How to Use OCR in OneNote. Awesome Feature.

This is an interesting one. Every time we do meetings with customers and I need to convert image to text, I use the OCR capabilities from OneNote. And every time I hear "WOW!" from the people.

It led me to conclude: This is a fantastic not-well-known feature, it must be promoted more. In this video I do a quick demo on how it works. If you knew this, great!! If not, I hope you use it more now and also share the news.

Stop Talking About Yourself to a Customer

In consulting, one thing I've learned is that one of the things customers hate most is when you spend time talking about yourself. Ok, maybe they don't literally hate, but they couldn't care less about your company of what you do. So, don't talk about yourself or how awesome your company is for a customer, specially if it is one of your first contacts with them.

So, Here's the Golden Tip...

They want to hear about *their* company, about *their* needs. Start talking about their company, their needs, their challenges and how you can be the glue to connect problem and solution.

You know, these 60 PowerPoint slides you want to show to them? forget about it. Pay attention at their body language. Around the slide #10 they will be checking their emails, their Yammer network and...god forbid... they may even be checking their Facebook!!

Get Them Engaged

It's nothing against you. They are basically waiting for you to finish what you have to say so they can see afterwards how can you help them solve their problems. If they are patient, they will wait...that's normally a BAD sign. If not, they will start asking questions and skip jump your presentation script...that's is normally a  GOOD sign.

In the new marketplace, they already know your company, they already know what you do. They Googled you, your company.

Also get rid of those slides about your prizes, your offices in Tokyo or London. OK so you do need to show them, at least don't spend too much time talking about them. It is OK to show at some point but don't spend precious time promoting yourself during their time. I like this point: When you have a customer presentation think this way, they are giving you THEIR time to you so what do you do: talk about yourself or how awesome your company is? Stop that, please! :-) Cut to the chase, talk about real solutions for their real problems.

Be Careful With Your Perception

Don't oversell. They already expect you to be a good company, they already expect you to offer a quality service, they already expect you to offer a fair price (regardless if it is a premium service). If you tell them your differential are these things they will put you on the hook for it.

You Don't Need to Say Anything

You're there to listen. You're there to make open questions about their needs, problems. And maybe some one of your slides address that, so just jump to that slide. Don't need to go one by one until you get there.

You're There to Help Them, Not to “Sell”

Eliminate the sales jargon from your pitch. Be authentic, be passionate about your intentions which are "I am here to help you with problem X". in my opinion, is should be your/our messaging.

What Defines Personal Information/Data in the Cloud ?

 

The cloud technology is great. It allows people and systems to deliver applications to a global scale, with ease and great management power. Data can be stored and retrieved from anywhere in the world. This is a huge benefit, and equally huge challenge.

If you deal with legal documents, store personal information, then independent of your preferred cloud provider (Microsoft, Amazon AWS, Google, IBM, HP etc.) there are challenges you need to consider to manage privacy issues.

The Case for Personal Identifiable Information

Many countries have laws that regulates how personal information data (PI) should be handled. For example, I live in Queensland, Australia and here we have the Information Policy Act 2009 also known as PI Act. This law defines what is PI data here:

"...information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in material form or not, about an individual whose identify is apparent or can be ascertained".

This is definition is already a great start to help identifying PI data for cloud projects. If you're curious on what's and what's not PI data, the Office of the Information Commissioner (OIC) has a checklist that address this question.

Not All Bytes are Born the Same

It is important to say that laws like the PI Act are applied to personal identifiable data, not only this law can be applied. Any other laws may come on top of that, for example laws that regulates insider trading, or identity theft, for example.

Now that we know the scope of the regulations, the next thing to be aware is that not all data is the same. It means that the type of information and its sensitivity levels have a direct impact on how the data needs to be handled.

Privacy Impact Assessment

Generally speaking, it is common for cloud migration projects handling such data to have them identified in the assessment phase. In these cases, if any personal information is found (for example, a database table that has names and street addresses or an Excel file that contains telephone numbers) a privacy impact assessment (PIA) is conducted. This PIA will generate a report that cross-check the data identified, the impact in the cloud project delivery and how to minimize or avoid any privacy risks involved.

And we are talking here only about data. The next item to check in your cloud migration project is the data flow. Data flow is equally important because what it is "legal" in a place might not be in another. For example, let's assume that Company X applied all measures required by law to protect personal data for a company, however this company has headquarters in another country. Could an email between offices of these 2 countries be shared with the same content?

