episode of the nonprofit show thrilled to have you here. Julie and I are excited to have this disruptive conversation with none other than Kami Baker. So Kami, glad to have you here. The real estate agents of change, R-A-O-C, and Kami's going to talk to us about the power of real estate gifts. So before we jump into this conversation with her, we want to remind you who we are, who you're looking at or possibly listening to. So hey there, Julia, a CEO of the American Nonprofit Academy. I'm Jarrett Ransom, your nonprofit nerd. Yesterday I had a wonderful coaching call and I asked this woman, where is your beautiful accent from? And she said, Georgia in South Carolina. And I'm like, me too. So I can, I can hear it that my accent's a little bit stronger of the southern drawl. So anyway, really glad to be here in honor of all of you and the great work that you do. We are also so esteemed to have the continued amazing support from our besties over at Bloomerang, American Nonprofit Academy, Fundraising Academy at the National University, Be Generous, Your Part-Time Controller, Staffing Boutique, Nonprofit Thought Leader, as well as the Nonprofit Nerd. These companies are here for you. Their mission is your mission. So please do check them out. They're amazing partners really here to help you do more good around your community. And if you missed any of our episodes, you know where to find them. Roku, YouTube, Amazon Fire TV, as well as Vimeo. But wait, there's more. Just like a good ShamWow commercial. You can listen to the non-profit show wherever you stream your podcast. So go ahead and queue us up there. If you're walking, driving, exercise, whatever you're doing, you can, you can also listen to us, including this episode will be up in just a few couple of hours. A few couple will be up today. But really glad to have our guests with us. Again, Kami Baker, CEO, real agents of change. Welcome, my friend. Thank you for having me. I got that southern draw two. In the minute we met, I thought, yay, a fun conversation about non-profit that's not dry. So let's do it. I know I heard it when we met as well. We've had a couple of conversations off air, of course, really learning more about random, sorry, not random acts of kindness, but the real agents of change. But you really do provide a lot of random acts of kindness as well, Kami. So tell us a little bit about yourself, how you got into this.  Well, I'm an author. I'm a recovering alcoholic single mother who was in real estate and was so hungry and determined and gorilla marketing in real estate that I did a lot of fundraisers, not just because it was the right thing to do, but because it was a great way to meet people. Social responsibility, 87% of people want to do business with those that are socially responsible. So I started doing antique car shows and giving the money to nonprofits. And that went on for many years. I worked with Ronald McDonald's and Make-A-Wish and all these nonprofits while I was a real estate agent. And three years ago, I was at a conference December 2019. And I heard the speakers say charitable gifting of real estate. And I thought, I've been in real estate 15 years. I've been doing all this nonprofit work. How in the heck have I never heard of this? So here we are today. I delved into it. The pandemic had me completely unemployed. You can't speak and do fundraisers with pandemic. And so I learned all about this and become one of the experts and wrote a book about it. Love it. I think this is so fascinating because we've talked about this a lot, Kami, in the relationship of demographics and the aging of our population and how we are in one of the most significant times of transition of wealth in our country. We are in it right now. And a lot of that has to swirl around real estate. And so I think this is such an important topic and time, topic and time meeting together. So let's kick in and start the conversation with a really kind of cursory look at how this works. And can you donate real estate? Maybe that's the first question. Well, this has been happening since 1917. U.S. government created the tax deduction. And real estate is just one of many. And the thing is the reason that people have never really heard of this before is because of the 1.8 million nonprofits in this country, the fact is 99.9 percent do not cannot, will not. Frankly, they shouldn't accept real estate because it's so risky and time consuming and expensive. Even if all three of us sit on their board to advise them, somebody's got to pay off mortgages. Somebody's got to put on a roof. Somebody's got to pay HOA fees, etc. So that's why we haven't heard of it. If 99.9 percent of nonprofits won't take real estate, what's the point of teaching it? But the fact is, we've simply come up with a really simple system that makes it risk free, no money out of pocket for the nonprofit world.  And 80 percent of people who donate real estate are doing it because it's the right thing to do. They're a veteran and they want to help veterans.  They want to help the animals. So this is a win-win-win. The nonprofit's $9 billion a year is already being donated to nonprofits through gifts of real estate. And that's with 99 percent of them not even asking for it and even turning it down. That's why we can go from $9 billion to $29 billion a year with good conversations like this that people learn. Yes, you can donate real estate. No, it doesn't have to be risky. No, your nonprofit doesn't have to take title. We can make this super easy and beneficial for everyone. There is no downside. That is just mind blowing. And you keep blowing my wine, Cammy, because I know we've talked before. But you were saying to me that on average, this charitable real estate giving is about $500 to $600,000, right? A transaction. Her transaction equity from the real estate. So it could be a one mil equity that goes to the nonprofit world. Right. That is amazing. And then again, if you think of this nonprofits, like what would you do with $500,000? What would you do with $550,000 or $600,000? I know that there is so much out there that our organizations are thirsting for, whether it's infrastructure, building their staff, remodeling their current spaces, doing more with the money that they have. So I just wanted to put that into perspective, $500,000 to $600,000 per transaction. So let's talk about the impact of that, perhaps. Like as we share on average transaction, what are some of the other impacts of charitable real estate donations? Well, the fact is, when we look at cash versus real estate as a nation, we only have 3% of our wealth in cash. 43% of our wealth is in real estate. So when the nonprofit world can start opening up to accepting non-cash assets, in our case real estate, Dr. Russell James, who has been a professor at Texas Tech and teaching plan giving for 20 years, has done the research. It is proven that when a nonprofit takes non-cash assets, they six times the growth of those who only take cash. So we're talking about saving lives. We're talking about doubling, tripling, six-timesing what you bring in as a nonprofit, and it's from the donors you already have. What? You're saying the donors on my list, they give me $20 a month? Yes. We have stories of people who are giving $20, $25 a month or even a year to their nonprofit, and when they learn they can give real estate, they did. They had a second home. They had that investment property or even their primary residence. People want to give. We don't sell them on it. We don't convince them of it. We educate and let them know what their options are so that they can make a decision. So it's really an interesting thing that you brought up, and that is what types of real estate are these things that I didn't even think about like the second home or I always thinking, oh, it's the full city block in the center of town or, you know, but it can be a residence? Well, not only can it be a residence, a single family, a condo, commercial, it could be a restaurant, a strip mall, vacant land. It can be anything that's not a timeshare. And the other thing about it, Julia, is this. It doesn't have to be in the same town as your nonprofit. It can be anywhere in the country, in some cases, anywhere in the world. It can be of any size. It doesn't have to be mortgage free. We have a partner who pays off mortgages, who takes on the responsibility. You as a nonprofit never take title. You never take title. There is no risk. There is no money out of pocket. This is real estate anywhere in the country that is liquidated and you get the proceeds. It's just like credit card processing. Every nonprofit, you can click a button on their website and donate. You put in your visa card number and three days later, they get 97% of the proceeds in their bank account. It's the same thing here. The nonprofit doesn't know how to process credit card. They don't know what your bank statement looks like. They've just got a button and you give them money. It's the same thing. You don't have to understand all the idiosyncrasies, but we do have a lot of videos to help people understand how it works. So walk through the process. Let's say I am the CEO of a nonprofit, let's say in Des Moines, Iowa, and I want to get into this process. What would that look like for my organization? Do I have to be of a certain size, certain age? What does that look like to start with? And then let's go from there. So any nonprofit, you could have just got your 501c3 designation today. You could be Fidelity Charitables, the largest nonprofit in this country. They don't even do their own donations of real estate. Even they use the same team that we do. So let's say it's a nonprofit in Des Moines, and I'm going to share with you three ways that a piece of property can go to benefit them. So let's say there's a condo in Florida.  I got this condo in Florida. It's a million dollar condo. It's got $200,000 mortgage on it. I want to give it to you, Des Moines nonprofit. The first way is for that donor to go sell their property, pay all the taxes, and then give that nonprofit the proceeds. The problem with that is it is the worst way. It is frankly the lazy way. It's the old way of doing it. Uncle Sam gets a big piece. The donor gets the least tax advantages, and the nonprofit gets the least amount of money. So what if that donor with that condo in Florida tries to give it directly to the nonprofit in Des Moines? Here's the problem. That nonprofit's got to pay off that $200,000 mortgage. They got to take title to give the donor the tax deduction, and by taking title, they have to pay off any liens. They have to take on the responsibility, and 99.9% won't do it. It's too risky. It takes too much time, too much money, mission shift, all that stuff. So the third way, the when, when, when way, the way that we suggest that they do it, Des Moines nonprofits working with the real agents of change. We have a team. That donor comes to us, explains their circumstances. We show them on a net sheet. Here's what it looks like to pay Uncle Sam, or here's what it looks like to do it this way. When they decide to do it, the team we have pays off that mortgage, $200,000 to the donor, gets them off the title. So now you got a million dollar piece of property, $200,000 came out, but you got $800,000 in equity. So the team hires a realtor in Florida at a full commission. We want our realtor friends to know you get paid, liquidate these donations of real estate, and when it's sold and all the expenses are recouped, 98% of the proceeds goes to the nonprofit in Des Moines. Is that simple? What does that look like in terms of time? I know that's like a huge, it's a fabulous question. Things can, can sell in 24 hours and in 24 years.  