 

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\MSIPC\<MicrosoftRMS_FQDN>\Template 

Restart your Office applications

Users will see new template immediately. 

To refresh templates for Office 2010 users: 

Just log off and back on again.

Use RMS template to protect email.

Now we come to the business end. What is the experience like for users?

A user creates a new email and chooses Options > Set Permissions. See all the available templates (including my custom template).

I've chosen the custom template and the email can be sent.

The recipient gets the email and can only view the content. This is really cool and highly secure. Note that any attachments would be "rights protected" also. Test some scenarios and see what you think.

Remember that I was testing here using Exchange Online. If you use Exchange On-premise you must install the RMS Connector. I'll be reviewing that shortly.

In my next blog I'll be having a look at the RMS Sharing App and RMS Document Tracking.

Azure RMS Sharing App & RMS Document Tracking

EMS Landing page

In the last blog we looked at Azure RMS and how it can be used to protect emails. We saw an example of a "rights protected" email using Outlook Web App. However the solution is only supported using Microsoft email clients. What happens if we want to send an email to a colleague and they wish to open that protected email on an Android or iOS device. Enter the Azure RMS Sharing App. Microsoft released the RMS Sharing App at the end of 2014. The announcement was made in the Official RMS Team Blog. You can read that article here

This is an extract: 

"First, we know that you desire built-in support for RMS into Microsoft Office on all platforms. We currently support RMS in Office 2010, Office 2013, and Office 365 but lack comprehensive support on other platforms.

We’ve come up with a way of supporting the sharing of secured Office documents in advance of the native Office support. We’ve done so via the RMS application’s Share Protected button. When you invoke Share Protected to share Office documents we send your email recipients both an RMS protected version of the Office document and a protected PDF copy of the same file. 

The Share Protected button is added to Outlook, Word, Excel, and PowerPoint (v2010 and 2013) when you install the RMS app for Windows"

So how does this work. Download the App from the Microsoft Download Center

http://www.microsoft.com/en-ie/download/details.aspx?id=40857  

Install the App.

The installation requires a restart.

See the new "RMS Share Protected" button in Outlook. Create an email and click on the Share Protected button.

Log in using your Azure credentials (essentially your email address) so that your RMS license rights can be verified.

Choose the RMS rights. 

See the other configurable options:

• Set expiration date
• Email notification when someone opens the attached document
• Allow revoking of the document

The mail is then RMS protected. See that we now have two attachments - a protected Word document as normal and also a protected PDF document which can be opened on any device. Send the email..........

......and you get an immediate notification with a link to the RMS Document Tracking Site. Unfortunately this link doesn't work for me yet as it is currently just available in North America. When the site is available I will be able to track the document to see who has opened it and when. I will also be able to revoke the document at any time.

I will also be able to access the Document Tracking site from here.

The recipient receives the email. See that Word Online is not supported.

The recipient tries another app (Word in this case) and is given instructions on how to access the document. The user should select "Download" to install their version of the RMS Sharing App.

The recipient logs into the RMS Site........

....and is prompted to select and install the correct version of the app for their device. They can now open the document (I have no screenshots of this as they are disabled by RMS).

Finally I get an email to tell me that the recipient has opened the mail (with a link to the Document Tracking Site). 

This app is seriously cool.