Home is where I lay my head https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/feed.xml Windows 10 and EMS related stuff worth sharing - Pieter Wigleven Fri, 18 Aug 2017 04:20:17 GMT en-US hourly 1 Hardware independent automatic Bitlocker encryption using AAD/MDM https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/hardware-independent-automatic-bitlocker-encryption-using-aadmdm Wed, 07 Jun 2017 15:32:54 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/?p=715 GDPR in mind. Most organizations require a form of disk encryption like BitLocker. In one of my previous blog posts you might have read about the requirement for InstantGo capable devices to automate BitLocker configuration on the device and backup the recovery key to the user's Azure AD account. Windows 1703, also known as the Creators Update, offers a wizard where users are prompted to start encryption regardless of the hardware used. This post describes how to fully automate BitLocker encryption without end-users being prompted. Recently I received a few scripts that allow the triggering of a fully automated BitLocker encryption process regardless of hardware capabilities. The solution has been developed by Paul O Connor (DXC) and Adam Lyndersay (DXC) which leverages the previous powershell script work by Jan and Sooraj (DXC). I've added some enhancements, wrapped them into an MSI - ready to be uploaded in Intune and deployed to a group of users. For specific scenarios where end-users are not part of the local admin group an alternative solution is available.

How does this solution work?

The TriggerBitLocker MSI attached to this blog does the following:
  • Deploys three files into C:\Program Files (x86)\BitLockerTrigger\
  • Imports a new scheduled task based on the included Enable_Bitlocker.xml
The scheduled task will run every day at 2PM and will do the following:
  • Run Enable_Bitlocker.vbs which main purpose is to call Enable_BitLocker.ps1 and make sure to run minimized.
  • In its turn, Enable_BitLocker.ps1 will encrypt the local drive and store the recovery key into Azure AD and OneDrive for Business (if configured)
    • The recovery key is only stored when either changed or not present

What if users are not part of the local admin group?

The first user that joins a device to Azure AD is a member of the local admin group by default (unless you are using Windows AutoPilot). If a second user – part of the same AAD tenant – logs on to the device, it will be a standard user. This is typically used in the scenario where a Device Enrollment Manager account takes care of the Azure AD join before handing over the device to the end-user. For this scenario you will find a modified MSI (TriggerBitlockerUser) at the bottom of this blog, some changes are:
  • The BitlockerTrigger scheduled task will run in the System Context and will:
    • Copy the recovery key to the Azure AD account of the user who joined the device to AAD.
    • Copy the recovery key to Systemdrive\temp (typically C:\Temp) temporarily.
  • A new script MoveKeyToOD4B.ps1 is introduced and runs daily via a scheduled task called MoveKeyToOD4B. This scheduled task runs in the users context. The recovery key will be moved from systemdrive\temp to the OneDrive for Business\recovery folder.
If you are going to use this alternative scenario, make sure to download TriggerBitlockerUser at the bottom of this post. Deploy this via Intune to the group of end-users, not the Device Enrollment Manager group/account used to join the device to Azure AD.

How can users get access to their recovery key?

This recovery key is written to two locations, both the Azure AD account and into a recovery folder in the OneDrive for Business (if configured). Users can retrieve the recovery key via http://myapps.microsoft.com and navigating to their profile, or in their OneDrive for Business\recovery folder. Azure AD (make sure you log on with the account used to join the device to AAD): OneDrive for Business:

Important to know:

  • After the script has run (most likely after 2 PM) a reboot will be required before the initial BitLocker encryption starts - users will be prompted. You could force a reboot by changing the scripts. The recovery key will be written to Azure AD and/or OneDrive For Business the next time the scheduled task is run, this could be 2 PM the next day.
  • Upload the MSI to Intune as a "Line-of-business" app. I've successfully tested by deploying towards a User Group as "required" using the new portal at http://portal.azure.com.
  • The script doesn't take any potential 3rd party encryption software into account. Only deploy this MSI to devices where BitLocker will be the only disk encryption solution in place.
  • BitLocker won't start the encryption process if any removable drives are attached/mounted. Automatic removal can also be added to the script (see the comment from Jos Lieben below).
  • Please test this MSI on your own devices and in your own environment before broadly deploying.
  • This solution has only been tested on Windows 10 1703 x64. You can even test on a Virtual Machine, as long as you assign a Virtual TPM.
  • Consider using Microsoft Intune Compliance policies in combination with Conditional Access to make sure only BitLocker encrypted devices can access company resources.
A lot of time and testing has gone into this project, if you find it useful - please consider leaving a reply.

Changelog:

  • June 21 - 2017
    • Uninstall removes the scheduled task(s)
    • If available, uses new PowerShell commandlet to backup key to AAD
    • Use TLS1.2 when connecting to AAD
    • Better error handling and minor reliability fixes in script
  • August 1 - 2017
    • Better error handling in non-admin scenario (TriggerBitlockerUser).
Downloads: ]]> The Ultimate Browser Strategy on Windows 10 https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/the-ultimate-browser-strategy-on-windows-10 Tue, 25 Apr 2017 13:23:03 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/?p=645 no technical compatibility reason why you shouldn't use Edge as the default browser on Windows 10, starting with version 1607 (also known as the Anniversary Update). So, what's the best approach?
Use Edge as the default browser, when users navigate to specific legacy websites automatically fall back to Internet Explorer. When the user navigates to a non-legacy website, automatically close Internet Explorer and navigate to the site using Edge. [video width="1280" height="720" mp4="https://msdnshared.blob.core.windows.net/media/2017/04/The-Ultimate-Browser-Strategy-on-Windows-10.mp4"][/video]
This combines the best of both worlds. Stay secure using a fast browser providing longer battery life and use automated fallback from/to Internet Explorer for application compatibility. Lets look at how you configure this.

