Windows 8: Cleaning up WIFI Profiles and VPN Networks

The other day on my Windows 8 laptop, I noticed a few dozen WIFI connections for places I was unlikely to ever visit again (hotel WIFI connections from business trips and vacations). You would think in 2014 that these would be easy to delete via an administrative GUI.

To delete your superfluous WIFI connections

1) Open a command prompt (CMD from from the Windows 8 main screen)

2) Run the command "netsh wlan show profiles" in the console window:

The output generated by "netsh wlan show profiles" will appear as follows:

Profiles on interface Wi-Fi:

Group policy profiles (read only)

---------------------------------

    <None>

User profiles

-------------

    All User Profile     : San.Diego.Airport.Free.WIFI

    All User Profile     : BW Rockland

    All User Profile     : Travelodge5

    All User Profile     : Holiday Inn On-WiFi 13

    All User Profile     : HolidayInn-1

    All User Profile     : Holiday Inn On-WiFi 10

    All User Profile     : Holiday Inn On-WiFi 14

    All User Profile     : BWLakeLucilleInn

3) Delete each unwanted profile using: netsh wlan delete profile name="ProfileName"

To delete the Wasilla, Alaska, Best Western's WIFI profile the command to execute is:

netsh wlan delete profile name="ProfileName"

Microsoft has a great overview of the netsh command at "Manage wireless network profiles".

 

Visual Studio Online (cloud based TFS): Deleting another user's Workspaces

It is possible for a Visual Studio Online (cloud based TFS) workspace to exist for a user, even after said user has been removed as a valid VSOL user. The specific VSOL instances this happened under was: https://admiralgracehopper.visualstudio.com/

To remove such an orphaned workspace perform the following steps:

1) Open a Visual Studio command prompt, so that "tf" command can be executed. The full documentation for tf can found for Visual Studio 2013 under Use Team Foundation version control commands.

2) Invoke "tf workspaces" for all workspace owners (hence command-line option /computer:*) and all computers (hence command-line option /owner:*):

tf workspaces /computer:* /owner:* /collection:https://admiralgracehopper.visualstudio.com/DefaultCollection

The output for this command will be as follows
Workspace     Owner                Computer      Comment
------------- -------------------- ------------- -------
Contractor-PC Susan Wu             Contractor-PC         
Desktop101    Jan David Narkiewicz Desktop101
LaptopUltra   Jan David Narkiewicz LaptopUltra

The output generated by "tf workspaces" shows a workspace for Susan Wu, the developer who was no longer with the firm.

3) Invoke "tf workspace /delete" to remove the other user's workspace:

tf workspace /delete "Contractor-PC";"Susan Wu" /collection:https://admiralgracehopper.visualstudio.com/DefaultCollection

The workspace and username were specified as: <workspace><semi-colon><username>. Double quotes were used to include the space in the username "Susan Wu" and to make sure that the dash in workspace, Contractor-PC, was interpreted correctly by tf.

Visual Studio Online (cloud based TFS): Making Visual Studio 2010 allow Logging in with Different Credentials

On one project I work on the client asked me to change Visual Studio Online (VSOL) username (email address) to a different email address. VSOL was being used for source code control in a project developed with Visual Studio 2010. Seemed pretty simple to change credentials but there is a bug in Visual Studio 2010 that complicates this process.

From Visual Studio 2010's Team menu select Connect to Team Foundation Server which seems to offer a way to sign out:

Hitting "Sign Out' does nothing.

The solution is to close the Connect to Team Project dialog. From the View menu select Other Windows | Web Browser. In the web browser navigate to http://msdn.microsoft.com:

Sign out from MSDN which is logged in with your previous VSOL account.

From Visual Studio 2010's Team menu select Connect to Team Foundation Server which seems to offer a way to sign out. It actually does this time: 

This time when you sign out, Visual Studio will sign the account out of Visual Studio Online and prompt a user to enter new credentials:

It is not possible to sign in with the updated Visual Studio Online credentials.

Visual Studio Online (cloud based TFS): Creating Additional Administrators

We have all been bottle-necked when there is one administrator for Visual Studio Online and hence only one person who can manage source code control. While the VSOL administrator is on the beach in Florida there are no new projects created and no new users added to VSOL.

To create a second administrator:

1) The administrator should log in to VSOL (this blog's instance of VSOL is found at https://admiralgracehopper.visualstudio.com).

https://<VSOL instance name>.visualstudio.com

2) The administrator should navigate to the screen which allows access to security including group and use management:

https://<VSOL instance name>.visualstudio.com/DefaultCollection/_admin/_security

For this blog's instance of VSOL the link can be found at https://admiralgracehopper.visualstudio.com/DefaultCollection/_admin/_security.