So as you see, data flow can be as complex as data controls, but we will talk about this on another time.

Images from @MSAU

SharePoint Paris 2015 Office 365 DLP

In May 2015 I was both lucky and honoured with an invitation to present at the inaugural SharePoint Paris 2015. Fantastic event! lots of Microsoft people and MVPs from across the world.
If you came to my session, my wholeheartedly thank you and I hope you enjoyed watching it as much as I did presenting it.
Here are the slides of the session.

Office 365 Data Leakage Protection, DLP, Data Loss Prevention, Privacy, Compliance regulations from Edge Pereira

How to Add Simple Authentication to Azure Website

During my last Azure Website project, we had to setup a staging environment in order to test the website being deployed. By nature, all Azure Websites are opened to everyone to see, however the need to protect the content being tested came up for several reasons. We were running on a tight deadline and we did not want to spend too much on configuring this authentication. The solution we found was to leverage from the provided IIS and .NET capabilities already provided by Azure and setup a simple authentication mechanism using a static username and password.

Blueprint

For this case we needed 3 things:

1. a web.config file with the authentication configuration
2. a Login.aspx page that comes up for the visitors to enter the credentials
3. a javascript hookup binding the page and the web.config

Once you have all these elements, what you do is to upload these files (via FTP) to your Azure Website. The IIS hosting will automatically recognize them and the changes will take effect immediately.

Solution

The solution took about 10 minutes to build and to save you this valuable time here is the code for both web.config and login.aspx (included with the javascript) you need:

<?xml version="1.0"?>
<configuration>
    <system.web>
        <compilation debug="false" />
        <authentication mode="Forms">
            <forms>
                <credentials passwordFormat="Clear">
                    <user name="AddYourUserNameHere" password="AddYourPasswordHere" />
                </credentials>
            </forms>
        </authentication>
        <authorization>
            <!-- Allow access to all who can match the username and password -->
            <allow users="*" />
            <!-- Denies access to anonymous users -->
            <deny users="?" />
        </authorization>
    </system.web>
 
    <system.webServer>
        <modules>
            <remove name="FormsAuthenticationModule" />
            <add name="FormsAuthenticationModule" type="System.Web.Security.FormsAuthenticationModule" />            
            <remove name="UrlAuthorization" />
            <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
        </modules>
    </system.webServer>
</configuration>

And here’s the code for the login.aspx file you will need.

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat='server'>
public void Login_OnClick(object sender, EventArgs args)
{
    if (FormsAuthentication.Authenticate(UsernameTextbox.Text, PasswordTextbox.Text))
    {
        FormsAuthentication.RedirectFromLoginPage(UsernameTextbox.Text, NotPublicCheckBox.Checked);
    }
    else
    {
        Msg.Text = "Login failed.";
    }
}
</script>
<html xmlns="http://www.w3.org/1999/xhtml" >
<head><title>Simple Login Authentication</title></head>
<body>
    <form id="form1" runat="server">
    <h3>Simple Login Authentication</h3>
    <asp:Label id="Msg" ForeColor="maroon" runat="server" /><br />
    Enter the user name: <asp:Textbox id="UsernameTextbox" runat="server" /><br />
    Enter the password : <asp:Textbox id="PasswordTextbox" runat="server" TextMode="Password" /><br />
    <asp:Button id="LoginButton" Text="Login" OnClick="Login_OnClick" runat="server" />
    <asp:CheckBox id="NotPublicCheckBox" runat="server" />
    </form>
</body>
</html>

Well, that’s it. I hope you liked and it saved you some Google searches and time

by Edge Pereira

Office 365: Privacy, Compliance and Data Leakage Protection

Thank you everyone who attended my presentation at Infrastructure Saturday #infrasat on Office 365 : Privacy, Compliance and Data Leakage Protection. Fantastic crowd. Great engagement and questions. Feel free to reach out if needed anything. 

Here are the slides: http://1drv.ms/1v767mF

by Edge Pereira

How to host json file on Azure Website

Recently our project team developed an application and we intended to host it using an Azure Website, due to its convenience, price and easy of use. It worked well in the local drive and in the local web server..so if we just copy the site to another place it should work, right?

Wrong, if the other site is an Azure Website. If you do, you will note that all accesses to the JSON file will result in a 404 error.

The Problem

To make short a long story, that's because Azure Websites have a few MIME file types blocked by default and .json is one of them. And for the record, .svg is another one. 

