or folder level with butter. It's cool from like a home hobbyist perspective. From a more professional perspective it can partially be cool and partially be just horrifyingly sloppy where you kind of can't keep track of everything that's going on. The other big thing that butter has that everybody has wanted for like forever is it's got on the fly a reconfiguration of rate. So I mentioned with ZFS you've got a pool and you can add VDev to the pool. What you can't do is you can't change a VDev really once you've created it. Once you've created for example a 6-disk grade Z1 which is basically like a grade 5, right? So you've got the capacity of 5 disks in the 6-disk VDev and you've got one disk worth of parity distributed through it, right? Well you can't add another disk to that. That's a 6-disk grade Z1 VDev from now until forever. You could add another 6-disk grade Z1 VDev into the same pool but now that one's immutable too. You can replace the disks in the VDev with bigger disks and once you've done that with all of them you'll see the additional capacity but you can't just be like oh well now I want that to be a 4-disk VDev not a 6-disk or now I want that to be an 8-disk instead of a 6. It's just not that mutable. Butter? Butter in care. With butter you can have a 5-disk grade Z1 add or I'm sorry a 5-disk, a butter grade one, add another disk and yay! Now it's a 6-disk. You don't even have to rebalance anything. You can rebalance it if you want to. You can even convert that butter grade one array that you already have into a grade five array on the fly. Just tell it, hey butter, that grade one make a grade five. It'll do it. You can keep using your computer while it's going on. Of course it may catch on fire the next day but you know that's butter. So you know portability, what systems can you use this on? You know again I hadn't really intended to keep making such a big difference out of people's ages in here but it's kind of relevant. So you know those of us in here who are in our 40s or more have probably been through a lot of systems, a lot of different file systems, a lot of different computers and hopefully some of us have data now that they couldn't read that exists on computers existed on computers that aren't even around anymore and it had to make a lot of transitions. So the more of those kind of changes you've been through, the more important portability comes to you, the more crucial it gets that you don't feel like, okay well if this particular operating system is no more, my data is going to be no more along with it. You don't want that. Luckily both VFS and butter are open source file systems which insulates you from that tremendous degree. But VFS is not licensed under the GPL like the Linux kernel is. Unfortunately it's licensed under the CDDL affectionately or unaffectionately referred to as the Cuddle. The Cuddle was created specifically by Sun Microsystems back in the day to license ZFS and Dtrace and some of their other intellectual properties under. Basically because Scott McNeely hated Linux. So they designed, it was based on the Apache licenses I recall and it's a very open license. It's not restrictive but it has just the right clauses in there. They felt like it would be impossible to combine Cuddle code with GPL code so he wouldn't have to feel like his hated high school rival Linux Torvalds would be able to use his stuff. Fast forward close to a couple of decades and there's a lot of controversy about that now. ZFS is very much available on Linux. It was available first as a Fuse file system which basically meant that it ran in user space not in kernel space which allowed you to separate the two so it wouldn't be a problem. It's also available as a loadable kernel module. The ZFS on Linux project is very mature. Those of you who are kind of interested in ZFS but haven't really gotten your feet wet too much may have heard a whole bunch of rumors that ZFS on Linux sucks that it's not reliable, that it's flaky, whatever. I can tell you right now that is not the case. I've been using it in very wide production for four or five years and it is awesome. With that said, there was always a question like, okay, there's no doubt that you're within your legal rights to use Cuddle code and GPL code kind of mush together. The question was, can you distribute Cuddle code and GPL code mush together? And everybody kind of assumed that you couldn't because that was what Scott McNeely was going for back in the day and everybody just kind of assumed that was the case. But ZFS and also Dtrace, they are awesome properties. And people have sort of been like, man, we really want to use this in the operating system that we actually care about. And they started looking at that a lot harder. And you have some folks like the Software Freedom Conservancy and the Free Software Foundation who still adhere to the position that no, it's not GPL. You can't use it with GPL code. Bad. You have a lot of other folks, actual intellectual property lawyers. I'm not just talking random people talking off the bar stool who have taken long hard looks at the code, at the licenses and said, you know what, I think this would stand up in court. I think we would totally be okay distributing this. Nobody has actually challenged it yet. The folks on the side of light, I have a very affectionate to Free Software Foundation and the Software Freedom Conservancy and all those folks. I'm a big believer in GPL enforcement. There are a few really good reasons that they haven't tried to challenge any of these ZFS projects. And one is that ultimately they are in favor of free software. We're all in favor of free and Libre software. The question comes down to whether you believe that endorsing these products is going to weaken the GPL or not. And again, opinions vary. What I can also tell you is that these folks are working very hard to lean on Oracle. If you don't pay attention to politics of the industry, a few years ago Scott McNeely had another hated high school rival and I'm using that loosely. I'm not saying they actually went to high school. Oracle. And Oracle won that particular grudge match and bought Sun and kicked Scott McNeely out to, well, you know, send them to that farm upstate to play with the other puppies. And so now Oracle owns ZFS and owns Dtrace and Oracle has been distributing Dtrace and their unbreakable Linux distro. And some of these folks on the GPL enforcement side have been leaning on them really heavily about that and being like, okay, look, you own this property and you really, really want to use it in Linux. So for the love of all it's holy, do it the right way. You need to do what you need to do and re-license this GPL so all these thorny issues go away. I have been told that they've been making progress on that front. They hope to make that a reality. But for right now, that's where we're at. We've got some folks fighting the good fight who think that it's wrong to distribute these things together. We've got some intellectual property attorneys who say, man, we have looked at that and we are really, really certain this would be totally fine if it got challenged in court, but it's kind of up in the air. Butter on the other hand, GPL. Part of the kernel. Don't have to worry about it. Just have to worry about it eating your data. One cool thing about butter is it scales down really well. There's a project, JOLA, Smartphone Project. The JOLA devs are like, I mean, no kidding, they are running butter on their phones to give you an idea of how well butter scales down. ZFS does not scale down that far. It's just kind of not really what the ZFS devs are truly interested in doing at this point. Most of the issues that prevent it scaling down could be fixed, but to give you some idea of where they are at, you can no longer really reliably run it on a 32-bit system. You really need a 64-bit operating system to play with butter. Now, with that said, there are some places that I won't mention, pretty bad forums, where you'll see people just tell you that you have to have this crazy unobtainium machine like, oh, you've got to have 16 gigs of RAM bare minimum and it needs to be 1 gig per terabyte of storage, so maybe more than that. And you've got to have an Intel processor. AMD's are terrible and you can't have a real technique. You've got to, things get kind of crazy in those forums. You really should not take that at face value. What you truly really need is a couple of gigs of RAM and a 64-bit processor. If it's AMD, that's fine. I can tell you I've run this stuff in production with real-world usage data depending on it, on like the cheapest possible AMD processors. Both the A3400, a little APU, cost about $40. There's also a little Tinkertoy processor called the Cabini, cost like $35 for the processor on a board. Most of them don't even have fans on them, if they do. There's a little teeny, teeny tiny ones that barely spin. ZFS works fine on those. So you don't actually need tons and tons of hardware. With that said, unlike butter, if you have more hardware, ZFS will totally make use of it. If you've got a ton of RAM, you've got a ton of RAM for that wonderful, wonderful art cache and you will feel the difference. So it's great to have it. Future proofing. So you don't ever want to bet against the GPL. I've said this in the original version of this talk three years ago and at the time I kind of interpreted that to mean I thought butter was just going to take off and leave ZFS in the dust because it didn't have the licensing problems. Unfortunately, the butter developers didn't really do what would have been necessary for that to happen. It's still not reliable, so it can't really take off. In the meantime, things have kind of gone the other way. Instead of butter getting closer to reliable, ZFS has gotten closer to being GPL. It's still something that we're looking for very hard to happen.  We had Mark Shuttleworth addressing the audience out here. I don't know how much they talked about this, but the next LTS release of Ubuntu that drops in April, Xenial Zeras, ZFS is going to be in the main repos. You don't even need to hit PPA anymore. You can just install it direct out of the repos. I imagine it's probably a universe instead of main, but either way, I mean, it's coming direct out of Canonical. So that's pretty cool. Fodder may eventually be a default Linux file system. Three years ago, I would have sworn up and down that by the time I was talking to you today, it would have been the default file system everywhere, because I mean, once you get used to these next-gen features, it is like actual physical pain to have to manage a system that doesn't have all these things.  