4) From the security tab, select "Users" and click on the user to be assigned administrative permissions:

The current administrator is Keyser Soeze. User, Jan David Narkiewicz, will also be made an administrator. The screen shown demonstrates the individual permission associated with Jan David Narkiewicz. Instead of setting individual permissions it is simpler to assign the user to the appropriate group or groups.

5) From the previous screen select "Member of":

6) To associate the user with additional groups including making said user an administrator click on "Join group":

7) From the "JOIN A VISUAL STUDIO ONLINE GROUP" dialog click on "Browse":

8) The list of account types is listed. The type of administrator can be fine tuned such as checking only "Project Collection Administrators" or "Project Collection Build Administrators". After adding all groups the permissions for user, Jan David Narkiewicz includes every administrative level feature because such permissions are inherited from the groups associated with the user:

Note: individual permissions can be added by clicking on the "Not set" control next to the permission type and setting the value to "Allowed".

Visual Studio Online (cloud based TFS): Changing Account Owners

As a consultant, many of my clients do use source code control or use a flavor of source code control running locally on a server (SourceSafe, SVN, etc.). In these cases, I immediately sign the client up for Visual Studio Online (VSOL, http://www.visualstudio.com/) with its free, source code for up to five users. Before completing work for a client, I make sure to make each client the account owner of their VSOL code repository.

To change the account which owns a VSOL instance perform the following steps:
1) Have the client create a Microsoft ID if they do not already have one. This is typically the client's hotmail.com, msn.com, outlook.com or live.com email address. For the sake of this example assume the client's Microsoft ID is Nicolaus_Copernicus@outlook.com.
2) Login to the client's VSOL that you currently own (our sample repository is: https://admiralgracehopper.visualstudio.com and it is owned by pumpkinko@hotmail.com).
3) Add the client's Microsoft ID as a user to VSOL which is as simple as clicking the User menu (e.g. https://admiralgracehopper.visualstudio.com/_user) and then clicking Add (see below):

4) Navigate to your VSOL instance's  settings page which for our sample repository is https://admiralgracehopper.visualstudio.com/_admin/_home/settings):

The "Account owner" drop down allows the user to be changed from "Jan Narkiewicz" to "Nicolaus Copernicus."

Windows Azure Active Directory Graph: Setting up a Tenant Domain, Application Principal ID and Application Password

Introduction

This posting demonstrates how to create the elements needed to programmatically access the RESTful API associated with Windows Azure Active Directory Graph. The following definitions are useful in understanding what is required to develop such applications:

• Tenant: owns or manages an instance of a cloud service
• Windows Azure Tenant: each Microsoft cloud service is associated with its own instance of Windows Azure Active Directory (Windows Azure AD). This AD instance is associated with an organization's cloud service and serves said service's tenant.
• Service Principal: this is an instance of an application within the AD tenant. Policies including permissions are applied to a service principal. For example: 
• An Address Book application's service principal might have read-only access to the AD instance associated with a Windows cloud service. 
• An HR application's service principal might have read-write access to the AD instance associated with a Windows cloud service.

An application that accesses Windows Azure Active Directory does so by accessing its service principal. A service principal is accessible by an application instance (a program instances) by the tenant domain (the URL associated with the application), a principal ID (analogous to a username) and principal password (the password associated with the principal ID).

There are a large number of excellent examples (Windows Azure AD Graph Code Samples Index) demonstrating the development of applications that use "Windows Azure Active Directory Graph." Each of these samples access AD Graph and therefore must make use of a service principal. The samples each utilize an app.config or web.config file containing elements corresponding to what is required to access a service principal. An example from "Sample App for Windows Azure AD Graph Differential Query" taken from an app.config is as follows:

<add key="TenantDomainName" value="BoostWIP365.onmicrosoft.com"/>
<add key="AppPrincipalId" value="9221e5fc-f3df-4337-8403-928abeb7af4e"/>
<add key="Password" value="G7Jo9Mis0DSyFXVdbEaA" />

The problem with the Windows Azure samples and documentation (including those related to setting up a service principal) is that Azure is a rapidly evolving platform. Microsoft is adding features at a remarkable pace so that documentation that is two years old may be obsolete. Documentation that is only six months old may be similarly obsolete. This posting attempts to be current with respect to setting up a service principal given the release of Windows 8.1.

Setting up an Azure Service Principal

These steps should be performed on a development machine (the machine on which you have Visual Studio 2013 installed or on which PowerShell scripts are developed). To create the tenant information perform the following steps:

1. Install Microsoft Online Services Sign-In Assistant version 7.0 or greater (there is a separate version for Windows 7/Windows 2008R2 and a newer version for Windows 8/8.1):

If you are running Windows 7 or Windows 2008/2008 R2 install the version of Microsoft Online Services Sign-In Assistant  found at: Microsoft Online Services Sign-In Assistant for IT Professionals RTW 

Note the system requirements (a.k.a. do not install on Windows 8 or Windows 8.1):

If you are running Windows 8 or Windows 8.1 install the version of Microsoft Online Services Sign-In Assistant  found at:Microsoft Online Services Sign-In Assistant for IT Professionals BETA

Note the system requirements below:

2. "Install the Windows Azure AD Module" based on your operating system (32-bit or 64-bit):

3. When prompted (see below) run the downloaded application:

3.1 It is useful to allow the installer to place a shortcut to the Windows Azure AD module for Windows PowerShell on the desktop.