The Fix

Luckily all Azure Websites are really IIS servers running on .Net. If you have some basic knowledge of IIS and .Net you know that we can control these security things via web.config. And that is what you need to do: Place a web.config file that tells IIS to allow the file extension.

To save you the trouble, here's the code to allow json and .svg to be served on Azure Website:

<?xml version="1.0"?>
<configuration>
    <system.webServer>
        <staticContent>
            <mimeMap fileExtension=".json" mimeType="application/json" />
     </staticContent>
    </system.webServer>
</configuration>

Just save this as a web.config and copy to the root folder of your application.

I hope this little trick saved you lots of time!

Cheers,
by Edge Pereira

Do What You Love

Don’t Let Failures Stop You

Working with CSS (sigh..)

By Edge Pereira

How to Upgrade SharePoint 2013 Trial to Licensed

If you are using a trial version of SharePoint Server 2013 and want to upgrade to a licensed product edition, you can purchase a license and perform the upgrade on the SharePoint Central Administration itself. Below are the steps to upgrade from trial to licensed.

If you have a trial you will see the following options in Central Admin.

 

Just click it and type the serial key you just purchased and SharePoint will take care of the rest. The whole licensing process should take just a couple of minutes. Suffice to say the server must be connected to the internet.

  

by Edge Pereira

How to Get a Random Value Variable on Command Prompt

Here’s a nice trick to get a random value on command prompt: Use the macro %random%

This is pretty useful to setup values not to be known, like for example to set the Administrator password to a unknown value.

net user administrator edge%random%pereira

by Edge Pereira

How to Call Administrator Command Prompt at the Windows Login Screen

Quick Summary: We are going to learn how to hack Windows 8 and get administrator rights to anyone without knowing the login information. This was my solution during a hackaton that happened here in Australia some time ago and I decided to share with you guys.

If you’re really in a hurry, here’s how it works…

Before the solution, a quick chit-chat…

The debugger process takes very high execution precedency in Windows. As a matter of fact, the debugger actually is running at the moment in your windows background and you never realised that.

If you’ve been around long enough to remember the old MS-DOS days, back then there was an application called SideKick. SideKick was executed at the computer boot and then stayed there hibernating. Then when the used pressed Ctrl+Alt, it magically appeared in the screen. It was awesome! Best thing ever! You could call this application from anywhere. It was done because during the initial execution, SideKick placed itself between the keyboard pressing command and the actual call in the CPU. It was a “man in the middle” kind of application, for the good.

That’s the same principle here, and to prove the point that the debugger is always running on Windows we will do this cool experiment in 3 Steps:

1) Open RegEdit and find the Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

2) Create a new string key called DisplaySwitch.exe. In this key set Name: Debugger, Data:cmd.exe

3) Lock your windows and press WindowsKey+P

Amazing hey! You’re calling the Command Prompt from your windows login screen. How about that for a power show-off with your infrastructure friends

The Explanation

The Debugger process is always running and intercepting all the calls made on windows, even during the login screen, and checking against the list defined in that registry key we talked about at the beginning. Now we only had to find an application, a service or anything that can be executed and send the instruction to the debugger to execute something else for us. That’s where the DisplaySwitch.exe comes into play.

DisplaySwitch.exe is executed when we press WindowsKey+P to allow us to select multiple monitors. The registry entry says “If the DisplaySwitch.exe gets called, call the Debugger instead and pass the parameter cmd.exe”. We are intercepting the keyboard call and making it execute the command prompt. Neat hey!

by Edge Pereira

032789_NSASecretListener - NSA Secret Listener Service in Windows

I was debugging some services in one of my Azure servers when I came around the command sc which allows to communicate with the Windows Service Control Manager. My problem required me to retrieve the SID for my local SQL Server Service. To make a short a long story, I ended up playing around with the service names and IDs, such as the command below.

C:\>sc showsid trustedinstaller

Why I started doing this? for nothing. Sheer curiosity, fishing for something new to learn. Then I came across this service called “NSA Secret Listener”.

C:\>sc showsid 032789_NSASecretListener

Note that it has a hardcoded numeric value at the beginning, which I believe it was put there on purpose just so it does not become so obvious..but again why use the NSA name on it and why this prefix?

Obviously we can see that the service has the status: Inactive; however I am curious to see the reasoning behind it.

Another point: If I run the command to get the display description, it shows that the service does not exists. “Security by obscurity” maybe?




Anyone has any hints? I would love to know the ins-and-outs of it.

Women in IT

Percentage of women age 15 or up who participate in the labour force, around the world.