Category Archives: microsoft

microsoft, windows

Usability: Microsoft’s big weakness

4 Comments

The iPhone, or maybe the iPod, was the beginning of the era of usability. Make something nice to use, reasoned Apple, and users will come flocking.

After the iPhone came the iPad; and then Android which while lacking the polish of iOS, mostly has the same characteristics of appliance rather than computer in its user interface.

What about Microsoft? It has learned to some extent. Windows Phone is a user-friendly operating system. The touch interface in Windows 8, although a shock to existing Windows users, shows obvious effort towards usability and sometimes succeeds. Navigating the weather app, for example, is a pleasure.

There are times though when Microsoft seems to have learned nothing. Take the new SkyDrive integration in Windows 8.1 for example. It is foundational in Microsoft’s effort to wrest Windows into being a cloud-centric operating system, where you could lose your device, buy a new one, log in, and find all your stuff. I’ve posted about its progress here.

But then you are on a train, say, with a poor internet connection, and you double-click a file in SkyDrive that has not been downloaded to your PC. This is the dialog you see (at least, it is the one I just saw):

image

There is so much wrong with this dialog that I don’t know where to start. But I will have a go.

First, I doubt the error is really unexpected. If my internet connection is poor, problems downloading stuff from SkyDrive are expected, not unexpected. You would think that the client could figure out, “It looks like I have a poor connection to SkyDrive” and inform the user accordingly.

Second, the error number. The dialog invites me to search for help using this number; however to do so I would have to copy it manually as it is unselectable. The number of course is in hexadecimal, so there is a high chance of copying an O instead of a zero as the difference is not obvious other than to programmers. Nor is it clear where I should search. Should I bang the number into Bing and hope for the best? Such searches can be fruitful, but they can also go badly wrong when you hit sites that tell you to download their utility to clean your registry, or some such nonsense.

Third, there is space for a human-understandable description of the error, but it is says “No error description available”. Lazy programming somewhere. Maybe in a code base the size of Windows it is too much to expect helpful messages for every error but this is not something users should normally see.

Fourth, there are three choices: Try Again, Skip and Cancel. Bearing in mind that I double-clicked only one document, what is the difference between Skip and Cancel?

Fifth, there is a More details button but it is disabled. Why, if no more details are available, does this More details button appear at all? Though I’d suggest that Error 0x80040A41 is a great candidate for “More details” rather than being something non-technical users are expected to make sense of.

What should happen? First, SkyDrive and/or its client should work better. This is a critical feature; but users are complaining (yes, I found this by searching for the error code) and it seems that problems persist in Windows 8.1 RTM. Microsoft has been working on file sync for decades, yet upstarts like Dropbox work more smoothly.

Second, when bad things happen, I am all in favour of plain English. I don’t see any reason ever to confront users with error numbers in hex. Put it in a technical details option by all means. In this particular case, why not something like, “Windows is having problems downloading from SkyDrive. You may have a poor internet connection; please try again later, and if the problem persists, contact support.”

Getting this right is not easy; but for as long as ordinary users see this kind of dialog in day to day use of Windows, the flight to iPad and Android will continue.

Update: the error fixed itself when I found a better connection

microsoft

Getting up and running with Workplace Join

A key part of Microsoft’s strategy for supporting tablets and smartphones in the enterprise is Workplace Join, which lets devices register with Active Directory:

When you join your personal device to your workplace, it becomes a known device and will provide seamless second factor authentication and single-sign-on to workplace resources and applications. When a device is Workplace-Joined, attributes of the device can be retrieved from the directory to drive conditional access for the purposes of authorizing issuance of security tokens for applications.

Devices currently supported are Windows 8.1 (RT or x86) and Apple iOS, with Android in preparation. It is a kind of lite version of domain join, enabling single sign-on but not group policy (centralised control of device settings). In order to control device settings, you can use ActiveSync (limited but includes password requirements and remote wipe) or device management through the cloud-based InTune.

I set myself the task of implementing Workplace Join on my test network, mainly using the guide here. It was somewhat arduous. Here are a few points to note.

Workplace Join is also called Device Registration and is a feature of Active Directory in Windows Server 2012 R2. It depends on Active Directory Federation Services (ADFS).

