Explore New Growth Opportunity with Dynamics 365 Business Central! 

Dynamics 365 Business Central represents an enormous opportunity for SMB partners and customers. It was built for small and mid-size organizations to address key financial and operational management needs.

Attend an upcoming digital bootcamp – we’ll take you step-by-step through how to identify an opportunity, drive effective conversations, and successfully transact Business Central. Show your customers your strategic value to them, help them expand into other Microsoft solutions to grow their business, make business more efficient, and more!

Unlock Your Business Central Opportunity | Digital event details
• Americas/EMEA region: September 19 | 8:00 AM – 10:00 AM, Pacific Time 
• APAC region: September 19 | 5:00 PM – 7:00 PM, Pacific Time

Register Today!

​Explore New Growth Opportunity with Dynamics 365 Business Central! 
Dynamics 365 Business Central represents an enormous opportunity for SMB partners and customers. It was built for small and mid-size organizations to address key financial and operational management needs.
Attend an upcoming digital bootcamp – we’ll take you step-by-step through how to identify an opportunity, drive effective conversations, and successfully transact Business Central. Show your customers your strategic value to them, help them expand into other Microsoft solutions to grow their business, make business more efficient, and more!Unlock Your Business Central Opportunity | Digital event details• Americas/EMEA region: September 19 | 8:00 AM – 10:00 AM, Pacific Time • APAC region: September 19 | 5:00 PM – 7:00 PM, Pacific TimeRegister Today!  Read More

​

Hi All,

I did the subjected certifications back in 2016. I am now wanted to update my certification. Please advise which certifications I should take to update my current skills in Microsoft 365?

Thanking in anticipation.

​Hi All, I did the subjected certifications back in 2016. I am now wanted to update my certification. Please advise which certifications I should take to update my current skills in Microsoft 365? Thanking in anticipation.  Read More

​

Heya folks, Ned here again. Last November, Microsoft launched the Secure Future Initiative (SFI) to prepare for the increasing scale and high stakes of cyberattacks. SFI brings together every part of Microsoft to advance cybersecurity protection across our company and products.

Windows has focused on security options with each major release, and Windows 11 24H2 and Windows Server 2025 are no exception: they include a dozen new SMB features that make your data, your users, and your organization safer – and most are on by default. Today I’ll explain their usefulness, share some demos, and point to further details.

The new OSes will soon be generally available and you can preview them right now: download Windows Server 2025 and Windows 11 24H2.

On to the security.

SMB signing required by default

What it is

We now require signing by default for all Windows 11 24H2 SMB outbound and inbound connections and for all outbound connections in Windows Server 2025. This changes legacy behavior, where we required SMB signing by default only when connecting to shares named SYSVOL and NETLOGON and where Active Directory domain controllers required SMB signing for their clients.

How it helps you

SMB signing has been available for decades and prevents data tampering and relay attacks that steal credentials. By requiring signing by default, we ensure that an admin or user must opt out of this safer configuration, instead of requiring them to be very knowledgeable about SMB network protocol security and turn signing on.

Learn more

Control SMB signing behavior (preview) | Microsoft Learn
SMB signing required by default in Windows Insider – Microsoft Community Hub

SMB NTLM blocking

What it is

The SMB client now supports blocking NTLM authentication for remote outbound connections. This changes the legacy behavior of always using negotiated authentication that could downgrade from Kerberos to NTLM.

How it helps you

Blocking NTLM authentication prevents tricking clients into sending NTLM requests to malicious servers, which counteracts brute force, cracking, relay, and pass-the-hash attacks. NTLM blocking is also required for forcing an organization’s authentication to Kerberos, which is more secure because it verifies identities with its ticket system and better cryptography. Admins can specify exceptions to allow NTLM authentication over SMB to certain servers.

Learn more

SMB NTLM blocking now supported in Windows Insider – Microsoft Community Hub
Block NTLM connections on SMB (preview) | Microsoft Learn
Demo:

SMB authentication rate limiter

What it is

The SMB server service now throttles failed authentication attempts by default. This applies to SMB sharing files on both Windows Server and Windows.

