Category Data Protection Manager

Backup Strategy should include Security

Planning for protection as a part of an IT Service Continuity plan often takes into consideration backup of applications and data as well as restore. But what about security?

When planning for protection of applications and data in your environment security should right up there in the forefront. “Backup Security” should be a key part of the plan.

Security in the context of backup can be thought of #1 as securing the backups, and #2 backups being used as an added measure for security breach mitigation. Let me break this down further.

In regards to securing backups you want to do things like encrypt backup data as it travels offsite, encrypting backup data at rest, being able to protect encrypted data, requiring security pins or further authentication of admins and more.

In regards to backup as an added measure for security backup becomes a direct part of Security planning in organizations. Sometimes when security measures fail backups are the only thing that can save you as a last resort. Backups are commonly becoming a way to recover from ransomware attacks as an alternative to paying the hackers. Here is a real world example.

Recently an unnamed hosting providers entire data center became hostage to a ransomware attack. This hacker got in due to a mistake of one of the system admins (more on how to protect at this level later) and basically had full domain admin rights to everything. Keep in mind majority of the servers in this scenario are for customers.

In this case the hosting provider had two choices. Option #1 go to the dark web via a tor network and pay a ton of money in bitcoin for the decryption key. Option #2 Restore everything from offsite backups and pray.

This hosting provider went for option #2 and thank goodness it worked. In this case if it weren’t for a solid offsite backup solution this hosting provider would have been up a creek without a paddle.

It is becoming more common that ransomeware will actually target backups because these are a high target and hackers understand this is a last resort for companies to save themselves. If the backups are deleted there is no other choice but to pay the ransom. This raises the security level of the backups. Administrative actions on backups need an extra layer of security.

Microsoft Business Continuity products help with not only protection but also security. These products consist of System Centers Data Protection Manager (DPM) and Operations Management Suites Azure Backup (AB) and Azure Site Recovery (ASR). In this post I am only going to touch on DPM and AB.

Some exciting things have been happening with Azure Backup and Data Protection Manager to ensure security is front and center as a part of your enterprise backup solution. Microsoft’s goal with the backup security is to provide prevention, alerting, and recovery.

More about this including a video can be found here:
https://azure.microsoft.com/en-us/blog/azure-backup-security-feature

Just yesterday DPM update rollup 12 for 2012 and update rollup 2 for 2016 was announced. Along with UR2 comes some enhanced security features for DPM. These will be called out later in this blog post. Microsoft has rolled out some great security features to both across hybrid clouds. I will go ahead and break these down.

– Azure Backup –

Encrypted backup data at rest
Described in DPM section.

Security PIN
With Azure Backup you can require a security pin for sensitive operations such as removing protection, deleting data, or changing other settings in Azure Backup itself such as changing a Passphrase.

Azure Backup also has some other security measures in place like a minimum retention range to ensure a certain amount of backup data is always available and notifications upon critical operations to subscription admins or others as specified.

NOTE: These security features are now also available in DPM with the UR’s (UR 12 for 2012 and UR2 for 2016) announced yesterday. When an administrator changes the passphrase, or delete backup data, you need to enter the PIN if you have Enhanced Security Enabled. Also, there is a minimum retention range of 14 days for cloud protected data that is deleted.

MFA
MFA is Multi-Factor Authentication. Microsoft has MFA available as a part of Azure Active Directory. Within Azure Backup you can configure it to require MFA of admins when performing critical operations. By enabling MFA you would then ensure via authentication from a second device usually physical to the user that they are who they say they are.

NOTE: When you enable security settings they cannot be disabled.

Ransomware attacks
Described in DPM section.

– Data Protection Manager –

Backup data encrypted during offsite transfer
When data is sent from DPM to Azure Backup it is encrypted before it even leaves your four walls. Data is encrypted on the on-premises server/client/SCDPM machine using AES256 and the data is sent over a secure HTTPS link.

Encrypted backup data at rest
Once backup data is on Azure it is encrypted at rest. Microsoft does not decrypt the backup data at any point. The customer is the only one with the encryption key that can decrypt the backup data. If this key is lost not even Microsoft can decrypt your backup data. This is very secure.