4. Download the sample application "Sample App for Windows Azure AD Graph Differential Query".

5. Unzip the sample in order to gain access to CreateServicePrincipal.ps1. This PowerShell script lives up to its name sake; the script creates a service principal.

6. Run the Windows Azure AD module for Windows PowerShell by clicking on the shortcut previously installed on the desktop:

7. The CreateServicePrincipal.ps1 PowshellScript should be run within the console, Windows Azure AD module for Windows PowerShell:

Note: if an error is encountered "CreateServicePrincipal.ps1 cannot be loaded because the execution of scripts is disabled on this system" please see "Running Windows PowerShell Scripts"

8. Hit return to run the script. The CreateServicePrincipal.ps1 script when run is prone to prompt prolifically. After CreateServicePrincipal.ps1 is run, the user is prompted as follows:

9. Enter R and hit return to run the script:

10. When prompted enter Y and hit return to continue execution:

11. The previous screen show the user being prompted to "Enter a Service Principal Name" to which the name "Order Muffins" was entered. When return is hit the following is displayed:

12. To continue the user presses any key (unless they are worn out by excessive prompting) followed by entering their credentials:

• username: this is in the form of <username>@<domain>.onmicrosoft.com
• password: the password associated with the domain account

13. After the user successfully enters their credentials they are prompted again (as follows):  

14. Pressing any key continues the prompts deluge. The user is ask whether they want their service principal to have read-only or read-write permissions as an AD tenant:

15. After entering R (read-only) or W (read-write) the script will run for several seconds creating the service principal:

16. The previous screen shot obviously removes the application principal ID and the application principal password. The principal ID is in the form of a GUID (e,g, d266d7cc-13c7-4e89-aaac-8c699cf6aff2) and the password is in the form of a case-sensitive text string (e,g, 8K+0OX6pvUZtaGo4YdUogT9xiF15aqyx1HbSvEg8Sec=).

With an application principal ID and the application principal password, a user can now write their own application that exercises Windows Azure's graph API or they can run any of the samples provided by Microsoft.

Running Sample App for Windows Azure AD Graph Differential Query

When the sample application, Sample App for Windows Azure AD Graph Differential Query, is run it displays the following:

Clicking on the User Management link causes the application to invoke the Windows Azure AD Graph 'API using the sample's domain, principal ID and principal password. The results are as follows:

Change the domain, principal ID and principal password to the values created previously results in the following being displayed:

Obviously the AD repository of a newly created AD tenant contains fewer values than a Microsoft sample AD tenant but the code did behave correctly.

Appendix A: Creating a Windows Azure AD Tenant

This section is only for developers that need to create a Windows Azure Active Directory Tenant. All Windows cloud services are associated with an AD tenant. To create such a trial AD tenant a developer could sign up for free trial of Azure at "Try it out. For free" or sign up for a free trial of cloud-based Office 365 at www,Office365.com The approach taken here is to sign up directly for an AD Tenant at:  https://account.windowsazure.com/organization. 

The previous URL displays the following in Internet Explorer:

The domain being registered below is shown to be friendlybakery@onmicrosoft.com:

When the "check availability" green button has been pressed the web page prompts a user to provide their login and country information:

The "continue" green button on the previous screen is not enabled until the phone number associated with the account is validated. To begin the validation process select "send text message" which will send a text message containing a validation code to the phone number. The page will update as shown below to include a text box in which the verification code can be entered and a "verify code" button. 

When the code is entered (as shown below) click on the "verify code" button:

Once the code has been verified click on green button labeled "continue".

Why is it Windows PowerShell and not simply PowerShell?

Logitech  (the peripherals company) just released a hardware device, Logitech PowerShell (Logitech Unveils First-of-its-Kind Console on the Go – PowerShell Controller + Battery). The Logitech PowerShell has nothing to do with Windows PowerShell. Logitech's device is a case for an IPhone 5 that contains a joy stick (okay a joy-stick-like-disk) and four buttons (A, B, X and Y). The Logitech PowerShell coverts an IPhone into a mobile game device (the image below was taken from a Logitech web site):

This begs the obvious question, "Why does Microsoft always say 'Windows PowerShell' and never simply 'PowerShell'?"

Power Shell is a trademark of Sutherland Golf, Inc. from 1999 and likely refers to the outer coating placed on golf balls. This conjecture as to the name PowerShell is based on Sutherland's 1999 patent filing "Golf ball with perforated barrier shell, US 6102815."