Share via

Windows Hello for Business and Azure Virtual Desktop / VDI

Tom James 1 Reputation point
2022-09-21T15:21:17.55+00:00

Hi All,

We recently implemented the Microsoft Cloud Hybrid Trust method for Windows Hello for Business, this has left our AAD joined machines able to access On-Premise shares, SQL servers etc using their Windows PIN.

The final hurdle for us is to get PIN working with Remote Desktop (Universal Windows Application, not MSTSC) however, it doesn't seem very simple.

We have a functioning PKI with publicly accessibly CRL. We have IIS and NDES configured and working so Intune can push out certificates as requested but here lies the problem:

We created the certificate on our CA as per the instructions from Microsoft (https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs) but whenever Intune runs, our CA issues IPSec (Offline) and not the WHfBCertificateAuthentication certificate.

Has anyone got any ideas as I'm pulling my hair our now!

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,191 questions
Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,564 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,848 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. JimmySalian-2011 42,146 Reputation points
    2022-09-21T15:37:27.277+00:00

    Hi Tom,

    What is the enrollment policy for the devices? Which option you are using to request the certs is it Intune or manual? If the IPSec Cert is not required you can set the permissions to deny for autoenroll.

    ==
    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

  2. Tom James 1 Reputation point
    2022-09-22T13:24:19.293+00:00

    To give an update - it's still not working but we have tried:

    • Removed IPSec (Offline) from a certificate that can be published
    • Removed permissions for the above certificate to be enrolled
    • Set the WHfB certificate to supersede the above certificate
    • Redid the Intune SCEP profile
  3. Thomas 0 Reputation points
    2024-07-18T05:47:16.3366667+00:00

    Hi there,

    nearly 2 years later and no solution? I would be also interested in an solution for this topic.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.