Protection and recovery of encrypted computers
The release of Hyper-V on Windows Server 2016 included a new feature known as Shielded virtual machines (VM’s). This feature essentially utilizes Virtual Trusted Platform Module (vTPM) technology and BitLocker to encrypt a VM to encrypt virtual machines at the virtual layer. This means if a VM is physically copied off a Hyper-V host whoever has the VM will not be able to get to the data on the virtual hard drive.

With the release of DPM 2016 it supports protecting Shielded VM’s. DPM can protect Shielded VM’s regardless if they are VHD or VHDX. This is great news because as a secure organization you should want to encrypt your virtual machines and DPM can protect them. This gives you an added layer of security on top of having backups.

Ransomware attacks
In today’s world ransomware attacks are a common thing. These type of attacks are targeted at small, medium, and large enterprise businesses. No company is too small or too big to be put in the crosshairs of ransomware attacks. A well-known attack is Cryptolocker.

As mentioned before in this blog post backups are an alternative to paying the ransom of a ransomware attack. They key here is to ensure you have a solid offsite backup in place such as Azure Backup. Having that offsite backup will ensure you can get your data back even if the ransomware attack get ahold of your onsite backup data.

I even go as far as to recommend sticking to the 3-2-1 rule (3 copies of backup data 2 offsite and 1 onsite). This way if something happens to one of your offsite copies of data you have another one. It may seem overkill to have 2 offsite copies but you would be surprised how often offsite backup data is accidently destroyed.

So there you have it. Security is a critical part of any backup solution. It is clear that Microsoft realizes this based on the security enhancements they have made to both Azure Backup and Data Protection Manager 2016. Their goal is to ensure both backup solutions are enterprise ready. I have been working with DPM for years and Azure Backup as soon as it came out. I know the team behind these products have a lot of new features and functionality planned for the future of these products and I am looking forward to it.

Read More

VMware VM Backup in DPM Setup

Today Microsoft released the availability to protect VMware virtual machines with System Center Data Protection Manager (DPM). This is a feature the community has been asking to get for a long time. Again the DPM team continues to deliver! Again the team has brought this new functionality to existing customers via an update rollup. You do not have to wait for a new version of DPM to start protecting VMware. This functionality is enabled in DPM 2012 R2 through update rollup 11. Download DPM 2012 R2 UR 11 from this link:

http://catalog.update.microsoft.com/v7/site/search.aspx?q=3162908

For DPM 2016 this funcionalty will come out of the box.

Now lets look at the install, setup, and recovery of VMware VM’s.

INSTALL THE UPDATE:

VMwareinDPM (17)

VMwareinDPM (1)

VMwareinDPM (2)

ADD VMWARE CREDENTIALS:

VMwareinDPM (3)

NOTE: This is an agentless backup. DPM does not install and agent here. It only connects to the VMWare host.

ADD VMWARE SERVER TO DPM:

VMwareinDPM (4)

VMwareinDPM (5) VMwareinDPM (6)

My VMWare server did not have a proper certificate. I had to add the following reg key:

DisableSecureAuthentication.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Data Protection Manager\VMWare]
“IgnoreCertificateValidation”=dword:00000001

It worked after that.

PROTECTING VMS:

VMwareinDPM (8) VMwareinDPM (9)

You can add a single VM as shown in the following screenshot.

VMwareinDPM (10)

Or set the protection to Auto.

VMwareinDPM (11)

If set to auto VM’s that are added to this host will automatically be protected.

There was no downtime during the protection of the VMWare VMs.

VMwareinDPM (12)

RECOVERING VMS:

You can see we can recover VM’s just like we can with Hyper-V.  You need to click on the VM folder to make the Recover option show.

VMwareinDPM (13)

If you click on a VM you will see the .vmdk files and can recover them.

VMwareinDPM (14)

The rest of the recovery process is the same as recovering a VM in Hyper-V.

VMwareinDPM (15) VMwareinDPM (16)

That concludes this post! Enjoy your ability to protect VMware with DPM.