Well, well, first of all, keep in mind that the property, it can't be a time share. It needs to have equity because it's the equity that's going to the nonprofit world and it needs to be marketable. So in other words, if it's some contaminated gas station out in the middle of nowhere with tumbleweeds, that's never going to sell anyway. And, and we don't want that and you don't want that either. So typically if the property is donated, if this team is willing to take title, they know what's going to sell. Now, if from a time perspective, in less than 30 days, the donor has their tax benefit, mortgages pay it off, they get cash in their pocket, you don't have to donate the full amount. Let's say they want to get $200,000 cash in their pocket, mortgages pay it off, donor gets cash, donor is done in less than 30 days. Now that specialized nonprofit we work with has the title, it depends on the market. It could be under contract in a week, it could take it a month. But the point is, is that the nonprofits themselves don't have to worry about having months and months of board meetings trying to figure this out. The minute it goes on the market, it could take, you know, two to three months right now at the time of this recording, or to go under contract, get sold, all the cash goes in a grant to the nonprofit that the donor wants to have it. So it's a quick process, and it's a heck of a lot quicker than trying to figure it out on your own. I love this, Kami, and you're like, it's a win, win, win. And it just makes me want to, for those of you listening, like I put up the big W, like that's definitely a win, win, win. And I'm thinking like, why are more of us not doing it? Does it fall on the communication on us, like the nonprofits to communicate this with donors? You know, I think that the problem is, people think it sounds too good to be true. What's the catch? People are so cynical and jaded. And I would say to you, well, how bad does something have to be for it to be true for you, right? But yes, it requires a lot of education. And what people need to know is, this has been happening for 100 years. There's nothing new about it. What is new is the fact that there are nonprofits that have been created to simply facilitate these transactions for your nonprofit. They are a third-party entity that this is all they do. If your nonprofit saves puppies or feeds veterans or stops human trafficking, that's your mission. The mission of this nonprofit is to do nothing but accept gifts of real estate on your behalf, pay off mortgages, take title and responsibility. And when it's all said and done, grant the money to the nonprofits that the donor wants to have it. It doesn't have to be one nonprofit. Could be three or 10. Could go into a donor advice fund. But friends, it's happening. It's happening with or without you. So all you have to do is tell your donors. Just tell the donors. Kamie, you and I have talked about how it seems that the nonprofit sector, and Julia, we've talked about this too, is like the last one to the party, right? We're the last one to adopt new trends, the last one to adopt technology, the last one to adopt innovation. So I mean, on our show, we've talked about gifts of cryptocurrency. We've talked about the, you know, donate now, pay later concept from our donors and supporters, be generous. We've talked about gifts of stock, right? Like a little bit of everything. Now we're talking about the gift of charitable real estate. And when we think of nonprofits, like I think we can all agree, we're not always the most innovative. We're not always the most creative, right? But I feel like we're leaving money on the table. Leaving money on the table is an understatement. The donors that are on the donor list, it is proven they will give three to seven times more of what they already give when you stop asking for cash. There's so much psychology that goes behind it. When a nonprofit asked a donor for cash, and they're mine, that donor has to say, well, do I want to go to another boring golf tournament, or do I want to buy my kid's Christmas presents? Do I want to buy more stale cookies at the bake sale, or do I want to take my wife out to dinner tonight? In other words, cash is competing with other cash items. When we can help that donor shift to their wealth bucket of real estate, now that's a whole different conversation. The tax benefits to them are impressive. They're going to liquidate that real estate one way or another. It might as well be to your nonprofit, and your donors are on other donor lists.  They do in the first ones to start educating those donors. If you keep sitting on this and thinking about it, and praying about it, and studying it, and be stuck in analysis paralysis, in six months, when you finally talk to your donors, they're going to say, oh yeah, I had a strip on California. You already gave it to the animal rescue league. I didn't know you could take it. Let me ask you this. Are you seeing that this is more of an estate issue and planned giving issue, or is this ongoing transactions with just regular donors, and you're not just waiting for that planned giving event? We've got stories of people in their 30s and 40s that have donated real estate. We've got stories of people who donated just a second house that were not high net worth, but when you think about just the numbers of this, people typically that donate are 60 and older. They're usually a higher education, a higher income. They've acquired several properties, and now they need to simplify their estate. Little Billy and Little Alice don't want the factory and the high rise in New York. All they want is money. Sometimes people can take that piece of real estate, get a couple hundred thousand cash, go by life insurance policies, Little Billy and Alice are fine, and now they can donate the rest of the money from the real estate. It isn't a state thing, but this isn't about waiting until you die. There's so many ways that the real estate can actually be liquidated now so that you can see, you the donor, can see what's happening with your legacy. This is about leaving legacy and not waiting until you croak, but doing it now, so you can see that church build that new building, so you can see the children being fed, so you can put people in college now while you can see it. Broke is a southern word too. I said to someone the other day, there's one more swig in this, you know, in this bottle, and I'm like, that's another southern word. Okay, so one of the things I want to say or ask rather, Cammie, is do we need to be in partnership with the real agents of change before we receive this house or charitable gift, or can we do it like where do you come into the mix? Yeah, great question. Well, you need to know about it before, so in other words, the real estate is donated to our partners, the specialized nonprofit, and then it gets liquidated. That's how the donor can get their tax deduction. They're donating it to a 501c3, but not the Boys and Girls Club and not the Veterans Center. In other words, whoever the nonprofit is that the donor wants to benefit, they're not taking title, but if something's already happened with the property before we are brought in, well, it's kind of too late, right? So this is about just having the nonprofits take a deep breath and say, there's other ways we can bring in money. Real estate used to be scary, but people also used to ride horses to work. Like, you know, the outhouse was brought in-house. It's called indoor plumbing. Things change. So for those of you who think, oh, we already tried real estate, that's scary. I already know a nonprofit that went bankrupt from doing that, or whatever those old fashioned statements are, here's what we want you to know. Things change. You can benefit from real estate. You just have to plan it out. You got to let your donors know so that we can tell them, here's what it looks like if you sell it and pay all those taxes. Here's what it looks like if you do it this way, and just let them decide. Yeah. So besides this episode, is there anything else you have, Kami, in your toolbox or resources where we as the nonprofit leaders can lean in and say, here's additional education. We one need to educate our board, our executive team, and at the same time simultaneously, we need to educate our constituents. So I know you have a book, and I see that on your background there. And I have one in my hands here too. And then also you have a podcast. So how do we start this communication with donors of that education? Well, we've created quite a few videos. If you go to therock.com, the way we have it spelled, which stands for real agent of change, therock.com, we've got information for nonprofits, information for donors, and information for real estate agents. You as a nonprofit need to educate the realtors and the financial advisors, you know, because 65% of these donations happen because a financial advisor took the initiative. They've already got clients that want to be philanthropic. They've got clients that need tax deductions. What they don't have is a way to facilitate these donations because the church and the veterans group won't take it. Well, what are we going to do? So we want to let all of them know we've got individual videos speak directly to each of those individuals. We have charitable real estate certification. And the reason a nonprofit would want to get certified and be on our map is because when you understand how this works and you can position and partner and promote with the realtor, with the financial advisory community, with your chamber of commerce like nonprofit and for profit coming together, make money making a difference, help each other to do more of that, which you are doing. So going to the website and also in Florida, we have the first CE course for real estate agents. Florida has given us the accreditation here, so soon we'll have it in every state, but we don't want people all over the country thinking, well, if I'm not going to get my three hours credit, I'm not going to do it. It's not about getting credit. That's why I didn't do this for three years now. I didn't get the CE thing done because I didn't want people coming to learn about this just so they can get three hours toward their license. I want people learning about this who will do something. And that's