I wasted some time juggling with certificates and Service Principal Names (SPNs). On my test network I have Active Directory, Certificate Server and ADFS on the same virtual machine, which is not recommended. Here are some things to note.

You need a Server Authentication certificate which includes a Subject Name and two Subject Alternative Names, one of which is enterpriseregistration.yourdomain.com In order to get this out of Certificate Server I ended up copying and modifying a template to allow this additional data to be entered when the certificate is requested. I did not need to purchase any certificates; it all works as long as the Enterprise CA (Certification Authority) certificate is trusted by the device.

IIS will need this certificate as the default web site must accept secure connections to enterpriseregistration.yourdomain.com.

I got into difficulty when configuring ADFS. Initially I used the same name for the Federation Service Name as the computer name. This in turn caused a conflict with the registration of an SPN for the ADFS service account, probably because I have too much installed on one box. SPNs are used by Kerberos for secure communications and each SPN must be unique. The solution was to remove ADFS and re-install, using a different Federation Service Name. Then I modified DNS so that all three names – computer name, Federation Service Name, and enterpriseregistration – resolve to the same box.

I have not published my ADFS to the internet so mine is only an intranet solution for now.

Once all this was resolved I was able to run the PowerShell scripts to enable the Device Registration Service, and to check Enable device authentication in ADFS:

image

Of course my first efforts at actually using Workplace Join on a device (I used Surface RT and Surface Pro) failed with a generic error.

image

Confirm you are using the correct sign-in info, and that your workplace uses this feature. Also, the connection to your workplace might not be working right now. Please wait and try again.

The first thing to check is that your device can access the device registration service over HTTPs. Open a browser and go to this URL:

https://enterpriseregistration.[yourdomain.com]/EnrollmentServer/Contract?api-version=1.0

If this does not resolve, or returns a certificate error, you need to fix this before registration will work. Possible reasons:

  • Your device does not trust the certificate
  • IIS has the wrong certificate
  • A necessary service is not running on the server (check ADFS and the Device Registration Service as well as IIS)
  • The device cannot access the Certificate Revocation List for your domain

There is also an event log for workplace join, buried in the Applications and Services section, even on Windows RT.

Once fixed, I was successful and saw my devices show up in Active Directory under Registered Devices.

image

microsoft, mobile, windows

Windows 8.1 and cloud-centric computing

If your iPad breaks or gets stolen, it’s bad but not that bad. The chances are that there is no data on the iPad that is not copied elsewhere, especially if you let Apple’s iCloud do its default thing and copy everything you create. Get a new iPad, sign in, and you can carry on where you left off; the apps are there, the data is there too, even if you do not actually have a backup of the device itself.

Google’s Chromebook goes even further in this direction. When you sign into the device you sign into Google and all your data is there.

This kind of freedom from worry about losing apps or data stored on the device seems to be Microsoft’s goal with Windows as well, though it is more difficult because historically applications have complex local installs, sometimes protected by activation tied to the PC itself, and data is stored locally in your user folders – Documents, Pictures, Music and so on – or in some cases elsewhere, depending on how well behaved the application is. In order to defend against data loss if the PC is lost or damaged, you have to keep regular backups, or make a conscious effort not to store data locally.

Windows 8.1 includes a significant change. It is optional, but the default is that documents save to SkyDrive (note that the name will change soon) by default.

image

This is in addition to synchronisation of settings, passwords and application data. Again, SkyDrive is where this data gets stored. You can see and control what is synchronised in Charms – PC Settings – SkyDrive -  Sync Settings:

image

The list is extensive and includes web browser favourites (provided you use Internet Explorer) and “settings and purchases” within apps. Note that apps in this context means new-style Windows Store apps, not desktop applications. Separately, there is a Camera Roll setting that syncs images and optionally videos from the Camera Roll folder in your  Pictures folder.

How close then is Window 8.1 to a cloud-centric experience, where you could thrown your machine in the bin, buy another one, sign in and carry on where you left off?