Read More

Presenting at MMS 2016 – Azure Stack, Backup, & OMS

It’s almost time for MMS 2016. By the end of Friday 4-22-16 MMS registration will be closed as the event has sold out! This year I have the opportunity to present twice and help facilitate one of the pre-con sessions. Here is a breakdown of my sessions.

Session #1: My first session is on Azure Stack the new Hybrid solution from Microsoft! This session will include me and Daniel Savage an Azure Stack program manager from Microsoft! You never know what new never heard before stuff you might learn about in this session. I recommend you sign up. Here is the title, description, and link for this session:

TITLE: – Future-proof your Career with Azure Stack in the New Hybrid Cloud World! –

DESCRIPTION: “Write once, deploy anywhere”, “extension of Azure”, “cloud agility”, “Cloud in your data center” What do all these buzz words mean to you and your career? How does Azure Stack Microsoft’s Hybrid solution apply to you as an IT Pro? Does Hybrid Cloud really have a place in the enterprise?

Come to this session and let Azure Stack Program Manager Daniel Savage and MVP Steve Buchanan unpack it for you.

SPEAKER BIOS:

Future-proof your Career with AzureStack

LINK: http://sched.co/6Xjn

Session #2: In my second session I will be presenting with my good friend and fellow MVP Robert Hedblom. He is making the trip all the way across the pond from Sweden for this event. Our goal for this session is to save jobs! hahaha…. You don’t want to miss this session as we take you through the steps of designing your backup and restore strategies. Here is the title, description, and link.

TITLE: – Be a Hero or be Fired. Backup and Restore Strategy –

DESCRIPTION: Did you skip planning the backup strategy? If a disaster occurred could you restore or would you get fired?

Come see System Center MVP’s Steve Buchanan and Robert Hedblom walk you through building a bullet proof backup and restore strategy of your business services. These strategies can be used with Microsoft business continuity tools. Learn how to be a restore hero in the event of a disaster and keep your JOB!

SPEAKER BIOS:

Be a Hero or be Fired. Backup and Restor

LINK: http://sched.co/68×3

Session #3: The third session is actually a 4 hour pre-con session about Operations Management Suite (OMS). This is a session you don’t want to miss. This session will be jam packed with MVP and Microsoft rock-stars! It will be jam packed with deep knowledge and again you never know what new never heard before stuff you might learn about in here. In this session you will have direct access to the Microsoft product team that is behind OMS. I am honored to be a part of this session. I have the opportunity to help facilitate it. Here is the title, description, speaker bio’s and link for this session.

TITLE: OMS from “What is this?” to “Wow, it can do that?!” –

DESCRIPTION: This is a pre-con session where emcee’s Steve Buchanan and Cameron Fuller will facilitate a four hour session designed to explain what OMS is and what it can do for your organization.

In the first hour Bob Cornelissen (SCOMBob) and Cameron Fuller will provide an introduction to what OMS is and what benefits it can provide your organization.

In the second 1.5 hour session, join the Microsoft product team members as they dig in deep on IT automation within OMS.

In the final 1.5 hour session, join the Microsoft product team members as they dig in deep on Log Analytics & Security / Compliance.  

SPEAKER BIOS:

OMS Pre-con

LINK: http://sched.co/6MtU

See you at MMS 2016!

MMS

http://mmsmoa.com

Read More

What is Microsoft Azure Backup Server?

Want to have DPM without having to buy System Center? Now you can. It is called Microsoft Azure Backup Server (MABS). Well MABS is not really a full DPM but a scaled back DPM. Microsoft released Microsoft Azure Backup Server on October 7th, 2015. In this post I am going to break down what Microsoft Azure Backup Server is.

clip_image001

Microsoft Azure Backup Server’s goal is to solve some problems that have existed with Azure backup for a while. These problems are:

  • -No centralization of protected servers with Azure Backup. Historically if you did not have DPM and you only had Azure Backup but needed to protect on premises server you would install the Microsoft Azure Recovery Services Agent (MARS) agent on your on premises servers. They would then be protected up to Azure.
  • -Without DPM Azure Backup can only backup files and folders. To protect workloads like SQL, Exchange up to Azure you needed to protect with DPM first and then send the data up to Azure.
  • -Purchasing a System Center license is not economical for some organizations.