why when we teach the masterclass, we teach people how to be charitable real estate champions, take action, take a stand, be proactive. When people say to me, well, I've never had anybody try to donate real estate. If I ever do, I'll give you a call. I think, why aren't you so ignorant? Stop waiting to react. Don't wait to react if anyone ever maybe asks you in the next 10 years. Be proactive. Teach them that it's an option. Let them make their own decisions. It's like planned giving. You see nonprofits that have a planned giving program or not, and it's something that you have to make a commitment to educate yourself up on and then I think you have more opportunities. This has been fascinating. I've really been interested Kami in having you share with us your approach, your knowledge, and certainly your passion. Kami Baker, CEO, the real agents of change, and you can find them at theraoc.com. Talk with Kami and her team. Learn more. I can't wait to watch some of those videos and learn and delve into this even more, Kami, because I know that this is a part of what's going on with the American economy right now. It's a big part. It's a transitory time for us, and so why not learn more about it and understand what some of the options are? Really, really interesting Kami for a great conversation today. Again, I'm Julia Patrick. I've been joined today by the nonprofit nerd herself, Jared Ransom, CEO of the Raven Group. And again, we want to thank all of our sponsors from Blumerang, American Nonprofit Academy, your part-time controller, Be Generous, Fundraising Academy at National University, Staffing Boutique, Nonprofit Thought Later, and the Nonprofit Nerd. These are the folks that join with us day in and day out to get really interesting conversations like we've had today with Kami Baker. Wow, Jared. Okay, great way to start the week, huh? I know I'm thinking of this already really looking at our gift acceptance policy for nonprofits and how this needs to be a component of that gift acceptance. We've talked about crypto on our show before. We've talked about automobiles on our show before. And so talking about this charitable real estate giving has got to surface to the top as well. So so much to think about. I feel if I have this crystal ball, Julia, we talk about all the time for our shows this year, it's really about innovation and it's how we can innovate our sector instead of sitting back and waiting, you know, and let's be reactive to every possible opportunity. No, let's be proactive. Let's see what else is out there. Let's see other ways to diversify our revenue streams. I love your story, Kami. And I know it was brief, but about the $20 donor, you know, the $20 a month donor that that also had, you know, an additional home or property somewhere. So this speaks to the opportunity that it's not just those that you might think have charitable real estate gifts. It's really you this donor, they're already in your database. And I love that. I love that too. I thought that was really powerful because I think when you marry that to the idea of the value of cash and how 3% is being held, you know, of wealth is held in cash and the rest and other assets, it makes it a lot more real, you know. And so it's been really a lot of fun. Kami, thank you so much for joining us today. Well, ladies, we can't bring it from $9 billion to $29 billion a year without visionaries like you giving us the platform to speak and to educate. So thank you. You have just brought probably quite literally billions of dollars to the nonprofit world by having this show today. Thank you. Yes, let's hope for that. And absolutely your passion just oozes on the subject. So thank you for bringing your passion. For all of you that have joined us today, we are so glad you're here. Please come back and join us tomorrow. Until then, as we end every episode, we invite you, encourage you, and remind you to stay well so you can do well. Thanks, everyone.


Companies talk about thinking outside the box, but we don't think that's far enough. Cable subscriptions are dropping, viewers are headed to the internet for TV and droves, and advertisers are scrambling to figure where in the world to put their money. It's time for a radical solution. Welcome to Liquid Cable. Liquid Cable is digital quality internet TV for anyone with a Blu-ray internet connection. All you have to do is pop in the free Liquid Cable disk and follow the on-screen instructions. Liquid Cable can pinpoint with the precision of a laser, viewers with the highest probability of buying an advertiser's product. Are we saying we can match up an advertiser's ad with a detailed personality profile? Yes, exactly. No more wasted ad dollars. Ever. And it gets even better. We can integrate advertiser's products directly into the shows themselves and give viewers the chance to interact with those products in real time. Liquid Cable, there's nothing on the planet like it. Viewers will get an internet video stream that will blow up to 52-inch screen with digital quality, crystal clear sound and pay nothing. We'll give them premium, original content as well as familiar established shows and make it available on demand. Any idea what advertisers would pay to be guaranteed their spots reach the perfect demographic and interact with those ads? Millions, multi-millions. Our ethical personality manifold will give advertisers access to viewers' exact tastes and preferences, allowing us to show them only ads that have been customized down to an individual level, giving them exactly what they want to see. Liquid Cable's highly targeted and adaptive analytics and ethical profile allow us to analyze, understand and align ads with viewers' behaviors and preferences to a degree never before seen on both ads and entertainment. Viewers will access Liquid Cable primarily through systems such as Blu-ray DVD players and Sony's PS3 console. Our channels will use two sources for our shows, original shows developed in-house and premium shows purchased through aggregators. Bottom line, Liquid Cable gives viewers premium shows for free in digital quality. We give advertisers the marketing arsenal to target their potential customer more precisely than ever before and we deliver the technology gateway for those viewers to interact with products in real time. We're looking for an exclusive group of visionaries who not only want to make a massive return on their investment but who want to be part of a TV and advertising revolution. Liquid Cable, time to turn it on.


So yeah, this talk is to somehow attempt to start where Candy has finished on Wednesday. We have Candy here. He was trying to record you guys for the design team and for UI hacking, so they are going to show you how to actually hack the UI. This talk is somehow primarily targeted at the new user interface but not necessarily new hackers and also the core hackers that have somehow little experience with the UI hacking. And I should perhaps say something quite that I decided to come up with this talk. We have a lot of UI easy hacks and it's somehow considered, like in general, easy hacking. So almost everyone can do that, but I've seen somehow lots of people actually, somehow, it was like this cargo code programming, like everybody is just like taking some bits from here and there, copy pasting them around without understanding what they're actually doing. And it's not surprising because like the documentation, there's some written here and there's some wiki there and somehow incomplete and scattered over various places. So I somehow tried to put this all together in this very talk. So here's some outline of what I will show and what we will learn in case you don't know it yet. We're going to learn how to add a new unit command to somehow do some work around the user interface, how to add a toolbar and sidebar button or menu entry doing that with an item because it's somehow boring and not so fancy without pictures. We'll learn to define the new flow and its interface and connect those two together. I'm intentionally not covering the the widget layout, the UI files because it has been extensively covered elsewhere and it's well documented and there's several G-sub projects about that. So I assume everybody knows it by heart. Yes, so what's the unit command? That's some basic building block of the labor office command dispatch API. Maybe if you've seen that, that's the form the command usually has. Is there some laser pointer perhaps somewhere? Could be on Friday, maybe it's not anymore, never mind. It usually has this one. I have a typo in my slide that should be some that should be a colon after you know who it's. You know colon and command name. Configuration files for you know commands live in this directory, office config registry, etc and there are local commands that are somehow like universal for all applications and there are also commands that can be local to the physical application like writer or whatever and press. This is where they live and here's some examples, some snippet of XML file how such you know command looks. I've highlighted the name you know here page for it with the I've highlighted that in red that's the command actually command itself. Additionally you can define a tooltip text for command which is useful for the sidebar for the toolbar buttons and you can define some additional flags. I originally intended to somehow only quickly fly over those flags because if you put one here it means the command is an icon if there's zero it means it has no icon and all the additional flags somehow seem a little important to me but do we have Flio here? No we don't but somehow I was I was not aware of some some differences because I yes there is. So this flag will be probably important for you if you write RTO or if you write vertical text because here you can define that your icon is supposed to be mirrored for example or it's supposed to be rotated vertically yes so once we have a command we need some entry point something user can hit enter over or click with the mouse on and that's a new element it can be a toolbar button or a sidebar button or some menu entry or some context menu entry but I'm not going to talk about context menus because somehow discouraged to add new context menus. Toolbars. Toolbar configuration is an XML file again it lives usually like for for app you should substitute sd, sw, sd, calc, and press draw a math and there are several independent XML files in this directory for several different toolbars and here's again a snippet of such an XML file defining one toolbar menu entry here we can see the command actually associated with this with this toolbar button and some additional attributes you can define if the toolbar button is visible by default or if it's hidden you can associate the help ID with it and you can also define what kind of toolbar button it is if it's split button or normal button or a toggle sidebar sidebars are thanks to Bendy and his GSOC student from some two years ago uh wideway so it's very similar to dialogues