How it helps you

Brute force authentication attacks bombard the SMB server with multiple username and password-guesses and the frequency can range from dozens to thousands of attempts per second. The SMB authentication rate limiter is enabled by default with a 2 second delay between each failed NTLM or Local KDC Kerberos-based authentication attempt. An attack that sends 300 guesses per second for 5 minutes, for example – 90,000 attempts – would now take 50 hours to complete. An attacker is far more likely to simply give up than keep trying this method.

Learn more

SMB authentication rate limiter now on by default in Windows Insider – Microsoft Community Hub
Configure SMB authentication rate limiter for Windows (preview) | Microsoft Learn
Demo:

SMB insecure guest auth now off by default in Windows Pro editions

What it is

Windows 11 Pro no longer allows SMB client guest connections or guest fallback to an SMB server by default. This makes Windows 11 Pro operate like Windows 10 and Windows 11 Enterprise, Education, and Pro for Workstation editions have for years.

How it helps you

Guest logons don’t require passwords & don’t support standard security features like signing and encryption. Allowing a client to use guest logons makes the user vulnerable to attacker-in-the-middle scenarios or malicious server scenarios – for instance, a phishing attack that tricks a user into opening a file on a remote share or a spoofed server that makes a client think it’s legitimate. The attacker doesn’t need to know the user’s credentials and a bad password is ignored. Only third-party remote devices might require guest access by default. Microsoft-provided operating systems haven’t enabled guest in server scenarios since Windows 2000.

Learn more

SMB insecure guest auth now off by default in Windows Insider Pro editions – Microsoft Community Hub
Enable insecure guest logons in SMB2 and SMB3 for Windows client and Windows Server | Microsoft Learn

SMB dialect management

What it is

You can now mandate the SMB 2 and 3 protocol versions used.

How it helps you

Previously, the SMB server and client only supported automatically negotiating the highest matched dialect from SMB 2.0.2 to 3.1.1. This means you can intentionally block older protocol versions or devices from connecting. For example, you can specify connections to only use SMB 3.1.1, the most secure dialect of the protocol. The minimum and maximum can be set independently on both the SMB client and server, and you can set just a minimum if desired.

Learn more

SMB dialect management now supported in Windows Insider – Microsoft Community Hub
Manage SMB dialects in Windows (preview) | Microsoft Learn
Demo:

SMB client encryption mandate now supported

What it is

The SMB client now supports requiring encryption of all outbound SMB connections.

How it helps you

Encryption of all outbound SMB client connections enforces the highest level of network security and brings management parity to SMB signing. When enabled, the SMB client won’t connect to an SMB server that doesn’t support SMB 3.0 or later, or that doesn’t support SMB encryption. For example, a third-party SMB server might support SMB 3.0 but not SMB encryption. Unlike SMB signing, encryption is not required by default.

Learn more

SMB client encryption mandate now supported in Windows Insider – Microsoft Community Hub
Configure the SMB client to require encryption in Windows (preview) | Microsoft Learn

Remote Mailslots deprecated and disabled by default

What it is

Remote Mailslots are deprecated and disabled by default for SMB and for DC locator protocol usage with Active Directory.

How it helps you

The Remote Mailslot protocol is an obsolete, simple, unreliable, IPC method first introduced in MS DOS. It is completely unsafe and has no authentication or authorization mechanisms.

Learn more

The beginning of the end of Remote Mailslots as part of Windows Insider – Microsoft Community Hub
Deprecated features in the Windows client | Microsoft Learn
Features removed or no longer developed starting with Windows Server 2025 (preview) | Microsoft Learn

SMB over QUIC in Windows Server all editions

What it is

SMB over QUIC is now included in all Windows Server 2025 editions (Datacenter, Standard, Azure Edition), not just on Azure Edition like it was in Windows Server 2022.

How it helps you

SMB over QUIC is an alternative to the legacy TCP protocol and is designed for use on untrusted networks like the Internet. It uses TLS 1.3 and certificates to ensure that all SMB traffic is encrypted and usable through edge firewalls for mobile and remote users without the need for a VPN. The user experience does not change at all.

Learn more

SMB over QUIC now available in Windows Server Insider Datacenter and Standard editions – Microsoft Community Hub
Configure SMB over QUIC client access control in Windows Server | Microsoft Learn
SMB over QUIC in Windows | Microsoft Learn
Demo:

SMB over QUIC client access control

What it is

SMB over QUIC client access control lets you restrict which clients can access SMB over QUIC servers. The legacy behavior allowed connection attempts from any client that trusts the QUIC server’s certificate issuance chain.

