With older versions of AD FS you could customize the look and feel using web design. With 2012 R2, there is no more dependence on IIS, with AD FS now built directly on top of HTTP.SYS, meaning no installation of IIS is required. You can read all the PowerShell commands on TechNet.

I had a few questions on this so below I have shared the commands we used to configure contosodemo.com.

The page looks like this:

And here are the commands run to configure as an example of how you can do this.

Set-AdfsGlobalWebContent -CompanyName "ContosoDemo.Com"
Set-AdfsGlobalWebContent -ErrorPageSupportEmail "Report this error"
Set-AdfsGlobalWebContent -ErrorPageDescriptionText "Access Denied"
Set-AdfsGlobalWebContent -HelpDeskLink "https://adfs.contosodemo.com/adfs/portal/updatepassword/"
Set-AdfsGlobalWebContent -HelpDeskLinkText "Change Password"
Set-AdfsGlobalWebContent -Homelink "https://www.contosodemo.com"
Set-AdfsGlobalWebContent -HomelinkText "Website"
Set-AdfsGlobalWebContent -PrivacyLink "https://www.contosodemo.com/privacy"
Set-AdfsGlobalWebContent -PrivacyLinkText "Privacy Statement"
Set-AdfsWebTheme -TargetName default -Logo @{path="C:\scripts\images\ContosoDemoLogo.png"}
Set-AdfsWebTheme -TargetName default -Illustration @{path="C:\scripts\images\family.jpg"}
Set-AdfsGlobalWebContent -SignInPageDescriptionText "<p>Access to ContosoDemo.Com resources may require device registration.<br><br>You can change your password using the 'Change Password' link below after you have registered your device.</p>"
Set-AdfsGlobalWebContent -UpdatePasswordPageDescriptionText "Please enter your user account, old password and your new desired password twice. Note that your new password must meet the ContosoDemo.com password complexity requirements."
Set-AdfsRelyingPartyWebContent -Name "sharepoint" -ErrorPageAuthorizationErrorMessage "<p style='font-size:0.9em'>ContosoDemo.com requires you to workplace join your device to access this resource.</p><br><p>On your <b>Windows 8.1 device</b>, use <b>PC Settings<b> to join your device to the workplace</p><br><p?On your <b>iOS</b> device, click <a href=https://adfs.contosodemo.com/enrollmentserver/otaprofile>here</a> to join your device to the workplace</p><br><p style='font-size:1.0em'>Please close the browser and access the application after you have workplace joined your device.<p>"
Set-AdfsGlobalWebContent -ErrorPageDeviceAuthenticationErrorMessage "We were unable to authenticate your device. Either your device is not registered or the certificate your device presented is invalid.  Please register your device and try again."
Set-AdfsGlobalWebContent -ErrorPageGenericErrorMessage "An unexpected error has occurred, please let the administrators know"
Set-AdfsGlobalWebContent -ErrorPageAuthorizationErrorMessage "Sorry, we were unable to authorize your access, please try again. If this error persists, please contact the administrators."

I hope that’s a useful example.

A.

Today we are excited to release the Work Folders client for Windows 7.   We know a lot of our enterprise customers are running Windows 7 and also want to take advantage of being able to sync documents from File Servers to these clients.

A common question about Work Folders is it’s relationship to OneDrive and OneDrive for Business. Here’s the comparison:

• OneDrive is a consumer service, not for work documents.  Store your personal stuff here.
• OneDrive for Business allows you to take documents offline from SharePoint, either on-premises with SharePoint Server, or as part of Office 365, and also includes powerful collaboration and sharing capabilities.  Store your workgroup and work documents here.
• Work Folders lets you take File Server data offline, it’s just your documents, not workgroup and does not have sharing or collaboration capabilities.

There are 2 important requirements for the Windows 7 client you should know about:

1. The Windows 7 PC must be domain joined.
2. We support Pro and above SKU’s

There are good, valid and well thought through reasons why these requirements are in place, and there are no workarounds.

You can get the bits from here.

Enjoy!

A.

We’ll be bringing this under the Microsoft brand as part of the removal of the Forefront brand, adding support for the latest platforms and investing in some exciting new areas.

