daclark's WebLog : Provisioning

Happy New Year to ZTP 3.1

daclark — Wed, 09 Jan 2008 05:20:00 GMT

Yes, it's true. The Microsoft Services Managed IP solutions group has been working for the last few months to package up ZTP 3.0 with current fixes and updated documentation to release as ZTP 3.1. Ironically, this is about the same place we were with this same team over a year ago, but they have a few new people and seem more motivated. This same team is also developing ZTP 4.0 based entirely on ILM 2.0 (and they may be searching for another build-with customer). I expect that ZTP 3.1 will be a formal Microsoft Services Core IO Service Line Offering in Feb or March and that ZTP 4.0 won't be generally available until late 2008 (though build-with customers may see multiple releases this year). May you be provisioned a happy new year.

Provisioning 4.0 on Windows Workflow Foundation

daclark — Fri, 15 Jun 2007 16:49:00 GMT

A common question around Zero Touch Provisioning has been, why use BizTalk Server and Human Workflow Services?

Answer: We started ZTP in 2003, when BizTalk Server 2004 was in pre-beta and HWS was one of the premier features of the release. We made a big bet that workflow would change the way distributed applications could be designed. As it turns out, it was the right bet, but the technology from HWS was very complex and had problems with shipping some features. Once it was determined that HWS was not going to be the premier workflow platform (around BTS 2004 RC), we already had too much invested in HWS to back it out. Fast forward to April 2006, there still wasn't another workflow platform from Microsoft publicly available. So, we continued with BizTalk Server 2006 to release ZTP 3.0 by the end of summer 2006. We released ZTP 3.0 in October 2006 and .NET Framework 3.0 released in November 2006 with Windows Workflow Foundation.

Now, we're planning Provisioning 4.0 to leverage Windows Workflow Foundation. BizTalk Server will still be used for what it is best at: integration scenarios. Talking with enterprise applications (like SAP, PeopleSoft, JDE, etc) and external partners (like procurement, supply chain, etc). Also, BizTalk Server has excellent features around business monitoring (BAM). Savvy customers will want to use Provisioning 4.0 with BizTalk Server 2006 to enable near real-time request and workflow monitoring against key performance indicators (KPIs). Ironically, BizTalk provides a lot of core services that is not included with the WF framework (like a host process, pub-sub messaging, correlation, routing, health tracking) that will need to be built or leverage another WF host model (like SCSM and ILMv2). Therefore, BizTalk Server will not be required by Provisioning 4.0, but may still be leveraged.

Provisioning 4.0 FAQ

daclark — Wed, 13 Jun 2007 04:51:00 GMT

At TechEd and via email, I've had many questions about the future of Zero Touch Provisioning. Here's some information in an FAQ form:

1. Is it true that ZTP v3.0 is the last version? Why is Microsoft passing over this solution?

Answer: v3.0 is likely the last version to be called Zero Touch Provisioning. However, there's a Microsoft Services solution group project code named Provisioning 4.0 that is based on the ZTP 4.0 planned architecture. To be clear, Microsoft isn't missing out on this opportunity, rather we’re investing more into the solution development and marketing. Just remember, more investment means more project rigor and financial measurement, which can lead to delays or scope changes.

2. What is the future Provisioning strategy with future Microsoft products like System Center Service Manager and Identity Lifecycle Manager v2.0?

Answer: Provisioning 4.0 will continue to be a common request and workflow engine across the Windows Server System and across IT disciplines. As Microsoft's products evolve and adopt WF technology, Provisioning 4.0 should support even more cross product integration actions and new product hosting. The goal of Provisioning is to enable self-service and task delegation for any activity across the platform (software, service, or device). On the technology side, we're moving to Windows Workflow (just like our products) to match the common technical architecture direction for all workflow at Microsoft and plan to provide WF activities for our products.

3. OK, but I saw a demo of Self-Service Provisioning on Service Manager using Configuration Manager to deploy an application.

Answer: Yes, this doesn't preclude products from shipping SDK samples, adapters, or solutions for specific high-value scenarios. However, Provisioning 4.0 spans Deployment Management, Configuration Management, Identity Management, Operations Management, and Service Management. Ideally, Powershell automation and Provisioning Packs will become common engineering criteria like Management Packs.

A main tenet of Provisioning is to protect the solution investment while enabling our future products. This may mean that some functionality delivered today in custom code will be moved into product features, but the overall investment in the solution is preserved by expanding service definitions and integration scenarios. In other words, if you are solely concerned with provisioning for 1 IT discipline, then an eminent product may be a better choice, but each provisioning scenario decreases investment risk dramatically and pushes you toward Provisioning 4.0. In fact, Provisioning 4.0 could enable transitioning to future Microsoft products faster.