uh I also lived in the CY conflict directory in SPS if there are somehow universal come on to all apps or in the S specific directory sw again and I somehow tried to uh so the XML paper is supposed to be much larger but I made it smaller so that it fits the slide and also thanks to thanks to a feature can be implemented we can already directly associate the you know command which you can see highlighted in red over there again we can associate directly with the with the sidebar button in the white file previously it was done some very clumsy way in the C++ code and you can also edit it in late uh menus are perhaps the most straightforward so there's only one XML file with many configuration for for the application it looks like this and this is perhaps looks familiar because this is this file on menu all apps and again the do not commands are are highlighted over there in red so um every every toolbar button every sidebar button some menu entries as well can have associated icon unfortunately it's not somehow possible for for the for the XML scheme to define a custom name for the custom path to the icon so so the icons have to live in a in a fixed path and have to have specific names and the path is mentioned over there is the icon teams if you're adding a new icon you absolutely have to add it to the galaxy theme uh optionally also to the other themes and it has to as I said it has to have a specific name so if I have a command you know do something my icon has to be named as underscore or l lc underscore the the command name in small letters like without capitals and it has to be in the engine format uh yes so uh if you if you don't want to have a new icon want to use the reuse the existing icon it's possible as well uh in every theme icon theme directory there's a simple text file called links txt which somehow defines links a little between between the different icons so you add a new line which has this form first entry is the is the new icon for your command and the second entry is the existing icon which is going to be recycled as what's the difference between the sd and lc uh some color quality or resolution i don't know exactly so sizes so to let application know about our UI element still some steps are necessary not for sidebars because this works somehow out of the box but the toolbar buttons need to be registered you can't register toolbar button have to find the c++ file c++ um object which is which is called swsc dll and you have to append like that there's a method that registers all all controllers all toolbar buttons for this application and you have to append the your button there and for a dialogue if the if the button new button is going to open a dialogue it has to be registered as well and they have to be added to one of the existing dialogue factories but also also live in that location it's called the algae effect usually so the static spark is over if if you want to roll this text you really will see open bar button or your sidebar button now in the application if you click on it it will do nothing so far so we somehow need to connect the actual c++ function with the heavy lifting opening a dialogue or opening the drop down doing something changing properties well simply doing the dynamic stuff with the with the UI element we've just added and for that we we use the slots you can well with some some adding my blood board and I some point use this as an illustration uh you can imagine it as a platform that connects the UI elements the commands that are associated with them with the actual functionality and there are two types of slots as I said like one is the method slot that for example opens a dialogue and the second one is the state slot which changes a state of an object so you can imagine for example it changes the line changes the color of the line or changes the size of the font and slots live in the oh first slots in the ID they usually like you usually have to find some some HRC file in the in the root directory of your application or in the somewhere in the global includes if it's going to be used by more application and associate the slot ID which usually has this form inside the actors for something with some numerical ID something to wash out for is that like those those HRC files where the slots ID are defined are somehow like they include not not each other but like they can be included and sometimes it get happened and there have been bugs and there have been regressions that there are somehow duplicates if somebody added the slot ID of thinking it does something useful but the same slot ID was actually defined in the included file and some other functionality suddenly it seems to work so for example I think I I've added some some slot ID for changing the background of the text and then somebody filed the back that one can't include the picture and document anymore because it's simply not the same slot ID and wow okay I miss one slide anyway uh slots definitions live in files that have a have an ending as bi like strategy defense initiative but it's something else and they usually look like this so this is an example of the property of the state slot this slot simply changes the color of the form and you can see this is color that's that's our unit command in disguise and it simply maps this unit command the slot ID we've just defined and there's lots of lots of those flags half them are obsolete but there's ill-occupated the round anyway uh I will the last slide that contains some link to the documentation defines like what those flags exactly mean but what's interesting is for example those those configuration flags down here because for example you have to set the toolbox conflict through if this is going to be a toolbar this is a method slot so it does not change state it actually does some other work usually opens a dialogue and yeah the basic difference between the property slots and the methods slots are the spray case over there it should be on a separate line but otherwise it wouldn't wouldn't fit the slide so so I put it nicely that's where some arguments come to this slot it's again like you know about command in disguise which maps to the side of the underscore about slot and this is its return value and as we can see this particular one is a manual entry because this menu config is set to true and everything else is set to false so that would be it and now we have to interface to the slot so actually connect connect our slot to some existing c++ function that is actually doing something uh as it would be somehow I don't know annoying and tedious for every module every application write those huge arrays of c++ functions it's not gonna done like that so we have some sb rdl compiler which I was kind of I don't know um slightly scared to investigate in detail but it goes through all those sdi sdi files and transports them into into actual array of function pointers and here's how a slot interface looks like uh for a slot for for this people's log it has execute method and it has a state method so somewhere somewhere in the in the local implementation or a local subclass of the shell of this aspect shell usually um this is the this prvsh whatever uh it it maps to some um so there will there will be some some c++ file with a similar name that actually implies those functions and the functions have those signatures and they usually contain some some long list of switch case statement for different slots so if you're adding a new functionality you can you can just plug your functionality into the into the existing methods and or define you on but I'm covering that here and some further reading there's some very very good article on all the open office wiki on the slots interfaces valued article on the UI configuration somebody I don't know who it was it's kind of unrecognizable from the link name wrote a simple tutorial how to add some hello world dialogue to the press it lives in liberal office wiki and we also have a very good wiki as I as I mentioned for for the UI format and for all the blade bits happy hacking I actually have further questions if you want to start with UI hacking just don't hesitate and come to come to design channel and I do have no yeah I promise to him to somehow pass this documentation to them so it doesn't have to be embarrassing only on the office wiki anymore but we can have it as well and any questions yes really I think that it's not that people fall back but default on OSX so like default default I think on all sides because it is better has to be the galaxy it can be in the other things it would be better if it was um yeah somebody has to fix the read me the the galaxy the galaxy actually has a big figure I want the other things like putting back to to Greece that good idea because so like Greece looks really different so if it won't be added to the galaxy it won't be found at all I just take the icon and add it to Greece it won't be found but maybe I'm wrong and text box or drop down box and will be followed this way when bringing a new source for this text box where yes you have to you have to follow follow those steps and that's somehow then subclass a toolbox and implement the functionality


Hey friends today, I am back at the Lakeland Antique Mall if you guys aren't familiar I have been down here a couple of times This is where you can buy some unique Disney World props and furniture from the resorts and because there's a lot of Room renovations actually happening at Disney right now including the Polynesian I decided to come down and see if we can find some cool poly furniture, so Let's go do this a Lot of people always ask how far it is from actual Disney World, and it's about 30 35 minutes I clocked it on the way down today, and I left from a Disney park to come here I always love coming down here It is totally worth the trip down here if you're on vacation because you just get to see so much interesting stuff Not just Disney stuff just everything in general one of the coolest places. I've ever shopped and Wow guys, they have definitely gotten a lot more stuff since the last time I was here first of all Remember I said I wanted to see if they had some Polynesian stuff We'll take a look at that. They actually have the Polynesian Resort Decorative Tiki floor lamps these things are massive They're so beautiful though.  