You can read the full blog here.

Enjoy.

A.

There are two Foundation Sessions at TechEd that start with “Enabling Enterprise Mobility” … why?

We agonized over this and debated a lot, but ultimately these 2 sessions should be considered complimentary and you should go to 1 and watch the other later .  Together they cover the breadth of what Microsoft does in this space, and we did not want to restrict or do an injustice to any of the content.

FDN02, which is “Enabling Enterprise Mobility with Windows Intune, Microsoft Azure and Windows Server” is the Enterprise Mobility with People-centric IT content, we look at Enterprise Mobility in a very broad sense … across platforms (so we will have the iOS and Android demos) and 4 main solution areas:

• Mobile Device Management – policy, application deployment, Company Portal and so on.  This is Configuration Manager and Windows Intune
• Desktop Virtualization – Remote Desktop Services, VDI etc
• Access & Information Protection – Windows Server BYOD scenarios … Workplace Join, Work Folders, Rights Management, AD FS, Web Application Proxy
• Hybrid Identity – Azure AD Premium, AD, Identity Manager, Sync and Federation

FDN03, which is “Enabling Enterprise Mobility with Windows and Microsoft Office 365” is, as you can tell by the name, the Windows (which includes Phone) and Office story, productivity, great devices and experiences, communication, collaboration and the Windows enterprise story.

Ultimately, you should go to the session that is best aligned to what you want to see and learn or that best fits the world you live and work in.

I can tell you that FDN02 is going to be very demo heavy including some new things you will not have seen in action before .

We look forward to seeing you there.

Here are the 2 PowerShell scripts.  Copy into the PS ISE, save as .PS1 files.

Note, if you redirected the RegisteredDevices location during install, update to reflect your location.

Usage:

getregistereduserfordevice.ps1 <devicename>

getregistereddeviceforuser.ps1 <user>

GetRegisteredUserforDevice.PS1

#user is provide by argument
if ($args.count -ne 1)
{       
    Write-Host "Usage: GetRegisteredUserForDevice.ps1 <device name>"
    exit 1
}

#get user's sid
$domain = Get-ADDomain
$deviceDisplayName = $args[0]
$userSid = (New-Object System.Security.Principal.NTAccount ($domain.NetBIOSName ,$userName)).Translate([System.Security.Principal.SecurityIdentifier]).value

#search device object when device displayName = client computer name
$objDefaultNC = New-Object System.DirectoryServices.DirectoryEntry

$ldapPath = "LDAP://CN=RegisteredDevices," + $objDefaultNC.distinguishedName
$objDeviceContainer = New-Object System.DirectoryServices.DirectoryEntry($ldapPath)
$strFilter = "(&(objectClass=msDS-Device)(displayName=$deviceDisplayName))"

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDeviceContainer
$objSearcher.PageSize = 100
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Onelevel"
$colResults = $objSearcher.FindAll()

Write-Host "Found" $colResults.count "device objects in AD whose displayName is " $args[0]
foreach ($objResult in $colResults)
{
    $sidString = ""
    $objItem = $objResult.Properties
    $userSid = $objItem.'msds-registeredowner'
    $userSid = $userSid[0]
    for($i=0;$i -lt $userSid.count; $i++)
    {
        $sidString = $sidString + [char]$userSid[$i]
    }
    $objSID = New-Object System.Security.Principal.SecurityIdentifier($sidString)
    try
    {
        $objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
        Write-Host "UserSid:" $sidString "UserName:" $objUser.Value
    }
    catch
    {
        Write-Host "UserSid:" $sidString "Failed to get user name, user might be deleted"
    }
   
}

GetRegisteredDeviceforUser.PS1

#user is provide by argument
if ($args.count -ne 1)
{       
    Write-Host "Usage: GetRegisteredDeviceForUser.ps1 <user name>"
    exit 1
}

#get user's sid
$domain = Get-ADDomain
$userName = $args[0]
$userSid = (New-Object System.Security.Principal.NTAccount($domain.NetBIOSName, $userName)).Translate([System.Security.Principal.SecurityIdentifier]).value