We're all going to be running butter, because why wouldn't we? But unfortunately not. Still could happen eventually. All right. So we've got a few minutes left, and who wants to see a live demo? Anybody? Awesome.  So first thing that...  All right. I'm going to bring up a VM here, and this is going to be fun, because I'm kind of going to have to type blind. Let's drag this thing over here. And now you know what, I lied. We're going to mirror this, because this is just painful. I think we've got time for that. Displays. Mirror. You know, let me mirror it. Now we'll just have to type blind. That will be fun. Urban2TrustEVM here. I'm sure this VM is actually on ZFS. I'm running ZFS on my laptop here. All right. Cool. So... I actually need to give that the focus first, fair enough. We've got our super... And now let's do something incredibly... I can't even see. Can anybody tell when I'm like actually over the terminal icon? Can I click now? Dash, dash. No, it was that in the dev file system, because I can't remove stuff from dev or proc. Now our next challenge... Now let's drag this over here where I can't see what I'm typing. Now this is on my actual laptop, not in the VM.  Okay, now we're root there. And we do a ZFS list, RTC, Images, Urban2TrustEVM... Oh, I'm going to drag this over here so I can see what I'm doing. And then I'll drag it back so you can see what I did. If I could only mirror. All right. Well, Urban2TrustEVM working, that's the problem. The snapshot's down here. Not being able to see is miserable. All right, so I'm going to do a ZFS rollback to my last snapshot, which was an hourly, which was automatically taken at five o'clock. I'll be paced. I'll drag this back over there so you can see it. Or most of it, because man, the resolution is low on this projector. All right, so hit enter and you probably can't really see anything, but there we go. So the ZFS rollback, ZImages, Urban2TrustEVM working, blah, blah, blah, and it rolled it back and that's pretty much it. So now we go back to our VM, which I really should have forced off for that actually. I can usually kind of crane my neck and see what's going on better than this when you can see what you're typing. It really is. Hopefully that was kind of painful for me, but keep in mind that like literally I just restored a system that I RMRFNoPreserve root on while I couldn't see what I was doing to the side of me in a couple of minutes. So that's a lot better than having to go to tape or whatever else you might do for backup. So the other part that is kind of hard to demonstrate here is I could replicate the whole thing to another box as well. Esther in the back. Not on Linux, no. It's technically possible, but it's hideously difficult and would be a pain to manage. So I don't think that that's a win for me. On my own like workstations, I'll make like my home directory will be ZFS and obviously my VM storage is ZFS. I don't really try to mess the root file system because it's replaceable anyway. I mean it's a 15 minute OS reinstall away. So stuff that I really care about is like my configs, my actual data that might go in my home directory or an opt or like I said, storage. The question was would I make home on ZFS? And yes, I absolutely do because there's stuff that I really care about on home that I can't just get back with a quick app to get after a 15 minute reinstall. But better than that honestly is just don't wear possible. I mean so what you're asking is kind of an edge case for me. That's like my personal workstation. Really where the really important stuff happens is on servers and the whole server is a VM on top of ZFS. So the whole thing is an image just like what we just saw with that one there. So like everything's covered. Can you say that again please? Okay, so the question was it sounds like my deployment started on BSD and then moved to Linux and the answer is yes that's true. There were a couple of years where every time I set up a server I had the extremely uncomfortable question to ask myself did I want package management that was sane or did I want a file system that I could truly trust and I had to pick one or the other I couldn't have both. Once the ZFS on Linux dropped and got stable I no longer had to make that choice. I could now have apps package management. I could have the Linux kernel. I could have all those things that I really, really seriously wanted and have it on ZFS and that turned into a no-brainer. I didn't just immediately reformat all my BSD boxes overnight but I did stop deploying any new ones because prior to that my BSD boxes they had for a while. I used to do everything on BSD and like you know I would install Samba on BSD for file servers and offices and you know I would run Apache web servers and blah blah blah. But the issue that I came across was that while using the ports tree was awesome in the late 90s and early 2000s as the security situation got worse and as you know public internet access to like you know things that clients who want to publicly expose got you know more and more frequent I was less and less comfortable with BSD package management because it wasn't fast enough so I wasn't doing it often enough. I wanted to get to the point where I could literally just say you know after getting installed unattended dash upgrades and have security updates happen automatically while I slept and not have to worry about it and have it just work. And Debian gave me that and Ubuntu gives me that and free BSD didn't. So once I could have both those things on the same box it was no brainer for me and now everything goes on Ubuntu. So the question was is ZFS not kind of just a random collection of disks? And it's not really designed for that.  It's fine to have mismatched sizes in a pool but if you have them inside a VDev the VDev is going to be sized to the smallest of your sizes inside that VDev so you're going to waste a lot of capacity. The other issue is if you mix a lot of different type of disks and now this is not unique to ZFS. This is true for any way that you're going to mix and match a bunch of disks and you know one big storage pool whether it's ZFS or butter or kernel rate or hardware rate or whatever the performance of that array of storage is going to track the performance of the absolute worst member of that group of disks. And the worst part is that may not even be the same disk every time. If you've got six disks even if they're identical one of them may have a hiccup on a given read. Now if they have a hiccup on let's say one out of six reads with an ounce of having a hiccup on one out of six reads you're basically having a hiccup that affects your entire read operation on every single read.  So you kind of want to avoid doing that if you possibly can. So the question is what's the best practice for installing ZFS on a hardware rate controller and the best practice for that is don't do that. So here's the deal. ZFS doesn't want to be underneath hardware rate. ZFS wants to have direct access to the individual disks because it does the array management itself and it's frankly far, far better at it than you know some little chip on a rate controller somewhere. It has access to more RAM, faster processors, far better written code. And like for example if you were to set up a hardware rate 5 array and install ZFS on top of that remember we talked about all that awesome you know self healing stuff where you know it just rebuilds out of parity. Well ZFS can't do that because it can't see the parity as far as it's concerned it just has one big disk.  If you have a rate controller and you're determined to reuse it some rate controllers can be reflashed with like an IT mode firmware that will allow them to function as just a regular host bus adapter that gives you direct hardware access to the individual drives and if you can do that, do that give the individual drives to ZFS and your gold. Otherwise pull that thing out, check up the trash. Don't check up the trash, sell it on eBay. Somebody will want it and get a nice inexpensive host bus adapter and put that in your box or just use the ports on the motherboard and go from there. You there. Isn't really good at warning you about much of anything.  There are, and I'm a little rusty on butter now because I'm not as enthusiastic about it as I used to be but it's possible to see that it's degraded, you know, using tools like Butterfly Show or whatever but it's a little obtuse, it doesn't always catch everything and usually your best indication that you've got a degraded butter array is that it won't mount because by default and the butter devs think this is a great idea and can't be convinced otherwise and I know because I've tried really hard to convince them otherwise. Like if you lose one disk out of a butter array, now all your data is intact but the array is degraded, right? So if you reboot your system, yeah screw you, it won't reboot because it's degraded and in an order amount at all you have to pass the dash O degraded argument which if you don't have that in your grub, yeah it's not going to mount, it's not going to boot, you're just going to be staring at a grub prompt with no way to get the thing back up other than like now you've got to boot from alternate media that knows about butter that can go through, that can mount it, that can get to your grub, I found that one out the hard way and the butter devs like I said, they think that's a great idea and they don't think that should be changed.  There's a couple answers to that. One is that butter has a really really bad problem with not being able to reclaim blocks once the file system gets really full. That is a bug, it's butter specific, it's not a byproduct of some intended feature, it's just like oops, that's not as bad as it used to be but it is still an issue. The other thing is if you've taken snapshots just deleting a file that's referenced by that snapshot, no that does not reclaim the space. If you want to reclaim the space that was occupied by that file, every snapshot that references that block has to be destroyed before the block is actually reclaimed.


Now, you can probably say, how about the side kick? Well, you can do the side kick like this, and you can reach him, but the problem with that is that if I miss, a side kick, look where I end up. I don't want to be here, right? He's behind me, he's behind me, whatever he wants. So, what's a good kick to use? Well, there's the other kind here that you can use with your rear leg, so you can go like this. See, you can go like that. So instead of using your left lead leg, you're gonna use your rear leg. Come up, and kick this way.