4. So, who owns Provisioning at Microsoft?

Answer: Today, Provisioning is a Microsoft Services solution, now owned by the formal solutions group. However, it is not farfetched to picture certain Provisioning Packs as SDK samples, adapters, or solution accelerators licensed for specific products. In the long run, I hope to see Provisioning as a common product feature with a shared architecture across the Windows Server System.

5. What does this mean for David?

Answer: I’m not sure, but I may not be working on Provisioning for much longer. The solutions group has Architects, Program Managers, Development Managers, Product Managers, and teams of developer/test resources. Ironically, it’s not clear that there is room for me. I’ve been working on Provisioning since 2003, both with world class resources like Brandon (Danny and Graham, or Nilesh, Balaji, and Dave) and sometimes by myself. It’s very satisfying and scary to see my vision take hold and live beyond my control. Perhaps it’s time to let Provisioning fly without me. Then again, it would be awesome to work with the various business groups to more formally productize Provisioning.

Working at Tech Ed 2007

daclark — Wed, 06 Jun 2007 02:53:00 GMT

Another year, another Tech Ed. This year, I'm presenting Using Zero Touch Provisioning in the Architect track (session ARC312). Like many speakers, I'm currently working on my slides and demos to best meet the demands and expectations of attendees. Unfortunately, this includes rebuilding my virtual servers because Windows Server 2003 SP2 hosed LSASS in my VPC. Anyway, I hope to see a few friendly faces and to announce the current direction for Provisioning 4.0.

My apologies to Sweden

daclark — Fri, 10 Nov 2006 20:18:57 GMT

Zero Touch Provisioning v2.0 is used by multiple partners at many customers in Sweden. Unfortunately, there's been confusion with contracts and some problems with engaging Microsoft Services to provide partners with access and redistribution rights to v2.5 and now v3.0. Microsoft is a big company with lots of legal entities and opinions. I've been on leave for quite a while now, but before I left we began working on the partner release strategy for v3.0. I return to work next week and I'm excited to say that there's some good news for partners. We should be close to finalizing the v3.0 partner strategy, including source access and services for partners (like training and support). ZTP v3.0 will continue to be a Microsoft Services offering, available to partners and customers, but the contracts and costs will be commonly set and more easily obtained.

To partners in Sweden (like Spintop and WMdata), sorry for taking so long and I hope you haven't given up on us. Thank you for using Zero Touch Provisioning. The ZTP v3.0 framework and toolset is very powerful. I truly expect 2007 to be the year of Provisioning and even hope to visit customers and partners around the world to train on v3.0 and discuss v4.0.

Zero Touch Provisioning 2.5 is Available!

daclark — Thu, 06 Apr 2006 01:28:00 GMT

Well, after many months, ZTP 2.5 is generally available through an MS Services engagement. We'll maintain source (features and bug fixes) through a Services engagement model (requiring Consulting Services for initial deployment or Premier Services for maintenance).

Q: What’s new in ZTP 2.5?
• Active Directory ServiceAdapter for WS queries to AD
• Combined status across ZTP+HWS
• Web Services for all ServiceAdapters and Administration
• New Web Parts: Navigation multi-view, Common Services, Pending Requests, Service Description, Administration tool
• Updated UI to match SharePoint styles and templates
• Updated User Controls modified to use Web Services and SharePoint styles/templates
• Sample Call Service Orchestration to batch updates to ZTP
• Sample Bulk Update Manager User Control for querying Active Directory
• Bug fixes increasing scalability and performance

Q: What platform is supported by ZTP 2.5?
• Windows Server 2003 SP1
• BizTalk Server 2004 SP1
• .NET Framework 1.1 SP1
• Windows SharePoint Services 2.0 SP2
• SQL Server 2000 SP4
• SQL Server 2000 Reporting Services SP2
• Systems Management Server 2003 SP1 or SP2

Q: How do I get ZTP 2.5?
ZTP 2.5 is currently only available as a Microsoft Services engagement. Contact your local Engagement Manager or Technical Account Manager to pursue an estimate.