How it helps you

Client access control creates allow and block lists for devices to connect to the file server. A client would now need its own certificate and be on an allow list to complete the QUIC connection before any SMB connection occurs. Client access control gives organizations more protection without changing the authentication used when making the SMB connection and the user experience does not change. You can also completely disable the SMB over QUIC client or only allow connection to specific servers.

Learn more

SMB over QUIC client access control now supported in Windows Insider – Microsoft Community Hub
Configure SMB over QUIC client access control in Windows Server | Microsoft Learn
Demo:

SMB alternative ports

What it is

You can use the SMB client to connect to alternative TCP, QUIC, and RDMA ports than their IANA/IETF defaults of 445, 5445, and 443.

How it helps you

With Windows Server, this allows you to host an SMB over QUIC connection on an allowed firewall port other than 443. You can only connect to alternative ports if the SMB server is configured to support listening on that port. You can also configure your deployment to block configuring alternative ports or specify that ports can only connect to certain servers.

Learn more

SMB alternative ports now supported in Windows Insider – Microsoft Community Hub
Configure alternative SMB ports for Windows Server (preview) | Microsoft Learn

SMB Firewall default port changes

What it is

The built-in firewall rules don’t contain the SMB NetBIOS ports anymore.

How it helps you

The NetBIOS ports were only necessary for SMB1 usage, and that protocol is deprecated and removed by default. This change brings SMB firewall rules more in line with the standard behavior for the Windows Server File Server role. Administrators can reconfigure the rules to restore the legacy ports.

Learn more

SMB firewall rule changes in Windows Insider – Microsoft Community Hub
Secure SMB Traffic in Windows Server | Microsoft Learn

SMB auditing improvements

What it is

SMB now supports auditing use of SMB over QUIC, missing third party support for encryption, and missing third party support for signing. These all operate at the SMB server and SMB client level.

How it helps you

It is much easier for you to determine if Windows and Windows Server devices are making SMB over QUIC connections. It is also much easier to determine if third parties support signing and encryption before mandating their usage.

Learn more

Windows Insider build 26090 brings small changes for SMB – Microsoft Community Hub

Summary

With the release of Windows Server 2025 and Windows 11 24H2, we have made the most changes to SMB security since the introduction of SMB 2 in Windows Vista. Deploying these operating systems fundamentally alters your security posture and reduces risk to this ubiquitous remote file and data fabric protocol used by organizations worldwide.

For more information on changes in Windows Server 2025, visit Windows Server Summit 2024 – March 26-28, 2024 | Microsoft Event. You will find dozens of presentations and demos on the latest features arriving this fall in our latest operating system.

And remember, you can try all of this right now: preview Windows Server 2025 and Windows 11 24H2.

Until next time,

– Ned Pyle

​Microsoft Tech Community – Latest Blogs –Read More 

In Microsoft Azure, I was registered the only user of the account.

The I have converted my account form external user to internal user.

How could I convert the account back to external user?

Thank you very much. 

​In Microsoft Azure, I was registered the only user of the account.The I have converted my account form external user to internal user.How could I convert the account back to external user?Thank you very much.    Read More

​

By 2025, the price of solar panels is expected to continue dropping due to advancements in technology and increased production efficiency. Analysts predict that the cost per watt could fall to between $0.20 and $0.30, making solar energy more accessible for both residential and commercial use. This reduction in price will further accelerate the global transition to renewable energy sources.

​By 2025, the price of solar panels is expected to continue dropping due to advancements in technology and increased production efficiency. Analysts predict that the cost per watt could fall to between $0.20 and $0.30, making solar energy more accessible for both residential and commercial use. This reduction in price will further accelerate the global transition to renewable energy sources.  Read More

​

1. Introduction

Managing the costs associated with running virtual machines (VMs) in Azure can be challenging, especially when VMs are left running during non-business hours. One effective solution is to schedule automatic shutdowns using Azure tags. In this blog, we’ll walk you through a PowerShell script that uses an Azure tag to define and enforce VM shutdown schedules.