It is getting there, but in practice there are plenty of snags and oddities. The big one is desktop apps, of course, which do not participate in this synchronisation other than via SkyDrive if you save documents there. You will have to reinstall the applications as well as reconfigure them. That said, certain desktop applications now have a subscription model. Two big examples are Microsoft Office, if you buy via an Office 365 subscription, and Adobe’s Creative Cloud which includes Photoshop, Dreamweaver, Audition and so on. Using cloud-aware applications such as these helps, but it is not seamless. For example, in Office 2013 I have to reconfigure the Quick Access Toolbar and copy my custom templates manually to a new machine.

New-style apps do roam to a new machine and you can now use them on up to 81 different machines, which should be enough for anyone. Note though that your apps, which are listed when you sign into a new machine with a Microsoft account , are not actually installed until you run them for the first time. Not a problem is you are on the internet, but worth knowing before you catch that flight. In the following example, only two of the apps are actually installed:

image

Microsoft takes a similar approach with SkyDrive documents. The feature called SkyDrive “smart files”, described here, means that documents are by default only available online. I can see this catching people out, especially with pictures, for which a thumbnail shows even when the actual picture has not yet been downloaded. Here are some pictures I took at Microsoft Build in June; they are on SkyDrive but although they look as if they are on my PC a message in the status bar says “Available online only.”

image

A nice feature in terms of seamlessly connecting to cloud storage without filling your local hard drive (or often, small SSD drive), provided you understand it. Of course, you can mark a file or folder to be available offline if you choose, in which case it is downloaded.

Some things are confusing. If you have a domain-joined machine then passwords do not sync, which makes sense for security, but also raises the question of what all this consumer SkyDrive stuff is doing on a domain-joined machine anyway? Of course there are other ways of doing something similar in domain environments:

  • Settings determined by Group Policy
  • Default document location set to corporate shared folder
  • Roaming profiles

The odd thing though is that you can link a Microsoft account (SkyDrive, App Store account) to a domain account and you then end up with a mixture of consumer and corporate features which work in different ways. It would be tempting simply to block the use of Microsoft accounts completely – which you can do with group policy – especially if you are concerned about sensitive corporate documents arriving on consumer cloud services and mobile devices through the magic of sync.

It is also confusing that Office 365 users cannot use SharePoint in Office 365 to sync settings.

I also feel that the user interface in Windows 8.1 needs some work in this area. Here are some things I find odd:

Applications like Paint and Notepad use a principle of “default to where you last saved.” This means that even if you set SkyDrive as the default document location, if you save once to the documents or pictures folder on the PC, it will default to that local destination next time you use it.

Since both SkyDrive and the local PC have a folder called Documents, it would be easy not to notice.

Office 2013 is even more confusing. I have Office 365, so when I hit save in Word I get offered Office 365 SharePoint, SkyDrive, “Other web locations” which includes an on-premise SharePoint, and Computer. Oddly, if I hit Computer, the default location is SkyDrive:

image 

Much of this confusion is a legacy problem as Microsoft attempts to transition Windows to become a cloud-centric OS, but it could be better done. I would suggest clear naming to help users know whether a save location is local or cloud. Most of all, I would like to see consistency between consumer and corporate deployments so that a domain-joined PC can have the same options that work in the same way, except that data is stored to a corporate location.

microsoft, windows

How to change a network from public to private in Windows 8.1

9 Comments

So I arrive at a hotel and turn on wi-fi and connect. That little dialog comes up, Do you want to find PCs devices and content on this network? The correct answer in a hotel is No, but in my jet-lagged stupor I click Yes. Oops.

image

No problem, just change it, right? Hmm. Go to the Network and Sharing center and it is not obvious how to change the profile of a network. It tells me that the network is Private, but the setting seems to be read-only:

image

Not much of a Network and Sharing Center if you cannot change this setting; but never mind. How about just “forgetting” the network so that the dialog reappears?

I took a look here. Press and hold a network in the list to forget it. Unfortunately this does not work in Windows 8.1, and apparently that is by design.

OK, so try the command line:

netsh wlan delete profile name="ProfileName"

The profile name in this context is the wi-fi SSID. Seems to work; but when I reconnect the profile dialog does not appear. Apparently the network is not fully “forgotten”.