History of Zero Touch Provisioning

daclark — Thu, 11 Aug 2005 05:04:00 GMT

In early 2003, Tony, a Director in Microsoft Services who branded Zero Touch, asked Brandon and I to review a prototype tool in development called DEAPS and determine if it was viable as a self-service provisioning application for an outsourcer. It was built on ASP.NET web interface posting to BizTalk Server 2002 orchestrations. Each workflow was an independent orchestration and required someone to know BizTalk to change operations. The UI was nice with a custom delegation model, but the engine didn't take advantage of our new (then, soon to ship) platform technologies, like WSS, Authorization Manager, BizTalk Rules Engine, and Human Workflow Services. Ultimately, we decided that it didn't meet the needs of a generic Provisioning engine. So, we began working on a design for a new Provisioning engine, to be called Zero Touch Provisioning (ZTP), that could be used to help an outsourcer manage desktops and reduce helpdesk costs. We began by prototyping on the BizTalk Server 2004 beta. Then, we created a conceptual design and formal scope. We planned to ship a version with the BDD Solution team in conjunction with Zero Touch Install (ZTI) around Q2-2004. In Q4-2003, we took our grandiose plans to Redmond to talk with both the MIIS team and IDM Solutions team to integrate BizTalk with MIIS and provide more scenarios on the same engine. We were told "no thanks" by the MIIS team, they hoped to ship MIIS 2003 and then a workflow engine soon after, and "maybe" by the IDM Solutions team, who hoped to provide a workflow solution as well. We also talked with the BizTalk Server team, who was excited by our use of HWS, but we ended up not working with any of them. MS Services had a customer and a core scenario that matched a scenario from the BDD team, so we were still planning on publicly shipping. We worked on ZTP from Q4-2003 through Q1-2004 to deploy the alpha release at our customer in March 2004. After demonstrating the core functionality at a customer, we went back to the various product (MIIS, BizTalk, SMS) teams to discuss another public release vehicle by adding more scenarios. Ironically, we couldn't convince the product teams to invest in integration across our server platform. At this point, we needed funding (MS Services doesn't work for free, even for internal projects) and the BDD team began paying for 1 persons time. This allowed Brandon to stay focused on ZTP. I continued to work for free for a while and eventually got funding from another source within MS. Due to SP1 and OSD, the BDD team slipped to Q3-2004, so Brandon got some quality time to fix issues. In July 2004, it was decided that we'd demonstrate and launch ZTP (in beta) at the MS global training event. Brandon and I worked feverishly on a killer demo and mediocre hands on lab. We packed our small room and generally impressed (and confused) the audience. Now, we were publicly committed to shipping this thing with the BDD team. We'd already been working 12+ hour days for months, but from August to November, we stopped sleeping and worked a minimum of 16 hours per day, often working for 36 hours straight. Honestly, neither of us remember sleeping, but we must have. Thankfully, the BDD team slipped again to Q4-2004. Our district had won a sales award, so we both did take a few days vacation to Hawaii. We released ZTP build 2.0.225.0 on October 29th 2004. We made a couple small updates (defaults, setup, spelling) to release 2.0.225.0-E with the BDD team in November 2004. Then, I got to go to IT Forum to create a ZTP demo for Bill Gates to launch OSD, BDD, and ZTP. Since then, I've trained and assisted people around the world (from MCS, Premier, MS IT, partners, and customers).

ZTP was born because two guys from MS Services had the sheer will to make it happen (with the help of many people, like Eddie, Graham, Mike, and Tony along the way). Funnily, it's almost been a year since we released, and MIIS still hasn't shipped any workflow (2 years since our first conversation), HWS has become something else, and we have multiple customers around the world using ZTP in different capacities. However, I still can't convince our server product teams to invest in integration across our server platform using BizTalk. And, we still don't have MIIS integration as a free download. Different teams may try to take the credit for our vision and deviate from MS Services, but it started here first with a bold Services Director betting on two techie Consultants.

ZTP at TechEd 2005

daclark — Tue, 07 Jun 2005 18:16:00 GMT

If you're attending TechEd 2005 in Orlando, Florida, feel free to look me up. I'm presenting on ZTP in the Windows Desktop track (since we shipped publicly with the BDD Enterprise solution accelerator.

DSK330 Zero Touch Provisioning with the Solution Accelerator for Business Desktop Deployment - Enterprise Edition

Day/Time: Wednesday, June 8 2:00 PM - 3:15 PM Room: N 210 E

This session begins with a high-level overview of the Solution Accelerator for Business Desktop Deployment Enterprise Edition. A technical drilldown into Zero Touch Provisioning (ZTP) explains: what provisioning is; why a company would use it; how it works; and illustrates this with some real life experiences. This session covers the architecture, services, and actions of the Zero Touch Provisioning engine, a workflow engine (based on BizTalk Server 2004) and a self-service portal (using Windows SharePoint Services). ZTP provides services to end-users and delegate administrators, using business rules to minimize help desk calls and to automate execution of IT and related tasks. The session concludes with an overview of the BDD roadmap and resources available to you. By the end of this session, you will understand the purpose of ZTP, how ZTP works, and how to use ZTP. (Strong Focus on BizTalk Server 2004.)