Microsoft Azure Backup Server solves these issues because it is an on premises backup server. Under the hood it is a scaled back DPM so it gives you similar functionality. It lets you protect the same workloads as DPM to disk on premises first and then up to Azure or you can backup directly to Azure. Essentially it gives you two types of protection:

  • – Disk (D2D), giving high RTOs for tier 1 workloads
  • – Azure (D2D2C) for long term retention

Tape protection with Microsoft Azure Backup Server is not possible. This is not included in the product.

MABS also gives you a centralized location on premises to backup your on prem servers to, manage the backup agent of your on prem servers and see the status of their protection. MABS does this without the cost of a System Center license. It can be used when you subscribe to Azure Backup. MABS will require you to provide backup vault credentials during the setup.

From the Microsoft site on MABS pricing: “Microsoft Azure Backup Server will continue to bill customers as per their existing Azure offers (e.g. Pay-as-you-go, EA, Open).” You can learn about Azure Backup pricing here: https://azure.microsoft.com/en-in/pricing/details/backup/

Now to get Microsoft Azure Backup Server you can either go download it directly here:

https://www.microsoft.com/en-us/download/details.aspx?id=49170

Or you can download from the Azure portal. Go to:

clip_image002

Then click on the “Download Microsoft Azure Backup Server for Applications” link as shown in the following screenshot.

clip_image003

Microsoft Azure Backup Server is great for organizations that need a backup solution without the cost of the entire System Center suite. Keep in mind this does not provide tape backup. However backup up to Azure for offsite is a cost effective solution and also now gives you on premises backup to disk as well.

Here is an official blog post on Microsoft Azure Backup Server along with “how to” videos. These videos will help you install and configure Microsoft Azure Backup Server. https://azure.microsoft.com/en-us/blog/announcing-microsoft-azure-backup-server/

Read More

Backup Summary Report Update v2

So recently Sebastien Weiland reached out to me and wanted to help update the DPM Backup Summary Report. A HUGE THANKS to him for diving in and looking at the tape issues and time issues. The report has been updated. Here are the changes:

  1. The report has been changed from UTC time to local time. So now the time on the report will match up exactly to the time of the recovery points in the DPM console. See the following screenshots:

In the DPM console:

clip_image001.png

On the report:

clip_image002.png

  1. Tape information is now showing properly in the report. Protection Groups with Disk +Tape will show data or Protection Groups with only Tape will show in the report. You have the option to select only tape or disk + tape as shown in the following screenshot.

clip_image003.png

Here is a screenshot of the full v2 report.

clip_image004.png

This is the perfect example of community coming together to work on a solution that benefits all! I have not had the time to dive in and adjust the SQL to resolve these few issues so Sebastien volunteered to take this on with me testing and verifying things. I want to give one more thanks to Sebastien for helping out. More info about him: Sebastien Weiland is the Head of IT at a Hospital located France. His LinkedIn profile can be found here: https://fr.linkedin.com/in/sebastienweiland. 

Here is a link to download the v2 report:

https://gallery.technet.microsoft.com/DPM-Backup-Summary-Report-4533bcc6

Happy Reporting!

NOTE: This is a community report. This report is not officially supported by Microsoft. Use at your own Risk. It is still recommended to use the official Microsoft Enhanced Reporting. Check out this link for a post on the DPM Enhanced Reporting: http://www.buchatech.com/2015/05/deploy-configure-dpm-enhanced-reporting/

Read More

Blog Dive: SQL Protection with DPM

Background for this post

Since version 2006 DPM has been able to protect SQL databases. Often in environments that are using DPM I still see they are using DPM for backup of all workloads but not using it for SQL backups. There are reasons for this such as a lack of understand of how DPM protects SQL or lack of trust in DPM to protect SQL. The goal of this blog post is to lay out why you would want to use DPM to backup SQL, what SQL versions and functionality (such as AlwaysOn) are supported, what happens under the hood when DPM protects SQL and that you can use DPM as your sole solution for protecting SQL. This is an effort to convince those that don’t use DPM for SQL Backups today to start using it or those that don’t trust DPM for SQL backups that it is a great option to consider. This blog post is targeted directly at DBA’s or DPM admins that need to give information about SQL protection to their DBA’s.