#search device object when registeredUser = user sid
$objDefaultNC = New-Object System.DirectoryServices.DirectoryEntry

$ldapPath = "LDAP://CN=RegisteredDevices," + $objDefaultNC.distinguishedName
$objDeviceContainer = New-Object System.DirectoryServices.DirectoryEntry($ldapPath)
$strFilter = "(&(objectClass=msDS-Device)(msDS-RegisteredOwner=$userSid))"

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDeviceContainer
$objSearcher.PageSize = 100
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Onelevel"
$colResults = $objSearcher.FindAll()

Write-Host "Found" $colResults.count "device objects"
foreach ($objResult in $colResults)
    {$objResult.Properties}

Hopefully that is useful.

A.

Is it possible to restrict access to Office 365 from just internal devices or client types? Yes.

Full details here: https://technet.microsoft.com/en-us/library/dn592182.aspx 

Client access policy works by identifying which authentication requests should be permitted based upon attributes of the request itself. To provide this additional request context information, AD FS populates claim values from the client request information such as the connection IP address, the AD FS endpoint, and HTTP headers sent by the client.

You can read the announcement here:

https://blogs.technet.com/b/ad/archive/2014/04/03/azure-active-directory-premium-has-reached-ga.aspx 

This is a fantastic milestone and I’m looking forward to being involved as we continue to evolve and add even more to our platform.

A summary can be found here: https://blogs.technet.com/b/windowsserver/archive/2014/04/02/windows-server-2012-r2-update-is-now-available-to-subscribers.aspx 

More details here: https://technet.microsoft.com/en-us/library/dn645472.aspx 

From the articles: (the AD FS update is a biggie, will unblock many customers with UPN challenges)

Here is what is included in Windows Server 2012 R2 Update:

• Cumulative roll-up – Windows Server 2012 R2 Update includes all of the previously-released monthly roll-ups, individual updates, and security updates released since RTM.
• Bug fixes – In response to customer and partner feedback, this update includes a range of performance and reliability improvements.  
• Enhancements – A range of enhancements are also included in the update including:
  • Enterprise Mode for Internet Explorer (EMIE).  This is focused on delivering better compatibility for server line of business applications.  
  • Active Directory fix for Office 365, to enable sign-on using an Office 365 email address. This would also make the RDS end user experience the same as on Windows 8.1 Update.
  • User interface.  On a typical server installation, end users will see a Search and a Power button on the modern Start page.

No system APIs have been changed and there are no changes to hardware requirements.  Aside from a single reboot, there is no action for you to take if you have turned on automatic update.  Plus, you will not need to re-verify nor re-certify your server applications, including System Center.  They should “just work” without requiring any additional testing.

We have been working with customers and partners who have already tested the update.  We've heard consistent feedback that the update experience was smooth and easy.  Customers also reported that their server applications continued to work with no issues.  Several noted that the EMIE was very useful in ensuring compatibility for their LOB apps.

We encourage you to apply this update to your Windows Server 2012 R2 systems as soon as possible.  This will ensure that you continue to benefit from the enterprise-grade performance and protection that our platform delivers.  It will also ensure that you continue to get the best servicing experience from Microsoft.  Future updates as of the patch Tuesday in May, including security fixes, will be based on Windows Server 2012 R2 Update as the baseline.

This is an exciting day!

Satya’s post and top-level info:

https://blogs.technet.com/b/microsoft_blog/archive/2014/03/27/a-cloud-for-everyone-on-every-device.aspx

Office for iPad:

https://blogs.office.com/2014/03/27/announcing-the-office-you-love-now-on-the-ipad/

New EMS licensing bundle – Intune, Azure RMS, AAD Premium:

https://blogs.technet.com/b/in_the_cloud/archive/2014/03/27/enterprise-mobility-for-every-business-and-every-device.aspx

AAD Premium:

https://blogs.technet.com/b/ad/archive/2014/03/25/identity-and-access-management-for-every-user-in-every-organization-using-any-service-on-any-device.aspx

We’ll have a lot more info on EMS and the Hybrid Identity stories very soon!

A.