I'm not even kidding Something really cool to point out about these Polynesian floor lamps. They have hidden Mickey's all over them Look at that. Do you see the hidden Mickey's? That is so awesome. I absolutely love these I think I need to get one There is a lot of cool stuff guys not just the Polynesian stuff We'll come back. I'm gonna show you all of it, but check this out Take a look at all this cool stuff. This is a curtain from Hollywood Studios in the Muppets Theater That is absolutely amazing. I love it and then down here. We have some props from actual little mermaid ride Amazing isn't it? I absolutely love it. This is all from Eric's market like right outside of the little mermaid And then they also have a splash mountain prop table right here $800 for that table, but the curtain though that is a piece of history right there for $600 That's pretty amazing They also got a couple of new not so scary Halloween party props and tons of ornaments still And I think they have a little bit more Christmas trees that are on the other side So we'll get to those eventually and also a Mickey's very Merry Christmas party one I would love to have that one and that one. They'd be really nice to frame You can actually call the Lakeland Antique Mall and if you see something in this video You want to know how much it costs or even if you want to buy it they can literally Purchase it for you and you could pay over the phone and they'll put it to the side so you could pick it up Or find a way to ship it to you That's really awesome that they do that because a lot of this stuff will go pretty quick I'll make sure to put all of the information so you can look them up at the Lakeland Antique Mall in the description But take a look at some more Halloween props These pumpkins are from Disney Springs and then tons of Halloween horror night stuff Look at this really our cool arcade side. That's awesome. This is a banner from I think it was last year's Halloween Horror Nights $500 for that and then they have some Jurassic Park stuff right here. Oh, you know, I love Jurassic Park Oh Jurassic World Fallen Kingdom. Oh What is this? The mall people prop sign. This is from Universal Studios 2. That's $150, but I really like that Now this is really really unique, but this is fabric from Disney's Riviera resort This is brand new like you can actually see the Riviera in it. This is kind of mind-blowing So I'm not sure what they use this for maybe carpeting or for the chairs, but take a look It's the Riviera that is amazing and they have a whole bunch of it Wow They also have some of your favorite beddings from your resorts plus pillows I seem to have wilderness lodge pillows These are Saratoga Springs pillows and then check out all of the different bed runners from the Grand Floridian and What kingdom lodge? This is really cool. I like this There's a Grand Floridian prop pillow. These are very fancy. I actually have one of these This is another really cool prop from the Grand Floridian. This is an actual parasol parade umbrella. Look at that. Very nifty Actually, they basically have a whole entire wilderness lodge room that you can purchase like you can literally turn a room into the wilderness lodge That's crazy. They got the pillows. They got the chairs. They got the lamps Look at this. Remember what I was saying about the wilderness lodge. Look, they even have the chair That is an awesome looking chair and speaking of chairs. These are very popular These are the animal kingdom lodge patio furniture chairs $135 well worth it Sometimes I get so excited because this stuff is just really awesome But one other thing I wanted to show you I think is really if the this animal kingdom lodge prop table Look at how crafty this is That's pretty amazing $350, but this was actually made at this Wally marketplace. Like that's insane, right? Absolutely amazing. The detail is so perfect for animal kingdom. I Also want to show you more of the Polynesian stuff I got super excited about the floor lamp because that's really awesome But they have a lot more because like you said they started doing room renovations So all that stuff is gonna eventually end up here Here is a desk and a chair from the Polynesian $150 and $45 for the chair. That's really neat. And then they also have this really awesome Princess birthday banner. Look at this. I like that. Oh, and then they have these maps That were actually props from the world of Disney. They have tons of hidden Mickey's and I might already see one right here And the other one is oh down here. I see another one. Those are really cool Then they also have lamps from the Coronado Springs resorts including the chairs plus some Polynesian patio furniture With the table. Oh, and then a Polynesian resort decorative drum. That's really awesome, too I told you lots of Polly stuff some more cool stuff over here Here's a Grand Floridian curtain with the hidden Mickey and then they have the actual lights that go above the bed at the wilderness Lodge and they had a little hidden Mickey's on them. These are $125 Tons of awesome amazing furniture. These are from the art of animation and the Lion King Suites and then a couple of the Bibbidi Boppidi Booster seats. Oh, and then of course the Beach Club Resort headboard in the back there. That's really cool And oh wow, remember me telling you that they were gonna have some Christmas stuff They have a whole lot of Disney Park Christmas stuff from inside the park. That's really awesome They have a lot of that really pretty silver garland from the lamp post actually at Hollywood Studios I love these little decorations. They were fantastic and tons of resort Christmas trees. This is the Yacht Club tree this one is Disney Cruise Line and Then this one over here It's from Disney Springs tons of cool stuff and a whole entire section over here still Wow, they really do have so much. Oh I like this one from Disney Springs as well Very cool stuff Another really cool thing that I just noticed is they have some of these Galaxy Edge Hollywood Studios props. These were actually used in Galaxy's Edge This one actually looks like it was from Doc Ondar's shop Look, you can actually see they have a picture of where it was at Really cool stuff $200 of that pretty pretty awesome $200 to take home a piece of Galaxy Edge I would do that another really awesome thing that I always like to point out is all of the cast member uniforms They're only a dollar each and there are so many iconic ones. I absolutely love it I'm super excited more Polynesian stuff They have Polynesian chairs the Polynesian nightstand What the nightstand seventy five dollars. Oh the Polynesian dresser. That is amazing There's a hundred twenty five dollars for the Polynesian dresser. Oh, wow, I really love this stuff back here a Port Orleans light what display not for sale. Oh, oh Actually, they have them in the box You can actually buy it brand new in the box. That's kind of crazy Another interesting thing how about this pirate to the Caribbean framed art right here? $95 they used this and displayed it. I really like it. It's really cool-looking. Isn't it very fancy and look at this Another Polynesian lamp. This one's really fancy. You can definitely see you might have angered the Tiki gods And like I said, this place is just so much more than Disney and resort stuff They have some things that literally just blow your mind like blow my mind First take a look at this gigantic hippo Murray. Look at this. Is it a hippo? I don't know It's how we how we the hippo Vintage how we the hippo Murray animal cookies advertising mask out that is crazy And then I think I pointed out this strange looking thing here Kind of like a Mickey Mouse, but this is the mouse from the original storyline amusement park That's pretty crazy. Then they have a dragon up here. Just tons of strange Weird oddities and I love this stuff. I absolutely love it This whole entire glass case. I'm about to show you it's literally frightening, but I love it There's a lot of cool creepy stuff Take a look at these dolls Wow You ever see anything like that before and then above they have mascot heads Definitely strange and then over here. They even have like an anatomy like poster This is definitely one of the strangest boots I've seen This is some cool stuff right here, too Look at that Mickey Mouse bubblegum machine and then that darn cat. I love it It takes sigmy secret agent to unravel the perfect crime. That's an awesome poster And as you're just browsing around at the different spots You'd be shocked at some things that you would find here actually like take a look at this 101 Dalmatians the complete happy meal McDonald's set that is so awesome It has all of them and guess how much it is a hundred and one dollars. That is so cool It's massive though, isn't it and I think this is so awesome This is like a nutdish from the New York's World's Fair or wow look at the monorail This is really cool. I absolutely love this. This is basically pre-epcot right here But you know, this is so awesome a good Walt Disney history piece right here Tons of baby Yoda stuff. Look at that baby Yoda ears baby Yoda shock glasses baby Yoda Christmas ornaments socks magnets Wow Well, that's gonna do it for me. I couldn't walk out with any of the Polynesian lamps But luckily they're gonna be putting more and more Polynesian stuff as it gets released out because they still have to Actually finish the renovations. They've not even like 10% done So there was gonna be tons of poly stuff coming in here the next couple of weeks and months And I'm just gonna keep checking on it. So I hope you enjoyed the video. I enjoyed making it That's a train and this is a horse. We'll see you next time. Bye


Hey folks, welcome to Windows Server Engineering Summit. Today we're gonna talk about the evolution of Windows authentication. My name's Ned Pyle. I'm a Principal Program Manager in Windows Server. And the agenda for today is the future of NTLM, what's new about Kerberos and what our plans are. This is all around Windows Server 2025 and Windows vNext. So what is NTLM? It's a legacy of 25, 30 years ago of the 90s. It includes LM, NTLM, NTLM v2. Whenever I say NTLM here, I'm really referring to all of them. Generally speaking, people are using NTLM v2 these days, but it's just too much of a mouthful. It's a challenge response protocol where you have a server and the server says, who are you? And the client says, I'm me and here's a little bit of proof. And the server says, oh, okay, I'll let you in because we can agree that I know what your proof is and who you are. And you can do NTLM directly, like between two machines, or you can have it forwarded on from a target to say a domain controller. So if I've got my laptop, I'm talking to a SQL database running on Windows here, I'm doing NTLM directly with it potentially, or if I need some active directory credential, I'm also being forwarded by that SQL server onto AD and back to that server and then back to my client. So what's so bad about NTLM? It's a weak protocol. So we go back to that situation of the server challenging and that client is being forced to use a password and only a password and not a particularly strong set of architecture that goes along with that password. So an evil listener can say, hey, thanks for this challenge response. I'm gonna use that to go be you, for example, and not even understand what the password is. It also has very weak cryptography. So when the server says who goes there, the client is saying, it's me and my proof is extremely weak. Here's my MD for password encryption scheme. And then the evil person says, well, thanks for this password that I could probably break pretty fast. It also doesn't have any concept of mutual authentication. So the servers you're talking to are completely untrustworthy which means there are things like relay attacks and ability for impersonation to occur and there are bugs in NTLM. What's really wrong about all this? Take password length and the amount of time it might take to break that password. So if I sit there and pump 122 terahashes a second which nowadays is not a difficult proposition or even a particularly expensive proposition over the course of this time and this length of password, never mind the complexity, just the length. 