Microsoft Technology Licensing, LLC

George Ringer

Jeromy Scott Statia

Karin Meier-Magruder

Daniel Dawson

Charles McDaniels

Shawn Becker

David Wells

Elizabeth Anne Phippen

Raymond Keith Linz

Aaron Richard Davis

Alexandr Tcherniakhovski

Darrin Earl Curtis

Douglas Anthony Rasler

Brad Turner

Satish Devan

Dayne Allen Thompson

Jeffrey Ryan Bacon

William T Boyd

Bum Su Jung

Daniel R Cornell

Bennett L Warriner

David S Riley

Derek Ingalls

Charles Mcdaniels

Confining lateral traversal within a network. An authorization request identifies a credential, a protected first resource, and an identifier of a protected second resource for which authorization is requested. A lateral traversal policy associated with the second resource is identified, which constrains access to the second resource to only resources that belong to a subset of resources including the second resource. When it is determined that the credential is configured for access to the second resource, and when it is determined that the first resource belongs to the subset of resources including the second resource, an authorization token is issued, which authorizes the credential to access the second resource via the first resource. Alternatively, when it is determined that the credential is granted access to the second resource, and when it is determined that the first resource is outside of the particular subset of resources, the authorization request is denied.

Confining lateral traversal within a computer network

A system discloses providing secure remote desktop session host experience to a user for a selected application while controlling the user's access to non-core functionalities of the selected application. An implementation of the system disclosed herein identifies a non-core functionality of an application running on a server, flags the executable files, shared object library files, and the registration keys necessary for the non-core functionality of the application, and disables the application's access to the identified executable files, the identified shared object library files, and the identified registration keys.

Secure remote desktop session

In one embodiment, a change data monitoring system may gather change data from multiple data sources each with a different proprietary source format. The change data monitoring system may receive a change data report having a change data set describing changes made to an online system from a data source of a data source set tracking the online system using multiple proprietary source formats. The change data monitoring system may convert the change data set from a proprietary source format to a standardized data presentation format. The change data monitoring system may present the change data set to a user in the standardized data presentation format.

Real-time change data from disparate sources

Examples related to secure computing systems are disclosed. In one example, a method includes, at a local agent computing device, sending to a remote work scheduling computing device a work context of the local agent computing device, the work context describing a set of work that the local agent is configured to execute, and polling a remote work depository for work compatible with the work context. The method further includes receiving a response from the remote work depository identifying a job within the work context, the job being requested by a computing device other than the remote work scheduling computing device, and executing the job.

Secured computing system

Embodiments are directed to automatically controlling network and service quality across datacenters. In one scenario, a computer system identifies portions of work that are to be performed within the datacenter. The computer system creates a request for change (request) in a change management system, where the change management system is configured to store and manage the implementation of requests within the datacenter. Then, upon implementation of the created request, the computer system polls the status of the request to determine whether the portions of work identified in the request can now be performed and, upon determining that the portions of work identified in the request can be performed, the computer system performs the portions of work according to the request. Performance of the specified work according to a request allows for workflows to be controlled based on the request.

Automated network control

Example apparatus and methods manage membership in a collection of servers participating in providing a service. An example device may provide a user interface that provides a single coherent view of the in-service state (e.g., in-service, out-of-service) of members of the collection of servers. The example device may also provide a request monitor that selectively blocks a membership request to a target device when the membership request will cause the set of functionalities to be suspended. If a service manager tries to take the only in-service server out-of-service, the action may be selectively blocked and the service manager may receive a notification of the potential result of the action. Taking a server out-of-service may include stopping messages from flowing to the server.

Managing server membership

Growing community of inventors

Mercer Island, WA, United States of America

George Ringer