There is a way. Regedit, and go to:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

and find the GUID that matches your network, in my case Network 11.

image

Delete this profile. Do the command line thing as well to delete the profile. Now the network really is forgotten. Reconnect, the profile dialog comes up again, and now you can choose Public.

There must be an easier way though. Anyone know the user-friendly way to fix things when you accidentally select the wrong profile for a connection?

Update

It seems that this is meant to be set in Charms – PC Settings – Network. In fact, you can do it for wired connections. Here is what I get if I tap a wired connection, which I presume changes the profile:

image

However, if I tap a wireless connection I get this:

image

This looks like a bug to me, either with my 8.1 install or more generally.

exchange, microsoft

Preventing auto-archive of Tasks in Office 365 with Retention Tags

1 Comment

I helped a contact set up Office 365 and encountered a curious problem.

He is a financial adviser and as part of his workflow, he uses tasks with a due date set far into the future. For example, “Call this client in two years time”.

He has an Office 365 E3 plan, which gives him enterprise-quality retention and archiving features.

We enabled archiving which by default means that messages over two years old are moved to an online archive mailbox.

He then noticed that tasks were disappearing. Then he found them in the archive mailbox. Some of the tasks that were being archived were the ones for action right now.

Why does Exchange archive tasks that are just on or even before their due date? It seems odd; but read this post carefully:

  1. A non-recurring task expires (or moves to the archive) according to its message-received date, if one exists.
  2. If a non-recurring task does not have a message-received date, it expires (or moves to the archive) according to its message-creation date.

You might not think that tasks are messages; but in Exchange everything is a message, kind-of. Nowhere does this post by Ross Smith at Microsoft refer to the task’s due date. That seems curious; but the evidence from both this post and our experience is that Exchange will indeed archive a task, regardless of its due date, if it is older than the archive period.

No problem, I thought, we’ll just set the Tasks folder not to auto-archive. Forget the folder properties though; this is Enterprise stuff set by policy and there is no auto-archive tab:

image

OK, so we have to look at the policies. This gets a little complex. If you right-click a folder in Outlook Web App, after enabling online archiving, you will notice an Assign Policy option which refers to both Archive Policy and Retention Policy:

image

However, you cannot right-click Tasks and choose “Personal never move to archive”. Nor can you use Policy tab that appears in Outlook (provided you have the right version) for most folders:

image

The Tasks folder is special. It inherits the default archiving policy for the mailbox, which cannot be overridden.

Here is how we have (I hope) fixed this. What you have to do is to set a default archiving policy of “Never archive” and then override this for the folders that you do want to archive. A bit backwards, but there it is.

You can do this either through the Office 365 Exchange admin screens, or with PowerShell. First, go to Compliance Management and select Retention tags.

Why are we looking at Retention tags and not Archive tags? The reason, as far as I can make out, is that what Microsoft calls in some places the Archive policy is implemented as a Retention policy with Action “Move to Archive”. Therefore, we have to create a new Default Retention Tag which specifies Never archive:

image

Now go to the Retention Policies tab. By default there is a single Default MRM policy. You can either amend this, or create a new policy. A policy is defined by a collection of Retention tags. The key tag in this instance is “Default 2 year move to archive”. You can either remove this and replace it with “Default never archive”, or create a new policy including “Default never archive”. It seems that Retention policies work better if they have a Default tag of some sort, so I suggest not omitting a Default tag altogether.

An Archive policy that never archives anything is not much use, so you should also include some Personal Retention tags. These let you override the default policy for specific folders, such as Inbox. You can also add Retention tags that apply automatically to specific folders (the Default MRM policy has examples for Junk Email and Deleted Items) but note that these cannot affect the Archive policy, as they cannot contain the action “Move to Archive”. Only Default and Personal tags can include Archive policy.

Finally, if you created a new policy rather than amending Default MRM Policy, you have to apply it to the mailbox. Go to Recipients, select the mailbox and click Edit, select Mailbox features, and change the Retention Policy.

image

Note that the archive policy doesn’t seem to be applied until the archiving process next runs, which by default is every seven days. You can kick it off in PowerShell like this:

Start-ManagedFolderAssistant -Identity <name of the mailbox>

My opinion: that is a lot of work simply to have Tasks not auto-archive. But on the plus side, it gives you a good understanding of how archiving and retention policies work in Office 365.