One major challenge I had when I set out to write this blog post is that I am not a DBA or a SQL expert. So I don’t have any SQL “street cred” so I needed to fully understand what a SQL DBA would require to ok DPM being the sole backup solution for SQL in an organization.

I have the fortunate opportunity to work with an awesome SQL MVP named Jes Borland at Concurrency. As a part of my research for this blog post I reached out to Jes Borland to have a discussion around SQL protection. One of the important questions I asked her was “What things do you look for in a SQL backup solution?“. Her response was “What I look for in a backup tool: the ability to do all types of SQL Server backups – full, differential, log, copy-only. Ability to take advantage of built-in backup compression.” as well as “As a DBA, my main question is, “How do I restore?“. This was perfect as they are key things I should look out for to make sure DPM can do.

Now that we covered the background let’s look at what DPM can do when it comes to SQL protection.

Why would you want to use DPM to backup SQL?

  • DPM understands SQL and was designed to protect the advanced configurations of SQL.
  • DPM can protect SQL up to every 15 minutes.
  • Reduce potential conflicts between backup tools and schedules of SQL protection.
  • DPM can protect SQL at the instance level or the database level. When protection at the instance level is turned on DPM will detect new databases on that instance and automatically add them to protection.
  • DPM is an affordable option for protecting SQL. It is a good fit for small SQL shops and can scale for large enterprise SQL shops.
  • DPM has self-service recovery of SQL databases using the Self-Service Recovery Tool (SSRT) that can be extended to DBA’s.

What SQL versions and functionality does DPM support?

Versions:

  • 2005
  • 2008
  • 2008 R2
  • 2012
  • 2014

Functionality:

SQL Clustering

When protecting a SQL cluster DPM is cluster aware. DPM is aware of the clusters identity as well as the nodes in the cluster. In a SQL clustering scenario if the SQL Server is changed to a different node, DPM will continue to protect the clustered SQL without any intervention from backup administrators.

SQL Mirroring

If the SQL you are protecting is mirrored DPM is aware of the mirrored databases and will protect the shared data set properly.

SQL Log shipping

In scenarios when SQL log shipping is being used DPM will automatically discover that log shipping is being used and DPM will auto-configure itself to co-exist ensuring proper SQL protection.

SQL AlwaysOn

When protecting SQL AlwaysON DPM will automatically detect Availability Groups and detects when a failover occurs and will continue protection of the database.

What happens under the hood with SQL protection in DPM?

Protection:

When SQL protection is first setup an express full copy of the database is created and this is the initial backup of the database. Express full backups bring over block level changes of the databases themselves. This would be the entire database on the very first backup.

Express full backups leverage a filter technology. This filter technology is what identifies changed blocks instead of needing to read all of the data or use checksums. This filter technology is known as volume shadow services (VSS). Specifically the SQL Server VSS Writer is used during SQL protection. This does two things: DPM backup of SQL will not impact databases and it will only backup changed blocks after the initial backup of the database reducing the storage footprint. Backing up the block level changes also has a significantly lower impact of the protected server during backup.

After the initial backup of the SQL database DPM will perform subsequent express full backups and synchronizations between the express full backups. Synchronizations copy over SQL Transaction logs. A recovery is possible from both an express full and synchronization backups.

DPM can be set to protect SQL databases as often as every 15 minutes so that you can have frequent protection of SQL throughout a day. As a part of the DPM SQL protection recovery points are created for each incremental synchronization and express full backup. DPM can maintain up to 512 shadow copies of a full SQL Server database(s) by storing only the differences at the block level. In a scenario where you have one express full backup per week, stored as one of 512 shadow copy differentials between one week and the next, plus 7 days x 24 hours x 4 (every fifteen minutes), DPM would have over 344,000 recovery points (what you restore from) of SQL.