The Methodist Church in Nigeria, Archdiocese of Kaduna, has produced the first female bishop that will preside over the diocese of Joss. Right Reverend Nkechi Musu was formally enthroned as a bishop of Joss by the Archbishop of Kaduna, most Reverend Joseph Nona at the Christ Methodist Cathedral Church in Joss, North Central Nigeria. In her remarks, Musu said, God has made all humans equal. She encouraged all Nigerians to always seek the face of God, especially as the general elections begin on February 25th. I think God is using what has happened in the Methodist Church in Nigeria to tell the whole world that the time to release women, to fulfill their destiny in the agenda of God is now. That without women and men joining their hands together, we will not be able to achieve the mandate of God, because it takes two to succeed. Even when God created, he knew that creating only Adam will not be able to bring his heart desire, so he had to make the woman to compliment him. So for the world of God to reach out to the ends of the world, men and women must put their hands together to serve God irrespective of gender. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


G'day Windows Server Hybrid Administrators. Welcome to this Learn Training Module. The title of this module is Implement Hybrid Identity with Windows Server. In this module, you'll learn about the following topics, understanding identity integration, synchronizing on-premises Active Directory domain services, leverage single sign-on, deploy as your ADDS and join Windows Server VMs to as your ADDS domains. This module functions as preparation for AZ800 Objective Domain 1, deploy and manage ADDS in on-premises and cloud environments. You can follow along with the contents of this module on Microsoft Learn at the address shown on the screen and listed in the video description. The Windows Server Hybrid Administrator Associate Certification is Microsoft's successor to the Windows Server MCSE. Certification has always been important for Windows Server Administrators and the Windows Server Hybrid Administrator Associate brings the old MCSE into the 2020s. To earn the certification, you need to pass two exams, AZ800 and AZ801. Being successful on the exam requires that you not only understand how to do common administrative tasks such as manage Active Directory, storage, networking, security, disaster recovery, monitoring and virtualization on-premises, just as you would have had to for the last few years of Windows Server. But also know how you can integrate and extend Windows Server with all of the relevant services that are available in Azure. As your AD is not Active Directory Domain Services ADDS in the cloud, instead it's an entirely new directory service designed for cloud-based and web-based applications which shares some functionalities with ADDS. For example, the Contoso IT10 can implement Azure AD and synchronize its on-premises identities to the cloud. These steps would enable Contoso staff to use SSO to access both on-premises resources and those related resources in there as your tenant. The IT team can use Azure AD to increase employee productivity, streamline IT processes and improve security for adopting various cloud services. Contoso employees can access online applications by using a single user account. Contoso can also perform central user management by using well-known Windows PowerShell command loads. It's also worth noting that because Azure AD is highly scalable and highly available by design, the IT team won't have to maintain related infrastructure or worry about disaster recovery. As a component of Azure, Azure AD can support multi-factor authentication as part of an overall access strategy for cloud services, thus providing an additional layer of security, role-based access control, self-service password, group management and device registration provide enterprise identity management solutions. Azure AD also provides advanced identity protection in addition to enhanced reporting and alerting that can help you recognize threats more efficiently. Azure AD is part of the platform as a service offering and operates as a Microsoft Managed Directory service in the cloud. It's not a part of the core infrastructure that customers own and manage, nor is it an infrastructure as a service offering. While this implies that you have less control over its implementation, it also means that you don't have to dedicate resources to its deployment or maintenance. With Azure AD, you also have access to a set of features that are not natively available in Active Directory domain services such as support for multi-factor authentication, identity protection and self-service password reset. You can use Azure AD to provide more secure access to cloud-based resources for organizations and individuals by configuring access to applications, configuring SSI to cloud-based SaaS applications, managing users and groups, provisioning users, enabling federation between organizations, providing an identity management solution, identifying a regular sign-in activity, configuring multi-factor authentication, extending existing on-premises Active Directory implementations to Azure AD, configuring application proxy for cloud and local applications, and configuring conditional access for users and devices. Unlike on-premises Active Directory, Azure AD is multi-tenant by design and is implemented specifically to ensure isolation between its individual directory instances. The term tenant represents an individual Azure AD instance. Within and Azure subscription, you can create multiple Azure AD tenants. Having multiple Azure AD tenants might be convenient if you want to test Azure AD functionality in one tenant without affecting the others. At any given time and Azure subscription must be associated with one and only one Azure AD tenant. However, you can associate the same Azure AD tenant with multiple Azure subscriptions. Each Azure AD tenant is assigned the default DNS domain name that consists of a unique prefix. The prefix is derived from the name of the Microsoft account you use to create an Azure subscription or provided explicitly when creating an Azure AD tenant and is followed by the on-Microsoft.com suffix. Adding at least one custom domain name to the same as your AD tenant is possible and common. This name utilizes the DNS domain namespace that the corresponding company or organization owns. For example, Contoso.com. The Azure AD tenant serves as the security boundary and a container for Azure AD objects such as users, groups and applications. Although Azure AD has many similarities to on-premises Active Directory, there are also many differences. It's important to realize that using Azure AD is not the same as deploying an AD-DS domain controller on an Azure VM and then adding it to your on-premises domain. When comparing Azure AD with AD-DS, it's important to note the Azure AD characteristics that differ from AD-DS. Azure AD is primarily an identity solution and it is designed for internet-based applications by using HTTP, port AD and HTTPS port 443 communications. Azure AD is a multi-tenant directory service. Azure AD users and groups are created in a flight structure and there are no organizational units or group policy objects. You cannot query Azure AD by using LDAP. Instead, Azure AD uses the REST API over HTTP and HTTPS. Azure AD doesn't use Kerberos authentication. Instead, it uses HTTP and HTTPS protocols such as Security Assertion Markup Language, SAML, Web Services Federation, AWS Federation and OpenID Connect for Authentication. It also uses Open Authorization, OAuth for Authorization. Azure AD includes Federation Services and many third-party services are federated with and trust Azure AD. Small organizations that don't have an on-premises directory such as AD-DS can fully rely on Azure AD as an authentication and authorization service. However, the number of these organizations is still quite small, so most companies search for a way to integrate on-premises AD-DS with Azure AD. Microsoft offers cloud-scale identity and access management via Azure AD, which provides several options for integrating AD-DS with Azure. The Azure AD directory is not an extension of an on-premises directory. Rather, it's a copy that contains the same objects and identities. Changes made to these items on-premises are copied to Azure AD, but changes made in Azure AD are not replicated back to the on-premises domain. Note that you can also use Azure AD without using an on-premises directory. In this case, Azure AD acts as a primary source of all identity information rather than containing data replicated from an on-premises directory. Directory synchronization enables synchronization between on-premises active directory and Azure AD for users, groups and contacts. In its simplest form, you install a directory synchronization component on a server in your on-premises domain. You then provide an account with domain admin and enterprise admin access to on-premises AD-DS and another account with administrator access to Azure AD and let it run. User accounts, groups and contacts that you select from AD-DS are then replicated into Azure AD. Users can then use those accounts to sign into and access Azure services that rely on Azure AD for authentication. Unless you activate password synchronization, users will have a separate password from their on-premises environment to sign into an Azure resource. Even if you implement password sync, users are still prompted for their credentials when they access the Azure resource on domain join computers. The advantage with password sync is that to sign into the Azure resource, users can use the same username and password as their domain login. Don't confuse this with SSI. The behavior provided with password sync is called same signing. With Azure, the synchronization flow is one way from local AD-DS to Azure. However, with Azure AD premium features, some attributes replicate in the other direction. For example, you can configure Azure to write passwords back to an on-premises AD-DS and to groups and devices from Azure AD. If you don't want to synchronize your entire on-premises AD-DS, directory synchronization for Azure AD supports limited filtering and customization of attribute flow based on the following values, OU, domain, user attributes and applications. You can use Azure Active Directory Connect, Azure AD Connect to perform synchronization between on-premises AD-DS and Azure AD. Azure AD Connect is a wizard-based tool designed to enable connectivity between an on-premises identity infrastructure and Azure. Using the wizard, you can choose your topology and requirements and then the wizard deploys and configures all the required components for you. Depending on the requirements selected, this can include Azure Active Directory sync, Azure AD sync, exchange hybrid deployment, password change right back, ADFS and ADFS proxy servers or web application proxy, Azure AD PowerShell module. When you run Azure AD Connect, the following occurs, new users, groups and contact objects in on-premises AD-DS are added to Azure AD. However, licenses for cloud services such as Microsoft 365 are not automatically assigned to these objects. Attributes of existing users, groups or contact objects that are modified in on-premises AD-DS are modified in Azure AD. However, not all on-premises AD-DS attributes are synchronized to Azure AD. You can configure a set of attributes that synchronize to Azure AD by using synchronization manager component of Azure AD Connect. Existing users, groups and contact objects that are deleted from the on-premises AD-DS are deleted from Azure AD. Existing user objects that are disabled on-premises are disabled in Azure. However, licenses are not automatically unassigned. Azure AD requires that you have a single source of authority for every object. Therefore, it's important to understand that in an Azure AD Connect scenario, when you're running Active Directory synchronization, you'll master an object from within your on-premises AD-DS using tools such as Active Directory users and computers or Windows PowerShop. However, the source of authority is the on-premises AD-DS. After the first synchronization cycle is complete, the source of