2. Prerequisites

Before you get started, ensure you have the following:

An active Azure subscription.
Appropriate permissions to manage VMs and read tag information.
Basic knowledge of PowerShell scripting.

3. Script Overview

The script manages the power state of Azure virtual machines based on a specified tag and its value, which defines the schedule. For example, a tag named “AutoShutdownSchedule” with a value of “10PM -> 6AM” will shut down the VM at 10 PM and start it at 6 AM.

4. Detailed Script Breakdown

Parameters and Initial Setup

The script accepts three parameters:

TagName: The name of the tag to look for on virtual machines.
ManagementGroupId: The ID of the Azure management group to operate on.
Simulate: If set to $true, the script will only simulate the actions without making any changes.

param (
[parameter(Mandatory = $true)]
[string]$TagName,

[parameter(Mandatory = $true)]
[string]$ManagementGroupId,

[parameter(Mandatory = $false)]
[bool]$Simulate = $false
)

Function: Get-SubscriptionsUnderManagementGroup

This function retrieves all subscription IDs under a specified Azure management group.

function Get-SubscriptionsUnderManagementGroup {
param (
[Parameter(Mandatory = $true)]
[string]$ManagementGroupId
)

# Array to store subscription IDs
$subscriptionIds = @()

# Get the management group hierarchy
$managementGroup = Get-AzManagementGroup -GroupId $ManagementGroupId -Expand

if ($managementGroup -and $managementGroup.Children) {
# Loop through each child in the management group
foreach ($child in $managementGroup.Children) {
if ($child.Type -eq “Microsoft.Management/managementGroups”) {
# Recursively get subscriptions from child management groups
$childManagementGroupId = $child.Name
$subscriptionIds += Get-SubscriptionsUnderManagementGroup -ManagementGroupId $childManagementGroupId
} elseif ($child.Type -match “/subscriptions”) {
# Extract subscription ID
$subscriptionId = [regex]::Match($child.Name, “([a-f0-9-]{36})”).Value
if ($subscriptionId) {
$subscriptionIds += $subscriptionId
}
}
}
}

return $subscriptionIds
}

Function: CheckScheduleEntry

This function checks if the current time falls within a specified time range.

function CheckScheduleEntry ([string]$TimeRange) {
$rangeStart, $rangeEnd, $parsedDay = $null
$currentTime = (Get-Date).ToUniversalTime().AddHours(2)
$midnight = $currentTime.AddDays(1).Date

try {
if ($TimeRange -like “*->*”) {
$timeRangeComponents = $TimeRange -split “->” | ForEach-Object { $_.Trim() }
if ($timeRangeComponents.Count -eq 2) {
$rangeStart = Get-Date $timeRangeComponents[0]
$rangeEnd = Get-Date $timeRangeComponents[1]

if ($rangeStart -gt $rangeEnd) {
if ($currentTime -ge $rangeStart -and $currentTime -lt $midnight) {
$rangeEnd = $rangeEnd.AddDays(1)
}
else {
$rangeStart = $rangeStart.AddDays(-1)
}
}
}
else {
Write-Output “`WARNING: Invalid time range format. Expects valid .Net DateTime-formatted start time and end time separated by ‘->'”
}
}
else {
if ([System.DayOfWeek].GetEnumValues() -contains $TimeRange) {
if ($TimeRange -eq (Get-Date).DayOfWeek) {
$parsedDay = Get-Date “00:00”
}
}
else {
$parsedDay = Get-Date $TimeRange
}

if ($parsedDay -ne $null) {
$rangeStart = $parsedDay
$rangeEnd = $parsedDay.AddHours(23).AddMinutes(59).AddSeconds(59)
}
}
}
catch {
Write-Output “`WARNING: Exception encountered while parsing time range. Details: $($_.Exception.Message). Check the syntax of entry, e.g. ‘<StartTime> -> <EndTime>’, or days/dates like ‘Sunday’ and ‘December 25′”
return $false
}

if ($currentTime -ge $rangeStart -and $currentTime -le $rangeEnd) {
return $true
}
else {
return $false
}
}

Function: AssertVirtualMachinePowerState

This function ensures that a VM is in the desired power state (running or stopped) based on the schedule.