12 character password, it takes quite a bit of time. 11 character password is still reasonably safe. 10, nine, eight, instantaneous on seven or fewer characters.  And so if it's so bad, why is NTLM still being used? One, it's very simple, it's very easy to deploy, it's very easy to code for. It is often therefore hard-coded into applications where they could use other protocols but they specifically hard-coded NTLM, either through ignorance or that simplicity piece. It can be used very easily by accident. For example, in an active directory environment, if I specify an IP address, there's no way to look up a service principal name and I will use NTLM and there's nothing you can do about it. Talk about how that's not actually true but generally speaking, you're gonna get NTLM just by using an IP and you didn't know, it was just an accident. Or it's required by the environment. You don't have domains, you don't have Kerberos, you're operating, say, in a work group and so when we try to negotiate, there's no other choice but NTLM. So when does that force us into NTLM? Unknown server. I don't have a way to figure out an active directory, for example, what a service principal name is. I'm using a local user account right now in the world of Windows today that means NTLM is the only option. I don't have line of sight to a domain controller. There's no way for me to contact a domain controller and use Kerberos or it's hard coded in the application. Those are the four main reasons and this is telemetry. It shifts around a little bit from week to week, these numbers aren't exactly precise but they could be a pretty good idea of what the story looks like overall. So that all seems pretty bad, right? Well, I'm here today to talk about what we can do about it. So what's first off better than NTLM, Kerberos? Kerberos is better and Kerberos is introduced to Windows a long time ago and Windows 2000 in active directory. It's been the primary protocol and since 2010, it's been the one that all Windows developers, all Windows applications, we've recommended that you use through the negotiate process. It is a ticket based system and which means that it's using bits of proof and keys and tickets to pass around information. There's no longer hashes, unsalted hashes for example. So if I take my laptop and I've got a domain controller and I've got something I wanna get to in this case a SQL server running on Windows, my laptop talks to domain controller and back to me to get proof of who I am and to get access to a ticket for me to go talk to that SQL server. I'm not being forwarded along. There's mutual authentication occurring here. It's a very safe and tried and true system. It scales extremely well and it's been sort of our gold standard now for 25 years and it's used throughout the industry. So what's good about Kerberos? It's got very strong crypto. That means crypto agility, the ability for us to swap out older, less safe crypto, cryptographic suites and swap in newer, more modern ones. So for example, in the last couple of years disabled using our C4 because it had no longer become safe to use. And that gives you the ability to be what post quantum computing resilient, right? So you could say as the cracking power of quantum computing increases or becomes generally available, our ability to swap out the crypto helps us negate that things effect. It is mutually authenticated. It isn't just passwords. So you can use smart cards, certificates, Windows Hello for Business, Fido, Fido 2, all those things can be used instead of just plain old, boring old fashioned passwords. It's extremely interoperable, extensible, IATF standardized, Kerberos really is the way to go. Oh, and it's delegatable, delegated. So I can set up things where Kerberos is done on my behalf safely by trusted devices, something which NTLM cannot do. So NTLM seems bad, Kerberos seems good. How do I get to the point of using Kerberos for everything? How do I as a running an organization get myself out of this NTM situation? And so we've provided a large number of new capabilities in Windows Vnext and in Windows Server 2025 to take care of that. So we're going to start phasing out NTLM and using Kerberos more and more through a number of things. One is called IATURB, one is local KDC, one is IP to SPNs, and one is making NTLM less likely to be used or instead have negotiate step in. And why would I, what would be the situations of this, the scenarios and when I would use each of these? So if I don't have line of sight to the KDC, to the Kerberos key distribution center on the main controller, I can use IATURB. If I'm using a work group, local authentication, I can use this new local KDC. If I'm using IP addresses for some legitimate reason, an application requires it, I can now add IP addresses into the SPNs. And if I'm using any sort of hard coded or unnecessary NTLM, there's some techniques we can use to identify those, fix or block that from occurring and move into the recommended negotiate way of doing security. And so let's go through these. So what's IATURB? This is all that you might not have heard of. It's initial and pass through authentication. The IA is sort of a weird acronym for all this initial and initial authentication, whatever. But it really is still just Kerberos V5, it's still GSSAPI. And you can think of IATURB, it is a security package in the existing negotiator, security package negotiator of Windows. And so you need an updated client and an updated target to use IATURB. You don't need an updated domain controller. Any old domain controller will do. And so Kerberos really doesn't change very much here in how it actually operates, but we are modifying some of the fundamental ways that ticket exchanges happen. And that lookups occur. So under the covers, you still get the standard Kerberos tickets, but they move in a slightly different way. And I'll actually show you a demo of this in a second. And what it does is it's forwarding Kerberos through the target to a domain controller. You don't need line of sight from the client to the domain controller anymore. As long as the target has line of sight and the client can see the target, you know, your SQL server, your file server, whatever, then that's good enough. So let's see how this would look. I've got my laptop. I've got a domain controller. I've got the thing I wanna get to a SQL server, right? So with normal Kerberos, I would send along a ASRAP and an ASRAP. I would do my first conversations with the domain controller back and forth to get a ticket granting service ticket for my target. Now, if that's blocked, like for example, my laptop is on the internet, there's no way I can get to that domain controller directly, right? That's blocked by firewall. But with iCurb now, I can talk to my target server, which is in an edge location, let's say, the DMZ. It can talk to the domain controller. I can't talk to the domain controller, but it can talk on my behalf. So when I send my AS request and I get my AS reply that passes through that server back to me on my laptop. And the same thing happens for my TGS request and reply. And then when I go to do my usual AP to that server, which I have live site to, that now works. And so you notice here how I didn't actually ever talk to the domain controller directly from my laptop. That's how iCurb works. Let's see this thing in a real demo here. So I'm gonna just map a drive here because I don't have SQL servers lying around, to this server using a domain credential, okay? And I have blocked at the firewall my ability to connect to that server. So I'm just mapping a drive. So what is that server? It's this .59 machine and this 101 machine is my domain controller. So here's 59, here's 101. Notice how the conversation is happening between my target server that I'm on right now, you saw, and the domain controller directly. It's not between the client and this domain controller. Otherwise I wouldn't see it in the wire chart capture, right? And if I look at the actual SMB connection, only then is it between me and the target. And so I've mapped my drive and it all worked with Kerberos, even though I couldn't get to the domain controller and I can see stuff, access data, see my little picture of Kerberos, isn't that cute? Then there's local KDC. That means local users and groups get Kerberos now. A KDC without a domain controller, a KDC without a domain. It's on top of the security account management database, the old database of the local authentication in Windows. And it still requires an IECURB enabled client, right? Because there's no service principal names, there's no DNS and this could be me in my living room talking to a laptop on the other end of the couch. But that means that no longer using NTLM for work groups, for local remote authentications with local users. And this is something we wanna make sure is open standards interoperable so that we can talk to other types of devices that aren't Windows in the future using this local KDC thing. Either they could be NAS devices, they could be appliances, they could be other operating systems. We wanna make sure this works for everybody so that no one's using NTLM. So how do I see this in action right here by my laptop? I'm talking to a Windows server. I have IECURB here to help me figure out like, oh, this isn't a domain, but this is local and I wanna use a local user account. And my entire ticket exchange happens just between those two machines. As if the Windows server SQL box was a domain controller, but it's not. It's just another server and a work group for me. This would even work between my laptop and another laptop, like in a complete consumer scenario with no setup, no nothing required. It just happens automatically. So let's see how automatic it is in my local KDC demo. So here I'm on a server and you can see I've got a local user called local admin. And I'm running this new Kerberos local key distribution center, local KDC service on here. That's all it takes. No other configuration is going to happen right now. I'm just gonna try and connect to it from my client. So I'm gonna map a drive over there to it. And you'll see as I map again, this is that same share I was using before. But this time I'm using a local user account, that local admin we just showed. And once I map that drive, notice that my entire conversation happens here directly with that machine. And my Kerberos conversation is happening at all, right? Because if this was the past, if this was the old