If you know an easier way, please let me know!

Further reading:

Set Up and Manage Retention Policies in Exchange Online with Windows PowerShell

Apply Retention Policies and Archive Policies to Your Messages

Changing the Organization’s Default MRM Policy (Default Retention Policy)?

.net, development, microsoft, professional, software development, windows, windows 7

ComponentOne’s TouchToolkit for Windows Forms: another approach to the Windows tablet problem

1 Comment

Software component vendor ComponentOne has released Studio Enterprise 2013 v2.5, the latest in its suite of components, with support for Windows 8.1 and Visual Studio 2013.

The piece that caught my eye is the TouchToolkit for Windows Forms.

image

Here’s the problem. The Windows desktop is poor with touch control, which is why Microsoft created Windows 8 with its alternate, touch-friendly Windows Runtime platform. However users are resistant to the changed user interface, and it does not help with existing desktop apps.

Developers are also faced with a question of simple mathematics. Develop a Windows 8 Store app, get a market of x. Develop a Windows desktop app, get a market of many times x, since Windows 8 can run desktop apps, but Windows 7 cannot run Store apps.

Embarcadero approached this problem with a framework called Metropolis, for Delphi and RAD Studio. It builds apps that mimic the Windows Runtime look and feel, but which are actually desktop apps. Of course they do not run on Windows RT, the ARM version. It is a confusing solution in my opinion, leading users into what Martin Fowler calls the Uncanny Valley, where stuff works almost but not quite how you expect.

I prefer the thinking behind the TouchToolkit. Take your existing Windows Forms apps, or write a new one, using these controls to make them more touch-friendly. They will never be as well suited to touch control as a Store app, but they might be good enough, and of course will run on Windows 7 and earlier versions.

The controls include a magnifier, support for zoom gestures, and a touch event provider that adds gesture support to any control.

Windows Forms, we all know, is not as good as WPF if you want an application that scales nicely and supports modern design. On the other hand, Windows Forms is pragmatic and easy to use framework that remains popular for line of business apps.

microsoft, mobile, nokia

Microsoft acquires Nokia’s device business: a risky move for Windows Phone

1 Comment

Microsoft is to acquire Nokia’s device business:

Microsoft Corporation and Nokia Corporation today announced that the Boards of Directors for both companies have decided to enter into a transaction whereby Microsoft will purchase substantially all of Nokia’s Devices & Services business, license Nokia’s patents, and license and use Nokia’s mapping services.

Nokia’s Stephen Elop is no longer CEO:

Stephen Elop, who following today’s announcement is stepping aside as Nokia President and CEO to become Nokia Executive Vice President of Devices & Services

The plan is that Elop, together with other executives from his team, will move to Microsoft. This is a circle completed for Elop, who was formerly in charge of Microsoft Office.

Nokia is retaining its patent portfolio, but licensing its patents to Microsoft for a 10 year term. 

Microsoft is acquiring approximately half of Nokia’s business overall, but all of its phones including the low end Asha range.

What are the implications for Windows Phone? One the face of it, the deal makes some sense. Nokia was the only Windows Phone OEM making real efforts to support and establish the platform, and has a large market share within the Windows Phone market. Although Windows Phone is struggling versus the iOS and Android giants, to Nokia’s credit it has established itself as a firm number three, ahead of Blackberry, and done some impressive work especially with the camera element.

Nokia has also managed to push out low-end but still capable Windows Phones at keen prices, and it is this more than anything else that has won it increasing market share. Recently, Kantar published a report showing solid gains for the platform:

Windows Phone, driven largely by lower priced Nokia smartphones such as the Lumia 520, now represents around one in 10 smartphone sales in Britain, France, Germany and Mexico. For the first time the platform has claimed the number two spot in a major world market, taking 11.6% of sales in Mexico.

What will be the effect of the acquisition on the Windows Phone platform and ecosystem? On the plus side, it gives Elop’s team access to more funds and removes any uncertainty surrounding Nokia’s future. If Microsoft keeps the proven team and its design and manufacturing expertise together, this could work.