authority is transferred from the cloud to the on-premises AD-DS. All subsequent changes to cloud objects except for licensing are mastered from the on-premises AD-DS tools. The corresponding cloud objects are read-only and Azure AD administrators cannot edit cloud objects if the source of authority is on-premises AD-DS unless you implement some of the technologies that allow write back. To implement Azure AD Connect, you must have an account with required permissions assigned on both the local AD-DS and Azure AD. Installing and configuring Azure AD Connect requires the following accounts and Azure account with global administrator permission in the Azure Tenant such as an organizational account that is not the account that was used to set up the account itself. An on-premises account with Enterprise Administrator permissions in the on-premises AD-DS. In the Azure AD Connect wizard, you can choose to use an existing account for this purpose or let the wizard create an account for you. As your AD Connect uses an Azure Global Administrator account to provision and update objects when the Azure AD Connect configuration wizard is run, you should create a dedicated service account in Azure for directory synchronization to use because you cannot use the Azure Tenant Administrator account. This restriction is because the account that you used to set up Azure might not have a domain name suffix that matches the domain name. The account needs to be a member of the global administrator's role group. In the on-premises environment, the account that is used to install and configure Azure AD Connect must have the following commissions. Enterprise Administrator permissions in AD-DS. This permission is required to create the synchronization user account in Active Directory. Local Machine Administrator permissions. This permission is required to install the Azure AD Connect software. The account used to configure Azure AD Connect and run the configuration wizard must reside in the local machine AD-SyncAdmin's group. By default, the account used to install Azure AD Connect is automatically added to this group. The account used to install AD Connect is automatically added to the AD-SyncAdmin's group when you install a product. You must sign out and sign in again to use the synchronization service manager interface because the account will not pick up the group security identifier, SID, until the next time the account is used to sign in. The Enterprise Administrator account is only required when you install and configure Azure AD Connect, but its credential is not stored or saved by the configuration wizard. Therefore, you should create a special Azure AD Connect Administrator account for installing and configuring Azure AD Connect and assign this account to the Enterprise Administrator's group when Azure AD Connect is set up. However, this Azure AD Connect Administrator account should be removed from the Enterprise Administrator's group after Azure AD Connect setup is complete. You should not change the service account for Azure AD Connect after you install Azure AD Connect because Azure AD Connect always attempts to run using the account created during setup. If you change the account, Azure AD Connect stops running and the scheduled synchronizations no longer occur. Pre-deployment checks should include analyzing the on-premises environment for invalid characters in ADDS object attributes and for incorrect use of principal names, UPNs, performing domain email discovery and user counts, identifying domain functional levels and schema extensions, and identifying custom attributes in use, identifying proxy servers used for Microsoft Exchange or Skype for Business if you deploy as your AD Connect as a part of a Microsoft 365 deployment.  After you complete these checks, tier remediation tasks include removing duplicate proxy address and user principal name attributes, updating blank and invalid user principal name attributes and replacing with valid user principal name attributes, removing invalid characters in the following attributes, given name, surname, SN, SAM account name, display name, mail proxy addresses, mail nickname, and user principal UPNs that are used for SSR can contain letters, numbers, periods, dashes, and underscores. No other character types are allowed. If you're deploying Microsoft 365 and your deployment includes plans for SSO, you should ensure that UPN names meet this requirement before SSO is rolled out. Domains used for SSO and directory synchronization must be rootable, which means that you cannot use local domain names such as Contoso.local. After you have set up as your with an active directory tenant, you must complete the primary tasks to deploy directory synchronization using the following steps. Add your ADDS domain into Azure, verify the domain, and then set the domain as the primary domain. Download and install as your AD connect. Run the Azure AD connect configuration wizard. As an option, you can configure as your AD connect to synchronize specific OUs in the on-premises ADDS environment. Enable optional features such as password hash sync, password writeback, and exchange hybrid deployment. Run Azure AD connect and let it configure the environment for directory synchronization. Validate the synchronization results. After you set up as your AD connect and perform the initial synchronization, you can reconfigure synchronization options if needed. The Azure AD connect software installation includes several applications related to directory synchronization. When you run as your AD connect, you have the option to use express installation settings, which sets up directory synchronization with the most commonly used settings, or you can choose to customize setup options. If you choose to use custom installation, at the beginning of the setup, you can choose to use a custom SQL server instead of a local database. You can also choose to use an existing service account instead of the one created by the automatic setup process. In addition, you can specify custom sync groups by default. The administrators, operators, browse, and the password reset groups are created by Azure AD connect, but you can choose to use your own custom groups for this purpose. By default, Azure AD connect sets up password hash synchronization for the directory synchronization mode. If you choose custom installation, you can also choose the federation with ADFS option or pass through authentication. Alternatively, you can manually configure directory synchronization if you have a non-Microsoft federation server or another existing solution deployed. Customers, your AD connect installation also allows you to choose the way you identify your users. By default, setup presumes that your users are represented only once across all directories. However, if you have a scenario where user identities exist across multiple directories, you must choose the matching attribute. You can configure the user principal name attribute in the same window. This is the attribute that users use when they sign into Azure AD. The domains used for this purpose, also known as the UPN suffix, should be verified in Azure AD before synchronizing the user objects. In some cases, you might want to synchronize only a subset of your users from your local ADDS. Azure AD connect allows you to select a specific group of users that you want to synchronize to Azure AD.  After you complete the setup, you can add and remove users from this group to maintain the list of user objects that should be present in Azure AD. You also can use OUs from your local ADDS as the scope for replication. In the final step, Azure AD connect lets you set up some optional features available in Azure AD premium. Azure AD pass through authentication helps ensure that services which rely on Azure AD always validate passwords against an on-premises ADDS instance. You can configure Azure AD pass through authentication by using Azure AD connect, which uses an on-premises agent that listens for external password validation requests. You can deploy this agent to one or more servers to provide high availability. It's not necessary to deploy this server to a perimeter network because all communication is outbound only. You should join a server that runs a pass through authentication agent to the ADDS domain where users are located. Before you deploy Azure AD pass through authentication, you should know which authentication scenarios are supported and which are not. You can use pass through authentication for the following authentication scenarios. Use assignings to all web browser based applications supported by Azure AD. Use assignings to office applications that support modern authentication. Use assignings to Microsoft Outlook clients by using legacy protocols such as exchange active sync, simple mount transfer protocol, SNTP, post office protocol, POP, and internet message access protocol IMAT. Use assignings to spite for business application that supports modern authentication, including online and hybrid topologies. As your AD domain joins for Windows 10 devices, app passwords for multi-factor authentication. Although pass through authentication supports most common authentication scenarios, there are still some scenarios in which you can't use this method. These scenarios include user signings to legacy office client applications excluding Outlook, user signings to Skype for business client applications without modern authentication, user signings to Windows PowerShell version 1.0, detection of users with leaked credentials, scenarios that require Azure AD DS. Azure AD DS requires tenants to have password hash synchronization enabled, so tenants that use only pass through authentication won't work in these scenarios. Scenarios that require Azure AD Connect Health. Pass through authentication is not integrated with Azure AD Connect Health. If you use the Apple Device Enrollment Program, Apple DAP, that uses the iOS setup assistant, then you can't use modern authentication as it isn't supported. It will fail to enroll Apple DAP devices into Intune for managed domains that use pass through authentication. Consider using the Intune company portal app as an alternative. Before you deploy pass through authentication, you should understand how it works and how this method of authentication differs from ADFS. Pass through authentication is not just a simpler form of ADFS authentication. Both methods use the on-premises infrastructure to authenticate users when accessing resources such as Microsoft 365 but not in the same way. Pass through authentication uses a component called authentication agent to authenticate users. Azure AD Connect installs the authentication agent during configuration. After installation, the authentication agent registers itself in your Microsoft 365 tenants Azure AD. During registration, Azure AD assigns the authentication agent a unique digital identity certificate. This certificate with a key pair enables secure communication with Azure AD. The registration procedure also binds the authentication agent to your Azure AD tenant. Note that authentication requests are not pushed to the authentication agent. Instead, during its initialization, the authentication agent connects to Azure AD over port 443, an HTTPS channel that is secured by using mutual authentication. After establishing the connection, Azure AD provides the authentication agent with access to the Azure service bus queue. From this queue, the authentication agent retrieves and manages password validation requests. Because of this, there is no inbound traffic, so it's not necessary to install the authentication agent in the perimeter network. Azure AD DS, which runs as part of the Azure AD premium tier, provides domain services such as correct policy management, domain joining, and Kerberos authentication to your Azure AD tenant. These services are fully compatible with on-premises AD DS, so you can use them without deploying and managing additional domain controllers in the cloud. Because Azure AD can integrate with your on-premises AD DS, when you implement Azure AD Connect, users can utilize organizational credentials in both on-premises AD DS and in Azure AD DS. Even if you don't have AD DS deployed locally, you can choose to