function AssertVirtualMachinePowerState {
param (
[Object]$VirtualMachine,
[string]$DesiredState,
[bool]$Simulate
)

$resourceManagerVM = Get-AzVM -ResourceGroupName $VirtualMachine.ResourceGroupName -Name $VirtualMachine.Name -Status
$currentStatus = $resourceManagerVM.Statuses | Where-Object { $_.Code -like “PowerState*” }
$currentStatus = $currentStatus.Code -replace “PowerState/”, “”

if ($DesiredState -eq “Started” -and $currentStatus -notmatch “running”) {
if ($Simulate) {
Write-Output “[$($VirtualMachine.Name)]: SIMULATION — Would have started VM. (No action taken)”
}
else {
Write-Output “[$($VirtualMachine.Name)]: Starting VM”
$resourceManagerVM | Start-AzVM
}
}
elseif ($DesiredState -eq “StoppedDeallocated” -and $currentStatus -ne “deallocated”) {
if ($Simulate) {
Write-Output “[$($VirtualMachine.Name)]: SIMULATION — Would have stopped VM. (No action taken)”
}
else {
Write-Output “[$($VirtualMachine.Name)]: Stopping VM”
$resourceManagerVM | Stop-AzVM -Force
}
}
else {
Write-Output “[$($VirtualMachine.Name)]: Current power state [$currentStatus] is correct.”
}
}

The script iterates through all VMs in the specified subscriptions, checks their tags, and enforces the power state according to the schedule. Below is the outline of what it does

try {
# Main script logic
}
catch {
$errorMessage = $_.Exception.Message
throw “Unexpected exception: $errorMessage”
}
finally {
Write-Output “Script finished (Duration: $((“{0:hh:mm:ss}” -f ((Get-Date).ToUniversalTime() – $currentTime))))”
}

5. Usage Example

To run the script, use the following command:

.StartStopVMsBasedOnTag.ps1 -TagName “AutoShutdownSchedule” -ManagementGroupId “MngEnv” -Simulate $true

I will be running the example in Local PowerShell, but the PowerShell could be run from anywhere including Automation Accounts. 

5.1 We tag our virtual machine accordingly

5.2 We look at our PowerShell code after being signed in to Azure and we run our command

5.3 We used the “-Simulate $true” flag which shows us what would have happened. If we want to run this in production, we can simulate first and when we are happy with our testing we can stop simulating by switching the “-Simulate $false”

6. Conclusion

Automating VM shutdown schedules using Azure tags helps optimize resource usage and reduce costs. By following this guide, you can implement a similar solution in your Azure environment. If you have any questions or feedback, feel free to leave a comment below. You can find a copy of this code in my GitHub Repo –> RallTheory/StartStopVMs/StartStopVMsBasedOnTag.ps1 at main · WernerRall147/RallTheory (github.com)

Disclaimer

The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts or Power BI Dashboards are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts or Power BI Dashboards be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages. This blog post was written with the help of generative AI. 

​Microsoft Tech Community – Latest Blogs –Read More 

Hello,

For some reason I am unable to get Palestine to display in a map chart.  I have tried turning it into a geography datatype as well as attempting multiple names (State of Palestine, Palestinian Authority, Occupied Palestinian Territory, etc), but it will not display on the map (its region instead says “plot data” when hovered over on a map).  I have gotten “Gaza” to work, but this only displays the region of Gaza and “West Bank” has no success.  Is there a way to display either both Palestinian Territories together or a way to display the West Bank (as I have already managed to display the Gaza Strip using “Gaza”)?  

Also, I am using Excel 365 for Mac—there seem to be some differences in application type.

Thanks!

​Hello, For some reason I am unable to get Palestine to display in a map chart.  I have tried turning it into a geography datatype as well as attempting multiple names (State of Palestine, Palestinian Authority, Occupied Palestinian Territory, etc), but it will not display on the map (its region instead says “plot data” when hovered over on a map).  I have gotten “Gaza” to work, but this only displays the region of Gaza and “West Bank” has no success.  Is there a way to display either both Palestinian Territories together or a way to display the West Bank (as I have already managed to display the Gaza Strip using “Gaza”)?  Also, I am using Excel 365 for Mac—there seem to be some differences in application type.Thanks!  Read More

​