http://www1.msteched.com/content/sessionview.aspx?TopicID=80d89b91-b86b-4e7a-8036-b3f768987ec9

Post-SP1 COM+ Hotfix Rollup

daclark — Wed, 04 May 2005 14:52:00 GMT

If you're using ZTP, BizTalk, or anything that uses Enterprise Services (COM+), after installing Windows Server 2003 SP1, you need to install the post-SP1 hotfix listed in 896729.

http://support.microsoft.com/?id=896729

From the article:

Provide extended COM+ services to support the Indigo Microsoft .NET technologies for building and running connected systems through advanced Web services.
Provide support for the Indigo WS-AtomicTransaction specification in the Distributed Transaction Coordinator (DTC).
The DTC stops responding (hangs) or leaks memory when the DTC is used with Microsoft BizTalk Server 2004.
You experience slow performance when there are available threads in the thread pool. This issue occurs even when you configure the COM+ single-threaded apartment (STA) thread pool with the EmulateMTSBehavior registry key.

ZTP works with MIIS, not against.

daclark — Tue, 03 May 2005 01:44:00 GMT

One of the most commonly asked questions I get around Zero Touch Provisioning directly relates to Identity and Access Management (a common provisioning scenario). Microsoft Identity Integration Server (MIIS) is the Microsoft product focused on IDM. To date, MS has depended on partner or customer code to fulfill the provisioning aspects of an IDM solution. However, ZTP (built on BizTalk Server) can be used to provide the workflow, delegation, and audit engine typically needed for Identity provisioning. Using SQL Server and WMI, ZTP can leverage MIIS in three distinct capacities: as a data source for Rule Engine Policies, as an endpoint for action in ZTP, and as the initiator of workflow to ZTP. Now, when considering an Identity and Access Management solution, look to leverage MIIS in conjunction with ZTP for the complete Provisioning system.

Using ZTP with Windows Server 2003 SP1

daclark — Tue, 03 May 2005 00:54:00 GMT

After installing Windows Server 2003 Service Pack 1, the default security settings for MSDTC and DCOM must be modified to allow BizTalk and ZTP to work properly.

Change the MSDTC Security Configuration settings and DCOM permissions on each server the ZTP components remotely communicate (BTS, MIIS, SMS, SQL, WSS). Set the MSDTC settings:

Enable Network DTC Access
Enable Allow Inbound
Enable Allow Outbound
Set the Transaction Manager Communication option to “No Authentication Required”

Also, grant the service accounts for ZTP and the BizTalk Host (i.e. ztpservice and btsservice) ALLOW for default Remote Launch, Activation, and Call Access for DCOM on each server. Or, specify permissions for each component (ZTP/BTS/WMI) on each server.

For a summary of the changes to DTC made by SP1 see http://msdn.microsoft.com/library/en-us/cossdk/html/2627a956-60b3-4d26-bc04-e0676ec97786.asp?frame=true.

Provisioning part 2

daclark — Wed, 23 Mar 2005 11:42:00 GMT

I just posted my second article on "big-P" Provisioning, here.

Understanding output in SDDL

daclark — Tue, 22 Mar 2005 22:39:00 GMT

If you've used the SC command line or worked with ADSI or MIIS, you'll recognize these easy to read strings representing ACLs (like O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)). For those that haven't seen these before, goto a cmd prompt and run the command SC SDSHOW LANMANSERVER from Windows XP Pro or Windows Server 2003. This is a text representation of an ACL called security descriptor definition language (SDDL). SDDL is useful for storing or transporting security descriptor information. The SD string format is a null-terminated, concatenated string with tokens to indicate each of the four main components of a security descriptor: owner (O:), primary group (G:), DACL (D:), and SACL (S:). If you don't want to parse this by hand, you can write quick little tool that helps you parse this information into something more meaningful, like I did.

MIIS SP1

daclark — Tue, 22 Feb 2005 00:59:00 GMT

Microsoft Identity Integration Server (MIIS) Service Pack 1 is part of the MS Provisioning story. In particular, the Management agent for extensible connectivity and the management agent Software Development Kit (SDK). This management agent and related tools can be used to synchronize data from any connected data source. The management agent for extensible connectivity can support either file–based or call–based data sources. The management agent SDK is a set of tools, interfaces, Help, and sample code that is needed to develop a management agent for extensible connectivity.

Article posted, finally.

daclark — Thu, 10 Feb 2005 01:15:00 GMT

Well, I finally posted my "What is Provisioning?" article only to realize that I'll need to write another. Next week, I'll explain the common components to Provision IT.