use Azure AD DS as a cloud-only service. This enables you to have similar functionality of locally deployed AD DS without having to deploy a single domain controller on-premises or in the cloud. For example, Contoso IT staff can choose to create an Azure AD tenant and enable Azure AD DS and then deploy a virtual network, VNet between its on-premises resources and the Azure AD tenant. Contoso IT staff can enable Azure AD DS for this VNet so that all on-premises users and services can use domain services from Azure AD. Azure AD DS provides several benefits for organizations such as administrators not needing to manage, update, and monitor domain controllers. Administrators not needing to deploy and manage Active Directory replication. There's no need to have domain admins or enterprise admins grids for domains that Azure AD DS manages. If you choose to implement Azure AD DS, you must understand the services current limitations. These include only the base computer Active Directory object is supported. It's not possible to extend the schema for the Azure AD DS domain. The OU structure is flat and nested OUs are not currently supported. There is a built-in GPO which exists for computer and user accounts. It's not possible to target OUs with built-in GPOs. Additionally, you cannot use Windows Management Instrumentation, WMI, filters, or security group filtering. By using Azure AD DS, you can freely migrate applications that use LDAC in TLM or the Kerberos protocols from your on-premises infrastructure to the cloud. You can also use applications such as Microsoft SQL Server or SharePoint Server on VMs or deploy them in Azure IS. All this without needing domain controllers in the cloud or a VPN to local infrastructure. When implementing the Azure AD DS scenarios, the following deployment considerations apply. Azure AD DS managed domains use a single flat OU structure by default. All domain join VMs are in a single OU. If desired, you can create custom OUs. Azure AD DS uses a built-in GPO each for the users and computers containers. For additional control, you can create custom GPOs and target them to custom OUs. Azure AD DS supports the base Active Directory computer object schema. However, you can't extend the computer object schema. You can't change passwords directly in an Azure AD DS managed domain. End users can change the password either using Azure AD's self-service password change mechanism or against the on-premises directory. These changes are then automatically synchronized and available in the Azure AD DS managed domain. Also, make sure that any applications don't need to modify slash right to the old app directory. Old app write access to an Azure AD DS managed domain isn't supported. The application doesn't need a custom slash extended Active Directory schema. Schema extensions aren't supported in Azure AD DS. The applications use a username and password for authentication. Certificate or smart card based on authentication isn't supported by Azure AD DS. To implement, configure and use Azure AD DS, you must have an Azure AD tenant created on an Azure AD subscription. Additionally, to use Azure AD DS, you must have password hash synchronization deployed with Azure AD Connect. This is necessary because Azure AD DS provides NTLM and Kerberos authentication, so users credentials are required. When you enable Azure AD DS for your tenant, you have to select the DNS domain name that you will use for this service. You also need to select the domain that you will synchronize with your on-premises environment. You should not use an existing Azure or on-premises DNS domain namespace. You might need to create additional DNS records for other services in your environment or conditional DNS forwarders between existing DNS namespaces in your environment. During implementation, you must also select which type of forest to provision. A forest is a logical construct used by AD DS to group one or more domains. Next, you will need to choose the Azure location in which the managed domain should be created. If you choose a region that supports availability zones, here's your AD DS resources are distributed across zones for additional redundancy. You must also select a vNet to which you will connect this service because as your AD DS provides functionalities for on-premises resources, you must have a vNet between your local and Azure environments.  The enterprise applications are domain controller services as your Active Directory domain controller services. After you deploy the Azure AD DS instance, you must configure the vNet to enable other connected VMs and applications to use the managed domain. To provide this connectivity, you must update the DNS server scenes for your vNet to point to the IP addresses associated with your Azure AD DS instance. To authenticate users on the managed domain, Azure AD DS needs password hashes in a format that's suitable for NTLM and Kerberos authentication. Azure AD doesn't generate or store password hashes in the format that's required for NTLM or Kerberos authentication until you enable Azure AD DS to your tenant. For security reasons, Azure AD also doesn't store any password credentials in clear text form. Therefore, Azure AD can't automatically generate these NTLM or Kerberos password hashes based on users' existing credentials. After the usable password hashes are configured that are stored in the Azure AD DS managed domain. Note that if you delete the Azure AD DS managed domain, any password hashes stored at that point are also deleted. Synchronized credential information in Azure AD can't be reused if you later create in Azure AD DS managed domain. You must reconfigure the password hashes synchronization to store the password hashes again. Previously, domain join VMs or users won't be able to immediately authenticate as your AD needs to generate and store the password hashes in the new Azure AD DS managed domain. The steps to generate and store these password hashes are different for cloud-only user accounts created in Azure AD versus user accounts that are synchronized from your on-premises directory using Azure AD Connect.  These user accounts aren't synchronized from an on-premises directory. For cloud-only user accounts, users must change their passwords before they can use Azure AD DS. This password change process causes the password hashes for Kerberos authentication and NTLM authentication to be generated and stored in Azure AD. The account isn't synchronized from Azure AD to Azure AD DS until the password is changed. Either expire the passwords for all cloud users in the tenant you need to use Azure AD DS, which forces a password change on next signing or instruct cloud users to manually change their passwords. Before a user can reset their password, you must configure the Azure AD tenant for self-service password reset. Members of the ADDC administrators group are granted privileges on the Azure AD DS managed domain. As a result, these administrators can perform the following tasks on the domain. Configure the built-in GPO for the containers ADDC computers and ADDC users. In the managed domain, administer DNS on the managed domain. Create and administer customer use on the managed domain. Gain administrative access to computers joined to the managed domain. Because as your ADDS managed domain is locked down, you do not have privileges to complete certain administrative tasks on the domain. Some of the following examples are tasks you cannot perform. Extend the schema of the managed domain. Connect to domain controllers for the managed domain using remote desktop. Add domain controllers to the managed domain. Employee domain administrator or enterprise administrator privileges for the managed domain. After creating an Azure AD DS instance, you must join a computer to an Azure AD DS managed domain. This computer is connected to an Azure vNet that provides connectivity to the Azure AD DS managed domain. The process to join an Azure AD DS managed domain is the same as joining a regular on-premises AD DS domain. After the computer is joined, you must install the tools to manage the Azure AD DS instance. To securely connect to the computer, you might consider using an Azure Bastion host. With Azure Bastion, a managed host is deployed into your vNet and provides web-based remote desktop protocol RDP or secure shell SSH connections to VMs. No public IP addresses are required for the VMs and you don't need to open network security group rules for external remote traffic. You connect to VMs using the Azure portal.  You can install these tools as part of the remote server administration tools feature on Windows Server and client computers. Members of the ADDC Administrators group can then administer Azure AD DS managed domains remotely using these Active Directory Administrative tools from a computer that is joined to the managed domain. Common ADAC actions such as resetting your user account password or managing group membership are available. However, these actions only work for users and groups created directly in the Azure AD DS managed domain. Identity information only synchronizes from Azure AD to Azure AD DS. There's no right back from Azure AD DS to Azure AD. As a result, you can't change passwords or manage group membership for users synchronized from Azure AD and have those changes synchronized back. You can also use the Active Directory module for Windows PowerShell which is installed as part of the administrative tools to manage common actions in your Azure AD DS managed domain, to authenticate users on the managed domain as your AD DS needs password hashes in a format that's suitable for NTLM and Kerberos authentication. Azure AD doesn't generate or store password hashes in the format that's required for NTLM or Kerberos authentication until you enable Azure AD DS to your tenant. For security reasons, Azure AD also doesn't store any password credentials in clear text form. Therefore, Azure AD can't automatically generate these NTLM or Kerberos password hashes based on users' existing credentials. Once appropriately configured, the usable password hashes are stored in the Azure AD DS managed domain. If you delete this domain, any password hashes stored at that point are also deleted. Synchronized credential information in Azure AD can't be reused if you later create in Azure AD DS managed domain. As a result, you must reconfigure the password hash synchronization to store the password hashes again. Even then, previously domain join VMs or users won't be able to immediately authenticate because Azure AD needs to generate and store the password hashes in the new Azure AD DS managed domain. The steps to generate and store these password hashes are different for cloud-only user accounts created in Azure AD versus user accounts that are synchronized from your on-premises directory using Azure AD Connect. A cloud-only user account is an account that is created in Azure AD directory using either the Azure portal or Azure AD PowerShell command list. These user accounts aren't synchronized from an on-premises directory. For cloud-only user accounts, users must change their passwords before they can use Azure AD DS. This password change process causes the password hashes for both Kerberos and NTLM authentication to be generated and stored in Azure AD. The account isn't synchronized from Azure AD to Azure AD DS until the password is changed. As a result, you should either expire the passwords for all cloud users in the tenant who need to use Azure AD DS, which forces a password change on next signing or instruct cloud users to manually change their passwords. However, you might need to enable self-service password reset for cloud users to reset their password. In this module, you learned how to select an Azure AD integration model and plan for integration. Also, you learned to prepare and install AD DS synchronization in addition to implement single sign-on and enable Azure AD login for an Azure VM. Finally, you learned to plan and implement Azure AD DS. We publish content regularly on this channel related to Windows Server, Hybrid Cloud and Infrastructure Operations and the certifications related to these topics. We hope you found this video informative and look forward to seeing you in future videos.