days, this would all be NTLM because I'm in a work group using a local user. There is no Kerberos, right? With local KDC, there is. The next thing we can do is make sure that when we're using IP addresses, we intentionally set it up so that they can still use Kerberos as well, which does not happen by default, right? Right now a service principal name, inactive directory for Kerberos gives you a DNS, FQDN, a NetBIOS name, a service name, and no IP addresses are ever set. You can make your clients use IP for Kerberos. This has actually been around since Windows 10, but it's not something you might have heard about. So there's a registry value you set in your Kerberos clients. This value right here called try IP SPN, hence the name. And then you set SPN, you add the IP address on to whichever machines inactive directory you want to start using Kerberos with IPs. And that's all there is to it. That's the entire process. You figure out some machines, some applications that are using IPs, and there's nothing you can do about it because the real solution is not use IPs. And so you have got these IP addresses you've gotta use. You specify those with set SPN to actually have service principal names and you put this registry value onto all your systems and that's it. There's an article on this over at aka.ms for slash try IP SPN, it's not even that long. This steps on the screen here, effectively just about all the steps, it's pretty straightforward. And then the last thing, and this is the hardest thing, is switching to negotiate, to stop using NTLM intentionally when all of these things, even though these things are available, you are still basically hard coding NTLM or allowing NTLM to be chosen. So the ways to take care of this, one is to upgrade applications. Applications that require NTLM, there's nothing that can be done unless they're upgraded and told not to do it anymore. You can stop hard coding. If you're writing applications, you've got line of business applications. If your company is developing applications, your organization, stop hard coding NTLM there. You can also block NTLM. You can block NTLM in a few different ways, but one modern way, a new thing you can do in Vnext and Server 2025 is blocking it specifically out of negotiate. The first example of that is SMB, which is, you might've been wondering why me, Ned, the SMBPM is here talking about a Kerberos content, but I actually, I've worked on this Kerberos stuff quite a bit along with that team because we specifically added functionality together to make it so that apps and drivers in Windows can say like, yeah, we're gonna use a negotiate, but we're not gonna allow NTLM to happen, even so.  And you can control it for SMB with PowerShell, Ker policy or the mapping tool. So for example, if I want, I could map a drive and say, don't ever use NTLM. I can also set a group policy that says, no matter what, when you do SMB, just use negotiate and no NTLM. And if only NTLM's there, then just don't connect, like that's just too bad. And I can also set it through just a global setting. So right here on this client configuration, on this machine, if I was to set to stable NTLM to true, for SMB, notice we're in the SMB client configuration PowerShell. That means that no matter what, if somebody tries to make me use NTLM, I get sent a strange email from somebody with a UNC path. And I was to click on that email as an unsuspecting user, because that strange email came from an evil person who was trying to get me to send that challenge response that we talked about up front. Remember the challenge response where my week MD4 password unsalted would be sent along, which they can then plug into some GPU array to break in two hours. With this way of doing things, my hash would never leave my box. NTLM would never be admitted, and there would be no concept of SMB being able to be told or forced or tricked into sending along NTLM password information or hashes for replays or anything.  And with this, you can do things like set exception. So, the first thing people say is, well, I've got some NTLM that I might need to use for SMB. I've got this old NAS box that only does NTLM. We're in the process of migrating off of it, but I can't right now. What do I do? You can still set exceptions in this particular setup with SMB to say, well, I won't do NTLM to anybody except this machine or this set of machines. And then you can specify that in group policy and in PowerShell, and that'll give you some wiggle room. Well, the goal of security isn't to like have an all or nothing zero sum of safe or unsafe, right? There's no such thing. There is a degrees, levels, defense in depth, and trying to remove as many easy and then progressively harder ways to compromise the system. And this is a big one right here. SMB's been abused for some years as a way for relay attacks and past the hash attacks and credential attacks, just because it was highly available and ubiquitous and constantly in use and very easy to get to because you needed SMB to copy files and open shares and pump data around. And there's also been, since Windows 7, if you really look back into some extremely old Ask DS articles from me from 12, 13, 14, 15 years ago, you'll see talking about how to block NTLM the old way. So you need to first think about the audit and analysis options. If your plans to go through and start hunting down this hard-coded NTLM or use of NTLM in your environment, you've got some tools. One, we have several policies, security policies, where you can audit incoming NTLM traffic and you can audit NTLM auth in the domain. That way you can see who's doing NTLM. Start just running that on all your machines, all your servers, even on your clients and definitely your main controllers and figure out where is NTLM coming from and start building up an inventory of things which are accidentally using NTLM versus intentionally or perhaps inexplicably using NTLM, the need investigation. And you can also use network captures, process monitor and some new options here that I can't talk about yet that are coming into the auditing space of Windows to further identify who is emitting NTLM. So you can go back and see if they must. And then you get into the option of blocking. So all those things we did there that allowed NTLM to be converted into something where it's gonna use Kerberos instead, you still wanna be able to block NTLM so it does not accidentally emitted or used for evil. So you can restrict NTLM inbound, NTLM in the domain and outgoing NTLM to remote servers with these policies, which go back, like I said, to Windows 7, every version of Windows that you're running, hopefully, can do this already today. And like I showed with SMB and that new way of doing things, you can also set exceptions. So you can restrict certain remote servers for specific servers and exceptions in this domain to allow NTLM, just in case you've got scenarios where hard-coded NAS box, you can't get out of that NAS box, it's got too much data on it, it's gonna be a while before it can be replaced. And you still wanna be able to connect because you've got a business to run, you've got an organization to keep going. But you've minimized your footprint. Your down to just a handful of machines using NTLM and the rest, because they don't need to, aren't. And that means we're talking about Kerberos for all, Kerberos for everyone, the ability to live in a world of negotiate where Kerberos is the primary and the first thing picked and there's nothing else picked. Meaning that NTLM is being deprecated. What does that mean to be deprecated? That means that you're only gonna be able to get security bug fixes. There's not gonna be any improvements, work, anything done to make NTLM better in some possible way because we think what's better is Kerberos than negotiate. It's not gone. NTLM is not gone in Windows Server 2025 or Windows V Max. Deprecate does not mean remove. Deprecate just means no longer being worked on and it's going to leave at some point. NTLM still works, NTLM is still supported. If you call and say I'm having some problem, I can't authenticate, I'm using NTLM, no one's gonna hang up on you. You still get to use NTLM for any necessary usage. But it marks the beginning of a campaign. That campaign is for us to, like here, inform, let you know what's going on, let you know what's coming in the next version of Windows and that the NTLM is not long for this world and then start to reduce your usage over the next few years, reduce and reduce and reduce down to what's necessary and then eventually end that usage either through our technologies like adding iCurb and local KDC, your things like removing hard coding from your apps or upgrading things until the point where you no longer have any NTLM. This might seem like it's insurmountable, right? I can tell you as somebody who worked on the SMB1 campaign and drove that for eight years here, I started at 45% SMB1 usage in telemetry. I would see about half of all SMB traffic with SMB1 and eight years later, it's now about 0.25%, almost entirely eradicated. It is very possible to do this. You just gotta bear down and we're gonna bear down with you. And that roadmap looks a little bit like this. So obviously here's what's coming, iCurb, local KDC. This NTLM to negotiation sort of options like SMB has done. But NTLM is still enabled. It's still enabled out of the box. You're in market OSs. We ship this and start figuring out how things have looked and things. We will start talking about what about back porting? What about bringing some of these options backwards into older OSs? We need your feedback and as much as you possibly can give us to justify that work, to give us examples and to help us come up with the resources to make that happen. And then at some future major release, NTLM will be disabled by default, but still available. And that at some major release after that, NTLM will be disabled and leave the machine. And it'll become available as a feature on demand, something that you can download, but the binaries won't be there and you won't have NTLM existing in Windows out of the box. And I don't have timelines on this. I don't have dates, obviously. This is gonna take us years. You're gonna be along for this ride with us. For anything NTLM related or you want to report issues, ask questions, send feedback, point out some vendor, anything you wanna do that says, like I have something about NTLM, just email ntlm at microsoft.com and it'll come directly to the engineering team. We will see this stuff and we'll be able to tell what's, hear what you're saying, hear what you're thinking, know what's going on with you. Perhaps give you advice. Perhaps you'll be able to influence future NTLM deprecation. Thanks so much for your time on this. I know this is a lot to think about. You might be watching this presentation a few times. This is going to be a long journey and we're very excited for you to come along on it with us. Thanks so much. Enjoy the rest of Windows Server Engineering Summit.