There are obvious risks though. Without Nokia, Microsoft did a poor job of marketing Windows Phone, and while some of that is down to half-hearted hardware partners, Microsoft was also to blame for poor execution. Now that Nokia is Microsoft, there is a danger that its effectiveness will slip back.

Another question is how this will impact the other Windows Phone vendors, such at HTC and Samsung. Nokia already seemed to be a favoured partner, so perhaps little will change, but it seems unlikely that this will energise the other partners and it may have the opposite effect. The Windows OEMs hate Microsoft’s efforts with Surface (even though it was their own failings that forced Microsoft into the venture) and the phone vendors may well feel the same about Micro-Nok.

There is now no non-Microsoft smartphone vendor for whom Windows Phone is anything but a small sideshow. That could change, but it is not a sign of health.

Whether Nokia was right to embrace Windows Phone rather than Android is an open question; and perhaps it should not have abandoned its Meego (Linux) efforts, but given that it did both, it seems to me that Elop has performed well and was successfully growing the platform, albeit from a small base. Will he be allowed to continue that work at Microsoft, as well as gaining greater control over the software side of Windows Phone whose slow pace of development, it is rumoured, was a source of frustration to Nokia?

Alternatively, history tells that Microsoft can suffocate its acquisitions (remember Danger?).

Personally I like Windows Phone. When I looked at a Samsung Android recently, I was struck by how disorganised and confusing an Android smartphone can be, though impressed by its capability. Windows Phone is decent and I hope it carves out a reasonable market share.

The risks, though, are obvious.

microsoft, security

Hands on with Microsoft’s Azure Cloud Rights Management: not ready yet

1 Comment

If you could describe the perfect document security system, it might go something like this. “I’d like to share this document with X, Y, and Z, but I’d like control over whether they can modify it, I’d like to forbid them to share it with anyone else, and I’d like to be able to destroy their copy at a time I specify”.

This is pretty much what Microsoft’s new Azure Rights Management system promises, kind-of:

ITPros have the flexibility in their choice of storage locale for their data and Security Officers have the flexibility of maintaining policies across these various storage classes. It can be kept on premise, placed in an business cloud data store such as SharePoint, or it can placed pretty much anywhere and remain safe (e.g. thumb drive, personal consumer-grade cloud drives).

says the blog post.

There is a crucial distinction to be made though. Does Rights Management truly enforce document security, so that it cannot be bypassed without deep hacking; or is it more of an aide-memoire, helping users to do the right thing but not really enforcing it?

I tried the preview of Azure Rights Management, available here. Currently it seems more the latter, rather than any sort of deep protection, but see what you think. It is in preview, and a number of features are missing, so expect improvements.

I signed up and installed the software into my Windows 8 PC.

image

The way this works is that “enlightened” applications (currently Microsoft Office and Foxit PDF, though even they are not fully enlightened as far as I can tell) get enhancements to their user interface so you can protect documents. You can also protect *any* document by right-click in Explorer:

image

I typed a document in Word and hit Share Protected in the ribbon. Unfortunately I immediately got an error, that the network location cannot be reached:

image

I contacted the team about this, who asked for the log file and then gave me a quick response. The reason for the error was that Rights Management was looking for a server on my network that I sent to the skip long ago.

Many years ago I must have tried Microsoft IRM (Information Rights Management) though I barely remember. The new software was finding the old information in my Active Directory, and not trying to contact Azure at all.

This is unlikely to be a common problem, but illustrates that Microsoft is extending its existing rights management system, not creating a new one.

With that fixed, I was able to protect and share a document. This is the dialog:

image

It is not a Word dialog, but rather part of the Rights Management application that you install. You get the same dialog if you right-click any file in Explorer and choose Share Protected.

I entered a Gmail email address and sent the protected document, which was now wrapped in a file with a .pfile (Protected File) extension.

Next, I got my Gmail on another machine.

First, I tried to open the file on Android. Unfortunately only x86 Windows is supported at the moment:

image

There is an SDK for Android, but that is all.