What's good Joshua Ross back again with another video, so we're gonna check out wrestlers being jerks volume one man It's always interesting to see when a wrestler is healing it up You know being pretty much a jerk an asshole within the ring not showing sportsman like conduct You know not showing sportsmanship It's good because it gets the crowd invested that makes you hate them even more and that's their job If you're if they're if a wrestler is supposed to be a healer that's supposed to make you despise them at all costs So we're gonna check this out by none other than BDWJ forever Appreciate all the love and support you guys have been showing on the channel roll to 70k and let's get right into it Oh the disrespect I haven't seen someone The low blow come on be better What's up with the rope man? Hey ref get in there break that up man. Oh, come on Oh The disrespect oh my god. Oh, there you go. Oh god working over Deppin. You'll love to see it You're right.  This is pretty cool, but he really disrespecting my man Oh Wait, Eddie was in he had a little he had a little stint in RLH Wow Did not know that She pulled a Eddie Guerrero, man, I love it. She faked it. I love it. That was cool.  Another double chop across the chest. Oh Very smart ring work there hook in that toe of Bay under that bottom rope The disrespect whipping them right onto his face Whoa Wait, what the he just assaulted the fishing with a damn spike They definitely look like they got the prison outfits going on city sneakers back to jail.  How about I start slapping you around our truth was in TNA at some point What did you want to know some truth? How about I start slapping you around them punches those offers? You're ripped at the ear it takes four pounds of pressure to rip off a human being's ear and retitis Just tried to do that a summer. He's gonna be on the Broadway's got the physical advantage here Oh First of foremost she could have just let it she's holding herself in that A lot of pride he wants a shot Did I just see That's a little yeah, that is me again. What is going on right now? What is happening right now? I don't know what I'm watching right now The crowd they're definitely wanting to see it I mean he was on Artemis Spencer's back in no time What is in the corner? I Apologize Dave Matthew Justice was crawling on the floor past commentary. I try to get him a water Well, I guess he got his revenge. He gave her the Bronco Buster crouch the crotch move What am I watching?  Very similar tactic, Joey. Oh, yeah, he really disrespected his opponent.   It's the dude, well, actually, no. It's the dude that was dragging the lady around by the hair in the commentary team saying, yeah, we went to Ghana and we was bunking women on the head, too. I was like, wait, wait. And then our truth going mega ultra rogue. I didn't even know he was in TNA at one point. This is crazy, man. Hey, man, if y'all want me to check out more of BDWJ forever's videos, make sure you hit that like button down below. I'll definitely check out some more videos when he drops them. Hopefully we can see a volume two at some point because this video is hella entertaining. But I appreciate all the love and support. Row two, because I appreciate y'all kicking with me. See y'all in the next one. Peace.


We'll start the conversation is where the assumption comes from. The very first thing I'm going to tell you my dear sisters is that always question assumptions. Where does the assumption that so many of we hear this, we hear this not just by the way it's not just from men. I hear this very often from women too, that a woman should stay at home. It's an assumption. Where does the assumption come from? That's the question. You see when you say a woman's place is her home, it can mean a lot of different things. And this is what we're going to break down together. I have heard in scholarly circles, both men and women, try to use the verse in the Qur'an that talks about, does anyone know the verse? Thank you. Now, those of you who have been attending the Friday Night Holocaust, we're going over the text called, the prohibitions of the tongue. And just a few weeks ago we talked about the prohibition of taking out of context verses of the Qur'an or hadith. You see the Qur'an was revealed in which it has multiple and heavy meanings. And even if you are a native Arabic speaker, you can't just open the Qur'an or even the body of hadith and say, oh I think it means this. Even if that's what seems it like on the surface or seems like a literal explanation of the verse. You see, this ayah is ayah 33 and chapter 33, Al-Ahzab. And it starts out, وقرنا في بيوت كن. But it is right in the middle of a series of verses that come before us. The context is everything. You have to understand, سبب النزول. Why was this ayah revealed? What was the reason for its revelation? There's a series of verses. And it starts out addressing the Prophet ﷺ and his wives. It's a series of verses that talk about at the point of it, is Allah ﷻ saying to the wives of the Prophet ﷺ that you wives are the mothers of the believers you have a special place in Islam. You thereby you have special rules that belong only to you. Furthermore, you have a choice. If you wish the dunya and the embellishments of the dunya, the Prophet can free you and you don't have to be his wife. But if you choose to be a wife of the Prophet ﷺ, you have special rules that apply to you. If you want Allah ﷻ and his Messenger, these are the rules. And this وَقَرْنَ فِي بِيُوتِ كُن is embedded right in the middle of these verses. Because if you look even at verse 32, the verse right before it, and the verses prior to that too, they start out with يَا نِسَاَا أَنَّبِ. O wives of the Prophet ﷺ. It's talking to specific people. And thereby the rules are for a specific set of people. The wives of the Prophet ﷺ. And he says, You are not like any other woman. No, sisters, when people take something from the Qur'an and try to extrapolate it and apply it to everybody, you can see where the problem is. Let me tell you, in case anyone is still feeling a little like, well, hold on, isn't it supposed to be that we understand these are the wives of the Prophet? What about the mothers of the believers who have very special rules even after the death of the Prophet ﷺ?  They are almost like an intensive training with the Prophet ﷺ to be the educators and teachers because they are the ones who are living directly with him. And they become the teachers of our ummah, right? So, somebody might say, but wait a second, we thought that this was something that people often say in women's places or home, in a women's place, where is it coming from? Now, we have different ethnicities here, so let me try something out. I've heard with my own ears, people who are, and I don't want to, and you please don't be offended by this, but these are true statements that I've heard. I've heard some Moroccan people say, and very similar statement by the way by many of our Pakistani community who will say something to the effect of the woman only should leave her home twice. Have you heard this? She leaves her home, probably other ethnicities too, I'm sure. She leaves her home, her father's home, to her husband's home, and from her husband's home to the... So, you know this statement. And you know it so well that you immediately quoted it. Or I can't do the Persian subhanAllah, but our Afghan sisters will say, and you have to help me with the wording here, that woman should either be home, or what? Or in the grave. So you know the statement. Nonsense. When I was younger, I think I would have been a lot more careful in PC and careful in my wording, and I think after all the years of therapy that I've done and counseling of families and people, this is cultural nonsense.