will continue to have community testing through the Wisconsin National Guard on Wednesdays and Fridays at the Sheboygan County Aging and Disability Resource Parking Lot in Sheboygan Falls through December 9th. There will be no testing, however, on Friday November 27th for the Thanksgiving holiday. It's strongly recommended that you register ahead of time via the COVID-19 Wisconsin Connect website. Registration does not give you an appointment time, but it speeds up the process at the testing site and prevents potential data entry error.  I just want to update some of the numbers today over the weekend. Our positive case count grew by 110. It's now at 7,225. We have 2,199 active cases, and that's down from Friday. It's down 262 cases. Over 4,983 people have recovered. That's up 372 over the weekend, and the deaths remained at 43 over the weekend, and we have 32 individuals that are currently hospitalized, and our negative case count is up to 33,783. Governor Evers recently issued the Executive Order No. 94 that urged that Wisconsin residents should take cautionary measures during the surge of COVID-19 cases in the state of Wisconsin. Cheboygan currently has experienced a very high level of COVID-19 and significant spread throughout our county. In the last few weeks, we were regularly seeing 100 to 200 new cases per day and are now over 40 deaths. Disorder is in alignment with the recommendations of the Cheboygan County Public Health Department, and it stresses the importance to stay at home as much as possible, only make trips when necessary, such as going to work and picking up groceries or filling prescriptions. Only leave your homes for essential activities, also like school, grocery shopping, and do not hold gatherings with anyone outside your immediate household, and avoid all in a non-essential travel, and do not gather in person with friends and extended family members on holidays, such as the upcoming Thanksgiving holiday. Standing local recommendations include physically distance at least six feet from the people whom you do not live with to wear a cloth, a mask, wash your hands frequently with soap and water, or use hand sanitizer with at least 60% alcohol.  Get tested and stay home while waiting results. Cooperate with public health officials if you've tested positive and had a close contact. Businesses and community organizations should use the WEDC guidelines when possible and encourage remote work opportunities to support physical distancing. Retail, hospitality, and restaurant bars need to encourage curbside pickup and delivery option. Require mask face coverings of staff and customers. Limit capacity within non-essential business bars and restaurants to 25%. Community and large gatherings are not recommended at this time as such sporting events, weddings, reunions, and celebrations that bring large numbers of people together. Avoid unnecessary activities and travel within the community that puts you in contact with others. Sheboygan has really reached a critical point in the surge of the COVID-19, and this new advisory is a multifaceted comprehensive effort to stop the virus in its tracks. The gains that we've made in the past year have been the result of our willingness to work together. Even in this difficult time, we will continue tonight as unite as we always have for our city in order to help the rise that we're seeing. And let's shake out of the fatigue that we've been experiencing and make a critical difference in stopping the coronavirus.


Hello and welcome back today. I am answering a question that I have been asked many times And was asked again recently via one of my YouTube subscribers You can always ask me questions drop them in the comments below and I add them to my to film list So this question is about self-harm and the question is should self-harm injuries or scars be covered up? Now I can't give you a definitive answer because you may work somewhere Where or go to school somewhere where there's a specific policy on this or specific Procedures in place and you need to consult with that But it might be that some of the ideas in here give you a little bit of pause for thought And you might begin to question some of those policies and procedures So I looked into this quite a lot and I spoke into a lot of colleagues who are experts in the field I've also consulted with people who work with young people and I've talked to young people themselves about how they feel about it And I've come to what I think is quite an informed view But I'm also really really happy for that view to be challenged So if you've got different ideas on this or your experiences don't bear out what I say in the video Please leave a comment below and let's have a conversation so my kind of rule of thumb basically is that When an injury is still an injury then we need to think first-a-first and that naturally Injuries which are in any way any sort of like open wound or wound that is in the process of healing Then we would cover that up because we do not want to risk infection And so yes, so you're likely to keep that covered with a dressing and keep it covered with clothing The other reason for keeping injuries covered is that it can also be triggering for other people who might be struggling with self-harm So that that's kind of an additional reason But the key reason here is actually about the safety of the person who has an injury We want to allow it to heal properly in just the way that we would with any other wound So if you had burnt yourself or cut yourself Accidentally then you would be unlikely to kind of have that wound sort of on show however Once a wound gets to the point where it's fully healed and a scar has formed then I think things begin to change and Here I think that we should treat those scars just as we would any other scar So imagine that the scar had been gained through an a car accident, for example Then that scar should be either covered or not by clothing Depending on the situation depending on the weather largely so dress for the weather But also dress with what makes you feel comfortable So some people who have gained scars through accident or who perhaps have for example birthmarks They might choose to Camouflage them with makeup or cover them up with clothing because they don't like them and that might be you know That's a subject for another discussion We might want to explore about Acceptance of our own bodies and our scars no matter how they are obtained But some people choose to cover them up because they don't want them on show other people are completely happy to have them You know just just to dress for the weather and if that means shorts leaves and scars are showing on arms For example, then so be it No one should make that decision on behalf of someone who has scars other than that person themselves now The one thing you might want to bear in mind So largely when we're thinking about self harm we tend automatically to think to young people and what they would be doing For example in a school or social situation, but sometimes the person who self-harm isn't the child sometimes It's the teacher. I'm the person who self-harm sometimes and haven't done for many months now Touching wood and working hard on that but I have scars and I've had to ask this question of myself quite a lot and One of the things if we are in a position where young people look up to us and we're working with vulnerable groups Who might be more at risk of self-harm or might be self-harming themselves a big Question that always I bear in mind here is how are these scars going to be interpreted by these people that I'm working with? and One thing I have had fed back to me about my scars in the past They've they they over time they look less bad and they heal more and they become paler But when they were Looking worse, I guess one piece of feedback I had from a young person which I took very seriously and have talked with others about it since is that when an Adult who is teaching or talking about these issues and encouraging you to come forward and talk about for example Self-harm if you have an issue with it if that adult Has scars which are more severe than the type of injury that you're inflicting on yourself Then you might feel less likely To come forward and talk about your issues because you don't think your issues are bad enough And actually this is the same reason why when we are showing Video content or resources in class about things like eating disorders or self-harm. We don't show injuries We don't show emaciation. We don't show extremes Because what can happen then is the young person think well, I'm not thin enough to deserve help my Injuries aren't bad enough to deserve help. So if you're working with young people It's just something to bear in mind if you have particularly You know if your if your scars are particularly I guess big And that might make a young person think ah, okay. I'm not bad enough to deserve their help They won't take me seriously Then either you need to tackle that head-on by saying you know literally saying that The injuries of any size The size of the injury doesn't indicate the level of discomfort and distress that the young person might be in and that He would always be taken seriously and then to actually follow through with that Or to think about whether it's appropriate to have those scars on show. So that's just something to bear in mind The other thing is that yeah, anyone of any age who does have their scars on show That means it sounds like you're kind of going. Yeah, look at my scars Look at my scars and that's not at all I mean what I mean is if you're just dressing for the weather and people might happen to see your scars You kind of have to be prepared for three things One is that if people see that you have scars which are clearly from self-harm Then you are more likely to happen people make a disclosure to you whether you're an adult or a young person So you need to be prepared for that you need to be prepared how you would respond if someone started talking to you about their own self-harm issues and What you know what you would do what you would suggest how you might support them or how you might kind of Suggest they go and get help somewhere else So you need to be prepared for that that yeah someone who is struggling themselves might suddenly go Oh, this is someone who might understand and they might make that disclosure. So yeah plan ahead for that The next one and this sounds really weird is that people might just not notice so often It can be a really big thing kind of building up to the point where we feel ready To be open and honest with the world by wearing clothing Which reveals scars about which we have lots of different feelings and every scar might tell a different story And this might feel such an integral and massive part of us that is linked with kind of I don't know Sometimes with guilt and shame, but also sometimes with a huge sense of pride because yeah These are scars now and these are battles that I won And when we have all those feelings mixed up and then we have our scars Visible and nobody even notices that can be strangely difficult to manage. So that's something to be prepared for too And the third thing that we have to be prepared for Is that people might ask questions? So it might not be that they're making disclosures about their own self-harm, but they might ask Oh, how did you get those injuries particularly young children might do this? And so you need to think about, you know, who you're going to come into contact with what kind of questions You might get and how you feel happy Responding to those questions and what's an appropriate sort of age and stage way to respond to these questions from the people Who might be asking them? So for example when it comes to younger children I often found that if young children asked me about my scars then I would explain that Well, these are something that happen when I'm poorly a bit like remember when you got chicken pox and you when you were poorly Then you got those spots on your body and it left some scars behind and and it's a little bit like that for me When I was poorly with depression then that's when I got these scars But they're getting better now because I'm getting better too and that often you find particularly with young kids They're like, oh, yeah, right, whatever. Can we play with the, you know, I don't know. Can we go play with Lego now? And and they kind of move on. So, yeah, okay, hopefully some food for thought But yeah, so the long and the short of it should scars be covered I think when an injury is an injury, it should be treated as such it needs to be kept covered away from risk of infection and Should also just bear in mind that this might be triggering for someone Scars I think we should dress for the weather but just bear in mind who we're gonna be around and be prepared for the responses We may or may not get from those around us. I hope this was helpful I would really really love to have a conversation about this So please leave comments below with any thoughts you have what you agree with what you disagree with What your experience has been of this and maybe what policies you have in place where you work if that's applicable And yeah, yeah start the conversation. I Yeah, and Completely lost my train of thought. Okay. Yeah, that happens If you would like to watch me lose my train of thought in future videos, then please subscribe And if you found this useful, then please give it a thumbs up and I will see you next time. Goodbye