I tried again on a Windows machine. Here is the email:

image

There is also note in the email:

[Note: This Preview build has some limitations at this time. For example, sharing protected files with users external to your organization will result in access control without additional usage restrictions. Learn More about the Preview]

I was about to discover some more of these limitations. I attempted to sign up using the Gmail address. Registration involves solving a vile CAPTCHA

image

but got this message:

image

In other words, you cannot yet use the service with Gmail addresses. I tried it with a Hotmail address; but Microsoft is being even-handed; that did not work either.

Next, I tried another email address at a different, private email domain (yes, I have lots of email addresses). No go:

image

The message said that the address I used was from an organisation that has Office 365 (this is correct). It then remarked, bewilderingly:

If you have an account you can view protected files. If you don’t have an Office 365 account yet, we’ll soon add support…

This email address does have an Office 365 account. I am not sure what the message means; whether it means the Office 365 account needs to sign up for rights management at £2 per user per month, or what, but it was clearly not suitable for my test.

I tried yet another email address that is not in any way linked to Office 365 and I was up and running. Of course I had to resend the protected file, otherwise this message appears:

image

Incidentally, I think the UI for this dialog is wrong. It is not an error, it is working as designed, so it should not be titled “error”. I see little mistakes like this frequently and they do contribute to user frustration.

Finally, I received a document to an enabled email address and was able to open it:

image

For some reason, the packaging results in a document called “Azure IRM docx.docx” which is odd, but never mind.

My question though: to what extent is this document protected? I took the screen grab using the Snipping Tool and pasted it into my blog for all to read, for example. The clipboard also works:

image

That said, the plan is for tighter protection to be offered in due course, at lease in “enlightened” applications. The problem with the preview is that if you share to someone in a different email domain, you are forced to give full access. Note the warning in the dialog:

image

Inherently though, the client application has to have decrypted access to the file in order to open it. All the rights management service does, really, is to decrypt the file for users logged into the Azure system and identified by their email address. What happens after that is a matter of implementation.

The consequences of documents getting into the wrong hands are a hot topic today, after Wikileaks et al. Is Microsoft’s IRM a solution?

Making this Azure-based and open to any recipient (once the limitation on “public” email addresses is lifted”) makes sense to me. However I note the following:

  • As currently implemented, this provides limited security. It does encrypt the document, so an intercepted email cannot easily be read, but once opened by the recipient, anything could happen.
  • The usability of the preview is horrid. Do you really want your trusted recipient to struggle with a CAPTCHA?
  • Support beyond Windows is essential, and I am surprised that this even went into preview without it.

I should add that I am sceptical whether this can ever work. Would it not be easier, and just as effective (or ineffective), simply to have data on a web site with secure log-in? The idea of securely emailing documents to external recipients is great, but it seems to add immense complexity for little added value. I may be missing something here and would welcome comments.

 

 

 

 

 

 

 

 

 

 

had to sign in twice since I didn’t check “Remember password!"

image

If you try recursion, it will package the already packaged file.

microsoft

Microsoft completes Windows 8.1, it says, but developers are unable to test their apps

Microsoft has released Windows 8.1 to its hardware partners according to VP Antoine Leblond; but developers will be unable to test whether or not their apps work on the updated operating system until it is also in the hands of users:

While our partners are preparing these exciting new devices we will continue to work closely with them as we put the finishing touches on Windows 8.1 to ensure a quality experience at general availability on October 18th. This is the date when Windows 8.1 will be broadly available for commercial customers with or without volume licensing agreements, our broad partner ecosystem, subscribers to MSDN and TechNet, as well as consumers.

One reason for subscribing to MSDN is to get early access to new versions of Windows for test and development, so this is a surprising and disappointing move.

We pay thousands for MSDN access so we can test our software/apps properly, early testing, before GA, is an important part of that process! We don’t care about a couple of bugs in your OS, we about bug in our software. Most of us actually want to support Windows 8.1, a lot of us want to get apps ready for the awesome 8.1 features, but we can’t properly do that unless we get the RTM bits before the public gets the Windows 8.1 update!

says one comment to Leblond’s post.