Aloha, I'm Kelea Akina, president of the Grassroot Institute of Hawaii. To borrow from Tolstoy's famous quote about families, good laws are often alike, but bad laws are bad in their own way. Now, this comes to mind because in July I attended Freedom Fest 2019 in Las Vegas, where I participated in a panel discussion on the dirty dozen of federal laws moderated by popular television journalist John Stossel. Such laws cost billions of dollars, typically benefiting a few at the expense of the many, and just make life harder for the average American. These are laws that eat away at our liberties. Because I was there to represent Hawaii, I focused on measures that we in the Aloha state have had the most experience with. That's why I started with the way the federal government enables large wasteful transportation boondoggles through the promise of federal grants. We all know about the Honolulu Rail and its cost overruns, but there are many other transportation projects around the country that have burned through taxpayer dollars in similar fashion. Earlier this year, California canceled a high-speed rail project that had more than doubled its $33 billion budget. Then there are projects like Boston's 17-year Big Dig, or Alaska's famous Road to Nowhere. As I explained, the federal government needs to stop dangling money over the heads of ambitious politicians. Instead, it should approach big transportation projects with skepticism. Especially when there are new technologies on the horizon or private options that would be more effective. Next, I focused on the U.S. Sugar Program, a collection of regulations such as price guarantees, quotes, and tariffs meant to protect the U.S. sugar industry. The result is that American sugar costs twice as much as sugar from overseas. A fellow panelist pointed out that one unintended consequence of the higher sugar prices was that people starting at the less expensive higher, I mean starting the less expensive high fructose syrup as a sweetener instead, which has been disastrous to public health and probably cost the government tens of billions of dollars more in public health spending. Now, ironically, sugar cane growers in Hawaii claimed for years that they needed the sugar program to survive. But ultimately, it didn't save sugar in our state. Meanwhile, we continue to pay for more sugar. Of course, no discussion of archaic protectionist laws would be complete without a mention of the Jones Act. In Hawaii, we understand that our cost of living is higher because all cargo carried between U.S. ports must be on ships owned, flagged, and built in the United States and mostly crewed by Americans.  But I also mentioned examples affecting mainland residents, such as New Englanders, who find it cheaper to import fuel from abroad than by ship from Texas. To mitigate these absurdities, I recommended updating the Jones Act for the 21st century, specifically by allowing our transportation companies to do what our military is allowed to do, mainly by ships from our allies who build them for a fraction of the U.S. cost. Finally, I talked about the common thread that runs through many of the dirty dozen, the intrusion of the federal government into matters that should be left to the states or the people. Whether it's meddling in the marketplace or persuading municipalities to commit to costly boondoggles, a lack of federal government restraint leads to bad laws. Now, unfortunately, we are the ones who pay, whether in higher taxes, higher prices, or the loss of liberty. That's why we should always look with skepticism at laws that erode federalism. The last thing we need is more candidates for the dirty dozen. Oh, and what other laws rounded out the list? We didn't have time to talk about it, but as summarized by Stossel, they were the FDA banning and trying things, the Endangered Species Act, the Antiquities Act, Controlled Substance Laws, the Safe Harbor Exemption from Anti-Kickback Laws, the Dodd-Frank Act, Sital Acid Forfeiture, and Congress delegating its authority to regulatory agencies. Need I go on? You can view the entire panel discussion on YouTube by going to grassrootinstitute.org. That's grassrootinstitute.org. Until next time, hey, hana kakou. Let's work together. I'm Keli Iakina with the Grassroot Institute of Hawaii. Aloha.


So I think the community feel is a great thing here at Stevenson. We're up on the hill. We're kind of like our own community. And everyone's willing to help each other, you know. If I have a question, academically I can go to my advisor or my teachers, athletically I can go to the athletic trainers, Conor, Jimmy, you know, if I have something wrong with my ankle, they'll help me out. The community feel is just a great part of Stevenson. A great opportunity that I had here at Stevenson was I got to travel to California this season. We went to Santa Cruz and got to travel to San Francisco and see the West Coast, which was a great thing. And I thank Brett Adams for that and the Stevenson Athletic Department and Community for letting us do that. Me being a leader on the volleyball court, you know, people, the freshman on my team, or even the seniors probably look up to me or athletically, you know, to be a captain and set the tone in practice or set the tone in a game. When things aren't going well, that's where Landon really shines, where he gets the team together, timeouts in the area. Sometimes I've just let Landon talk to the team. He's a motivator because he leads by example on the floor, and then he also is a very good communicator. And I say the third thing is he's consistent. He's always like that, you know, it's not, sometimes, you know, guys have, he has good days and bad days too, but he's always focuses and helps lead the team. Yeah. I think that when I'm in a group, I like to manage things. I like to do them right. So I feel like my athletics has been a part of that. I've always been a leader on the court. So when it comes to academics, I take the same role and like to get things done on time and a great job in a timely manner. So like I said, at the division three level, it gives you the opportunity to balance your academics and your athletics. Like I said, academics comes first and that would be, or that's great for me because that's what's going to drive my future. I'm not going to probably get anywhere other than this athletically, so academics come first and then I'm also playing a sport that I love and D3 gave me the great opportunity of doing that.


I'm Dylan Hersition. I work with Small Business BC as the education advisor. The Canada VC job grant is an initiative to support skills training and professional development. Covering two-thirds of the cost of training to help small business remain competitive. Small Business BC is able to support an applicant from start to finish. So we will guide clients through the eligibility process to make sure they're eligible for grant funding, but more importantly we want to know about the business. So we'll help develop training plans and even source training options throughout the province to support the small business training needs. We've had a great response so far with the monies available. Small business owners are very enthusiastic to accept it and support the skills and professional development training for both themselves and their staff. Everyone's welcomed the program and really appreciate the support of the ministry. We'd be happy to support anyone interested in the Canada BC job grant. You can reach us directly at our email jobgrant at smallbusinessbc.ca. We've handled all kinds of client inquiries. We've sourced everything from professional bodyguard services to being a drone operator, a drone pilot. So there isn't a training or specialized skill that we haven't come across. So if you'd like to challenge us, give us a call and we'd be happy to source your training options.