The following screenshot is an example of SQL protection in DPM. The top half in red shows an example of auto protection of SQL at the instance level while the lower half in blue is an example of individual database protection.

clip_image001

Truncating SQL logs:

DPM does truncate the SQL transaction logs as a part of the backup process. DPM truncates the logs (creates empty space inside the transaction log) after each synchronization.

Note that if the synchronization is set to a long window of time such as 12 hours the transaction log could grow to large for truncating and will need to be shrunk. So general rule is to keep the synchronization’s closer together.

To shrink the SQL transaction logs this needs to be done manually or using a SQL Maintenance job. This could always be done using a Pre-Backup/Post-Backup script.

Now if “Just before a recovery point” is selected in the protection group then the synchronization (incremental backup) will not be scheduled to run. Configuring this way tells DPM that only express full backups should run. Transaction logs will not be truncated by DPM in this scenario.

Recovery:

A good friend of mine System Center MVP Robert Hedblom always says “backup is about the restore”. I subscribe to the same principle in that “restore should always be the focus of any backup solution”. In a disaster recovery situation DPM can be used to restore from a loss of the database down to within 15 minutes of the failure. DPM can recover the database to original instance, a separate instance to a folder, or even copy to a tape. You can see those options reflected in the following screenshot:

clip_image002

When recovering to original SQL instance or a alternate SQL instance you can specify what state you want to leave the database in. Restoring the database in a non-operational state will allow you the ability to restore transaction logs in addition to the database restore.

clip_image003

You also have the option to specify where you want to place the database files (.MDF) and log files (.LDF) during the restore.

clip_image004

The DPM Self-Service Recovery Tool (SSRT) can be deployed on the client computers of the DBA/s. When recovering a database using the SSRT the experience is much like it is when recovering directly from DPM. When the New Recovery Job button is clicked a Recovery Wizard window will open with the same options as recovering directly from DPM. A screenshot of the SSRT shown below displays the UI with a restore job that has completed.

clip_image005

Details of a recovery job in the SSRT are shown in the following screenshot.

clip_image006

Hopefully this article has shed some light on SQL protection with DPM and will help you consider using DPM to protect your SQL instances/databases. For further information on SQL protection with DPM visit the following links on TechNet:

Read More

System Center 2012 R2 UR7 Highlights

Its been a while since I have posted a new blog. I have been busy working on multiple System Center projects and other behind the scene activities. Today update rollup 7 for System Center 2012 R2 was released and this is definitely worth a post. This UR includes DPM, SCSM, SPF, VMM, , SCORCH, Azure Pack, but not Operations Manager. UR7 for Operations Manager will be coming within a few weeks. More info here.  It is interesting that SCOM is not in this UR and we actually see SCORCH included. Here are some highlights from UR7:

For Orchestrator The Monitor SNMP Trap activity has an issue fixed and there is a fix for Stop Job and Stop Runbook. The SCORCH UR also includes some fixes for SMA.

For Service Manager we see a bunch of fixes. Some fixes I want to call out are MPSync Data Warehouse job stop responding and the Get-SCDWInfraLocations cmdlet introduced in update rollup 5 have been fixed. Great work from the Service Manager team. Keep it up.

Beyond just fixes we see new features in two of the System Center components VMM and DPM. As always its exciting to see new features added via UR’s.

In VMM we see support for Windows 10, the ability to provision and customize Debian 8 Linux as a Guest Operating System, support for VMWare vCenter 5.5, the ability to have Multiple External IP Addresses per Virtual Network, the ability to re-associate orphaned virtual machines to their service or VM role, and support for VMM DHCP Extension PXE/TFP Forwarding. There also is a ton of great fixes for issues in VMM. This is great work from the team and should make VMM more stable.

In DPM we see support for Windows 10 client protection, and a really cool feature being the ability to use alternate DPM servers to recover backups from Azure Backup vault. These means if you sent your backup data to Azure from one DPM server and it croaks you can connect a different DPM server to your Azure Backup subscription and recover data from Azure! I have a feeling we will continue to see greater collaboration between on premise backup/DR (DPM) and cloud backup/DR Azure Backup in the future.