It is hard to make sense of Microsoft’s reasoning here, though Microsoft’s Brandon LeBlanc comments that despite the RTM (Release to Manufacturing), Windows 8.1 is not altogether finished:

We are continuing to put the finishing touches on Windows 8.1 to ensure a quality experience at general availability

he says.

Windows 8 needs more high quality apps in order to win users over to its new tablet-friendly user interface, so it is unfortunate that Microsoft is not doing more to help developers support it.

microsoft

On Steve Ballmer and Microsoft’s future

1 Comment

The announcement that Microsoft CEO Steve Ballmer will retire “within the next 12 months” prompts some quick reflections on Ballmer and the state of his company.

Ballmer suffers from lack of charisma on stage, and this combined with missteps like failing to compete effectively in mobile devices, nearly buying Yahoo at a ludicrous price, the Kin debacle, making far too many Surface RT devices, and the poor reception overall for Windows 8, means that Ballmer’s time as CEO may be judged harshly.

image

Many commentators seemingly forget that Microsoft’s financial results under Ballmer have been generally excellent. Further, if we blame Ballmer for the various blunders that occurred during his time as CEO, we should also credit him for the successes, like Windows 7, the steady improvements in Windows server, and the market success of Xbox versus Sony PlayStation (though not forgetting the red ring of death nor the numerous loss-making quarters for entertainment and devices).

Nor would it be correct to portray the Ballmer years as conservative turn-the-handle profit making from Windows and Office. Under Ballmer, Microsoft is transitioning towards the cloud with Office 365 and Windows Azure (with considerable success), and he was willing to take bold steps with both Windows (“reimagined” in Windows 8) and Office (moving towards a subscription model).

It is worth noting too that by all accounts Microsoft is not an easy company to direct. From my perception, its overly bureaucratic and somewhat dysfunctional management style was allowed to develop under former CEO Bill Gates, and while you can blame Ballmer for failing to fix it, the last reshuffle shows his effort to pull the company towards a more collaborative and efficient way of working:

We are rallying behind a single strategy as one company — not a collection of divisional strategies. Although we will deliver multiple devices and services to execute and monetize the strategy, the single core strategy will drive us to set shared goals for everything we do. We will see our product line holistically, not as a set of islands. We will allocate resources and build devices and services that provide compelling, integrated experiences across the many screens in our lives, with maximum return to shareholders. All parts of the company will share and contribute to the success of core offerings, like Windows, Windows Phone, Xbox, Surface, Office 365 and our EA offer, Bing, Skype, Dynamics, Azure and our servers.

What should the new CEO, and Ballmer in his final months, do now? I will refer to you to this interview with Scott Guthrie about what happened when he was reshuffled, along with several other Microsoft execs, to take on Windows Azure. Just to remind you, Azure was not a success when first launched, being both difficult to use and poorly presented by Microsoft.

We did an app building exercise about a year ago, my second or third week in the job, where we took all the 65 top leaders in the organisation and we went to a hotel and spent all day building on Azure," said Guthrie. "We split up everyone into teams, bought a credit card for each team, and we said: ‘You need to sign up for a new account on Azure and build an app today. It was an eye-opening experience. About a third of the people weren’t able to actually sign up successfully, which was kind of embarrassing. We had billing problems, the SMS channel didn’t always work, the documentation was hard, it was hard to install stuff.

“We used that [experience] to catalyze and said: ‘OK, how do we turn this into an awesome experience?’ We came up with a plan in about four to five weeks and then executed.”

Azure was based on decent technology, but prior to the changes Guthrie describes, it was a relatively hostile platform for developers. Put another way, it was not so much the strategy that was wrong, as the way it was executed.

I recall similar comments from the former Windows chief Steven Sinofsky about how Windows 7 was designed, based on what users found annoying in Windows Vista.

Something I see frequently at Microsoft is good ideas poorly executed or spoilt by errors of detail, and Ballmer could have done more to insist on higher standards. Recently I have been working with Office 365, and while the underlying platform is strong, working with it can be infuriating. It needs Guthrie’s approach: get people to try the product, watch what goes wrong, and fix it.

Microsoft’s devices and services strategy makes a lot of sense but the company needs more attention to detail to make it work.