interview with what's the name with Vlad okay we're ridiculous because you got you I don't respect you that wow I don't respect you Vlad so because Vlad is extorting and using and he probably worked for the FBI or something yeah I just remember when we had a guy named mode three to get killed here on yeah he had seen Mike right before that and Mike was talking why do y'all do this what you know he was like and that was mode three was on that way I was like that was that Tyson man that's right he was he was really giving it to him and it made me think about these podcasts and these moments because we had a guy here I shout out the water to live who got killed right after he left for about a guy that was standing behind him and so I be like man you know these moments we get together you got to say what you got to say get it out there because you got this moment you don't know you don't know you don't know so you got to take advantage of making sure when you sit behind these mics that you make sure I watched that I watched mode three interview with what's the name Vlad okay Vlad ridiculous because you got you I don't respect you about wow I don't respect you Vlad so because Vlad is extorting and using and he probably worked for the FBI or something everybody says you know I'm saying like bro you a weak ass nigga bro let's keep it real you know I mean like we go like we don't stop going on Vlad TV black people wow he ain't for y'all he ain't for us he ain't he just wants you on there cancel him stops canceling our people cancel that wow man shout out to boss talk 101 man Columbus short on here spitting it he telling you to come support black people with black business that been here for 15 plus years and he just show up man that's a blessing man thank you for supporting us yeah man so in that support man you know I just want to educate everybody asking me all the time like what you got going Columbus what you doing Columbus can I know you always studying yeah I'm a student like Kobe man yeah Virgo Kobe was a Virgo yeah black mama he was a consummate student right and that's what every I want everybody to be you know I mean but now what how can we level the play of field man God has put me in a position that I never thought I would be in that has nothing to do with entertainment that has nothing to do with being famous but everything to do with putting people in a position to be successful and even the playing field and what is that that's started from the crypto and went into the NFTs right and I you know people didn't know what an NFT right let me say this for you and you gonna get right dead into that but that's what phase on love when he came on here he was like he said Bitcoin yeah right mm-hmm Bitcoin was 170,000 now it's 60 well how much it really worth right what is it what is the real worth of it they've been trying to get me in a big car for a minute this when Bitcoin was a thousand dollars I could have got that's what you didn't get what the fuck is we that's me tell me what I need to guarantee it's a gamble I know it's a gamble they don't want to tell you it's a gamble everything you do is again but it's it's it's it's investing in a ghost stock that all is always gonna be oil medicine is gonna be medicine hammers gonna be ham it's gonna vary but it's gonna always be there AT&T coke all these products are gonna always be there but when your product goes from 40,000 to 78,000 up and down then what is that man I don't understand it I told him on the time like I don't understand it either we're in the blind in this when people came to me I'm saying it's like some kind of what they call pyramid skin now I have no idea what it is and then the guys like man you got a guinea I'm like nah man I don't know about that crypto you black people here about something it's all right right so give us the spill on what it is so we can understand it so I listen and break it down to this form we have broke laws absolutely absolute loss on the crypto so you ain't broke you ain't lost let me know you about the crypto from a real crypto so area so what what is crypto you know cryptocurrency is a of it's it's it's currency that you can exchange through the internet right through through the web through you know electronically okay and why why is this important so you got Bitcoin and dodge coin you're gonna snoop got a coin but now what do these coins do like in different worlds in the virtual stock this is exactly what it is okay now certain coins are valuable now you gotta watch it like you watch an apple like you watch in your you know and if you know about stock you know let's break it down but most people some people black people I didn't know about stocks I didn't know about my first million dollars do you know how I'm a quick I blew away blew through my first million love what did you do I bought a m6 I got a I got a 65 and he went to Cancun went to tell you just money on yeah it was entertainment they got it the meal yeah stomp the art stomp the art meal what you mean when they give you yeah no they I did I work I got nothing for the movie but when the movie was number one two weekends in a row like a government check I got checks I'm kicking what never seen that much money in my life I still get residuals from it today today so but what I'm paying lack of financial education right like financial literacy I was financially illiterate as far as I didn't know how to handle it all I was trained in just like how to be a talent right just you know that nothing didn't understand monetary yeah we on boss talk one-on-one


Once Memorial Day weekend is hit, I think grilling season has officially started. So today I'm gonna show you a nice side dish that you can serve with grilled salmon, grilled chicken, grilled shrimp. It's just such a good side because it's quick to make and it's not potatoes. I know a lot of times it's easy to just go to the potatoes that's such a go-to. So it's nice to have something a little bit unique and very, very flavorful. I'm going to make a red curry. It's kind of like a linguine, a real simple sauce, just a few ingredients. So to start with, I've just got a pot of hot water. It's not boiling, I don't even have the burner on. I just put the pot of hot water on the stove and I'm going to add some brown rice pad thai noodles. Pad thai noodles work really well. Rice noodles is the important part because you don't really need to boil them until they're done like regular semolina pasta. So I'm just going to break these apart a little bit and they're going to start cooking in the hot water without it even boiling. So I'm just going to let those noodles soak a little bit and then I'm going to get my sauce started. And just over a medium heat, I'm going to put some red curry paste and then I've opened a can of full fat coconut milk. And when you open a can of coconut milk, you'll see at the top that there's just this thick layer of coconut cream. I'm going to scoop that cream off and add it to the pot with the red curry paste. Stir that until the coconut cream melts and you'll just have this nice, smooth, kind of orangish, reddish sauce in your pot. And then I'm going to add two tablespoons of honey to just add a little bit of sweetness to it. And it's always best to use local honey. And a couple tablespoons of tamari or soy sauce. Tamari, remember, is the gluten-free soy sauce. So I'm going to put that in. And about a teaspoon of paprika. Hungarian paprika is the best. And a little bit of lime juice, just probably the juice from half of a lime and I'll squeeze it right into my sauce. So you can see just in that minute or two that these noodles were in the hot water. Look at how soft they got already. So it doesn't take long for them to finish cooking in the pot. Today I happen to have some sugar snap peas in the refrigerator so I trim them, I slice them really thin and I'm going to add those to the pot right now too so that they cook just a little bit right along with the noodles because I want them to still have a little bit of crunch when I'm eating. So there you go, a red curry linguine delicious with any grilled food. I'm Sue Dodin sharing Good Food for Good Life 365.


Conflicts and disasters uproot millions of people from their homes every year. In an effort to improve their lives, IOM is proud to partner with the Internal Displacement Monitoring Centre, the leading experts in data analysis, research and policy development on issues of internal displacement. IOM provides reliable, accurate data to IDMC through its displacement tracking metrics, the world's largest source of data on internal displacement. The humanitarian community relies on this data to ensure the most essential services are really reaching people where they need it most. The emergence of COVID-19 in countries already suffering the effects of violence or disasters compounds the risks faced by internally displaced persons. Understanding and adapting to the mobility trends and needs of internally displaced people is more important than ever, particularly as this information can help governments mitigate the health and economic impacts the pandemic is having on displaced communities. The newly released GRID report by IDMC will continue to be an invaluable tool for humanitarians, governments and NGOs alike as they respond to the evolving needs of communities affected by crisis around the world. In particular, we welcome this report's focus on solutions, filling a persistent gap that will be key for helping governments find lasting, bold solutions for the displaced citizens now and in the future.


Welcome to the CSAW Library Series – CSAW Lessons – Components, Features, and Supports. By the end of this tutorial, you'll be able to Describe the components of a lesson Utilize lesson features to support classroom goals in student learning Use lesson resources to support easy classroom implementation CSAW's supplemental lessons are ready to teach standard-to-line content created by curriculum experts that balance digital and hands-on learning for students Our lessons also contain implementation resources and differentiation opportunities that can save teachers time Let's take a look at what CSAW lessons have to offer Lessons are housed in the CSAW Library When logged in as a teacher, click the Library button at the top of the page and use the Standards and Curriculum Alignment tool Search feature or subject tiles to find a lesson Each lesson in the CSAW Library contains a variety of standard-to-line activities that engage students in joyful learning A lot can be learned about the activities in a lesson at a glance Teachers can quickly see the activity type, approximate activity duration, and the number of activity pages along with a brief description of what students are expected to do Teachers can also jump into student shoes to prove you how students will engage in each activity by clicking the View as Student button Activities are designed to introduce concepts, activate background knowledge, give the opportunity to practice skills and build new understanding students need to succeed, leveraging CSAW's multimodal tools to support all students in learning Introduction activities lay the groundwork for understanding and often are completed as whole-class activities A variety of practice activities give students the opportunity to sharpen new skills in a low-risk environment demonstrate understanding of the current concept, and have purposeful, repeated practice Connect activities take learning offline and provide the opportunity for hands-on discovery that is later captured in CSAW They are designed to be completed with a partner or even with a family member at home Show what you know activities are assessments that allow students to demonstrate mastery and reflect on their learning while simultaneously providing key learning insights for teachers Keep your eye out for the formative assessment tag on activities in various collections providing teachers with auto-graded data to further support student learning Because CSAW keeps the power in teachers' hands, activities can be delivered in different ways to support instructional goals Present to class allows teachers to project the activity on a smart board for a whole-class experience Assigning directly to students is a great option for independent, center, or station work Activities can be assigned to all students, specific groups, or individual students If you're looking for support on how to use a lesson in your classroom, check out the lesson plan All lessons in the CSAW library contain a detailed lesson plan to help teachers successfully integrate activities into their instructional routines Lesson plans can be accessed by clicking Jump to lesson plan at the top of any lesson, or by scrolling past all activities to the bottom of the page Lesson plans begin with a lesson summary, including the lesson objective A student-friendly I-will statement to help them understand what they'll be learning and applicable national and state standard alignments A list of resources is provided so teachers know if any outside materials are needed for the lesson, such as paper or dry erase boards, writing utensils, devices, manipulatives, etc. Instructional format highlights which delivery methods or settings are recommended And teacher tips provides helpful hints and best practices for implementing the lesson Finally, the how to teach section gives an in-depth description and breakdown of what students are expected to do on each activity page That brings us to the end of the CSAW lessons, components, features, and supports tutorial If you have any questions, please watch this tutorial again or visit our teacher resources page for additional support You can also keep your learning going with CSAW's Integrating Lessons tutorials


because you see the whole planning or the billions of light years that we're seeing around us. That's just the first sky out of seven. That's how much God programmed around us. That's not how this medieval folklore was written. It was written for the understanding that there's a dome over the earth and that the sun and the moon are the two great lights and that the stars are all smaller and can be used to projectile weapons by angels to throw at devils when they get too close. When they try to listen to the truth, yes. That's it. No, not the truth. They're trying to listen to what God says. And not as the high assembly, which is the angels. So God's heaven is like a hotel in the top of the sky, in the top of this firmament, and when devils get too close to that, then the angels will grab the fixed stars out of the firmament and throw them at the devils and be used as missiles.