To access update rollup 7 visit this link: https://support.microsoft.com/en-us/kb/3069110

Read More

4th time System Center MVP

This morning I received an email from Microsoft that I am awarded System Center Cloud and Datacenter Management MVP for the 4th year. Here is the email I received:

image

The System Center Cloud and Datacenter Management MVP’s are a great lively bunch of folks. It is an honor to still be a part of this group. I have made many friends at Microsoft, with other MVP’s and in the community during my time as an MVP...

Read More

System Center Futures 2016 and Beyond

UPDATE 9-4-2015:

***There is an upcoming FREE event covering the Future of System Center. This will be held on Sep 25, 2015 at the Microsoft MTC in Minnesota (http://www.microsoft.com/en-us/mtc/locations/minneapolis.aspx). This is a must attend event for any company running System Center. For more info on this event visit: http://bit.ly/1JIHS48***

Last week I was able to attend the first ever Microsoft Ignite conference in Chicago. There was a lot of exciting news announced at this conference around the many Microsoft products and technologies. Everything was covered from SharePoint, Exchange, Unified Communications, Office, Windows server, Windows 10, all things Azure and more. This post is focused for any System Center professional that was unable to attend the MS Ignite 2015 conference but what’s to know what’s up with System Center. If you had any concern about System Center going away or just want to know about the future of System Center in general this post is for you.

During conference there were many sessions related to the various System Center components however there were a couple of critical sessions that covered the future of System Center. These are the Platform Vision & Strategy sessions. These are titled:

Windows Server & System Center Futures—Bring Azure to your Datacenter (Platform Vision & Strategy)

And

Platform Vision & Strategy (6 of 7): What’s New in System Center for Management

These sessions are important because they featured System Centers top guy Jeremy Winter and he talked about future direction of the management solutions. In this post I will sum up key information from each of these sessions.

NOTE: This post is my perspective on the Platform Vision & Strategy sessions from Ignite and do not represent the opinions of Microsoft.

Traditionally System Center has been a complete management stack for IT Operations. This is not going to change but will continue to get better. The stack consists of: Managing endpoints (PC’s/Mobile device/servers) – *SCCM/Intune* | Monitor – *SCOM* | Automation – *Orchestrator (SMA)* | Provision – *VMM* | Service Management – *SCSM* | Protection – *Data Protection Manager* | Self-service – *Azure Pack* also represented in the following screenshot from one of the session slides.

clip_image001[4]

So we are now in the year 2015 and have not had a new major version of the entire stack since 2012. However since the release of System Center 2012 we have seen a steady progression of enhancement to the stack. We have seen it move from SP1 to R2 and now updates and new features through update rollups.

These update rollups have been released on a faster cadence at a speed we have not seen from Microsoft before. In fact we have recently seen a round of new features in update rollup 6 and more announced at Ignite. Below is a list of key features that stuck out to me along with slides from one of the Platform Vision & Strategy sessions giving insight into where the System Center components are headed next.

SCCM: Support for Windows 10 and a plethora new MDM features.

clip_image002[4]

Automation: Graphical authoring. How cool is this!, DSC Push/Pull servers now in SMA and you can manage DSC in SMA, Role Based Access Control.

clip_image003[4]

DPM: Backup as a Service in Azure Pack powered by DPM, VMWare Backup, Azure Backup offline seeding.

clip_image004[4]

SCOM: LAMP Stack monitoring, Scheduled Maintenance Mode.

clip_image005[4]

VMM: Ability to manage Azure IaaS VM’s in VMM. 🙂

clip_image006[4]

SCSM: Workflow server scale-out, Azure Stack IT Marketplace

clip_image007[4]

All of those enhancements are exciting for System Center as it appears to be leading up to a major release soon...

Read More

Streaming Enterprise Backup Ignite 2015 Session

My Enterprise Backup session with Microsoft PFE Islam Gomaa and System Center MVP Robert Hedblom from Microsoft Ignite is now on Channel 9. Here is what we covered in the session:

  • Offline seeding to Azure Backup
  • Monitoring and the new enhanced reporting
  • Custom reporting
  • Real-world deployment best practices

and

  • The all new Backup as a Service in Azure Pack powered by DPM

You can watch it here:


Read More