Create an Enterprise Mode Site List

  • Create an XML file that lists your legacy websites and their required browser/rendering engine. Your organization might already have such a list after migrating to IE11 on Windows 7.
  • Download the Enterprise Mode Site List Manager, enter a specific website and adjust the Compatibility Mode according to the requirements. Enterprise Mode Site List Manager Tip: Use Upgrade Readiness to gain automated insights on websites visited by users in your organization, including details like Compat Mode and ActiveX plugins used. This also applies when using Windows 7 and 8.1.
  • Save the Enterprise Mode Site List to a shared location like webserver or server UNC share. explorer Note: Webserver is the preferred method to host the Enterprise Mode Site List. Also keep the UNC connection limit on Client Windows versions into consideration when testing.
I recommend specifying a blank homepage & blank new tabs in Internet Explorer. This prevents the default homepage in IE to cause automatized fallback to Edge.  

Define the required policies

A total of three policies are required, two in which we define the same Enterprise Mode Site List in Edge and Internet explorer. The third policy is to make sure Edge is used for all non-legacy websites.
  • Configure the Enterprise Mode Site List for Microsoft Edge. Link for more info & screenshot.
  • Configure the Enterprise Mode Site List for Internet Explorer. Link for more info & screenshot.
  • Send all sites not included in the Enterprise Mode Site List to Microsoft Edge. Link for more info & screenshot.

Expected browsing experience

Open Microsoft Edge and test the following scenario:
  • Browse to a website not on the Enterprise Mode Site List, e.g. microsoft.com
    • The site will open in Edge
  • Browse to a legacy website, specified on the Enterprise Mode Site List
    • Internet Explorer starts and navigates to the legacy site
  • In the same Internet Explorer instance that just opened the legacy website, browse to a website not on the Enterprise Mode Site List, e.g. microsoft.com
    • Internet Explorer closes and Edge will use a new tab to browse to the website.

Troubleshooting

  • Check if the Enterprise Mode Site List is loaded correctly by browsing to "about:compat" in both Edge and Internet Explorer. Deselect the Microsoft Compatibility List to see your custom entries.
  • Are you experiencing erratic fallback behavior? Make sure you specify a blank homepage and blank "new tab" location.
  • Support for fallback to IE was added in Windows 1511 (November Update)
  • Support for fallback from IE to Edge was added in Windows 1607 (Anniversary Update)

Conclusion:

With a few policies, we can leverage the best of both worlds: Edge for faster/safer browsing and Internet Explorer for specific legacy websites. Hopefully this allows you to use Edge as the default browser. Please consider leaving a reply if this blog helped you.  ]]> Deploy AppLocker Policies to only allow Microsoft/Citrix signed code and Store apps https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/deploy-applocker-policies-to-only-allow-microsoftcitrix-signed-code-and-store-apps Wed, 08 Feb 2017 17:48:54 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/?p=575 Configure Microsoft Intune policies
Open the Microsoft Intune management console, navigate to Policy > Configuration Policies > Add > Windows > Custom Configuration (Windows 10 Desktop and Mobile and later) Give the Policy a descriptive name (e.g. AppLocker) and select Add. We will define three AppLocker Policies, one for Executables, MSI and AppX. Please pay special attention, most values are case sensitive.


mdmapp


-------------------------------------------------------------------------------------------------------------------------------------------------
Setting Name: Executable AppLocker Policy
Data Type: String OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/000000001/EXE/Policy Value:
  <RuleCollection Type="Exe" EnforcementMode="Enabled">
 <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePathCondition Path="%PROGRAMFILES%\*" />
 </Conditions>
 </FilePathRule>
 <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePathCondition Path="%WINDIR%\*" />
 </Conditions>
 </FilePathRule>
 <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow">
 <Conditions>
 <FilePathCondition Path="*" />
 </Conditions>
 </FilePathRule>
 <FilePublisherRule Id="274fd9f6-d906-43ad-ad2f-e0152a209add" Name="Program Files (x86): MICROSOFT® WINDOWS® OPERATING SYSTEM signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="*">
 <BinaryVersionRange LowSection="10.0.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePublisherRule Id="56735fab-e02e-4e2e-af47-c2d02ec61ebc" Name="Program Files (x86): INTERNET EXPLORER signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="*">
 <BinaryVersionRange LowSection="11.0.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePathRule Id="f747fe36-a2be-4236-9be1-3c1a556ca121" Name="Program Files (x86): %PROGRAMFILES%\COMMON FILES\MICROSOFT SHARED\MSINFO\*" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePathCondition Path="%PROGRAMFILES%\COMMON FILES\MICROSOFT SHARED\MSINFO\*" />
 </Conditions>
 </FilePathRule>
 <FilePublisherRule Id="a7f07120-c355-4d80-a537-1be387f85d87" Name="Program Files (x86): CITRIX ICA CLIENT signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="CITRIX ICA CLIENT" BinaryName="*">
 <BinaryVersionRange LowSection="14.5.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePublisherRule Id="d5b5f9bb-7d06-4df0-82f8-7596bce8a664" Name="Program Files (x86): CITRIX RECEIVER signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="CITRIX RECEIVER" BinaryName="*">
 <BinaryVersionRange LowSection="4.5.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePublisherRule Id="07afdd14-6bea-4166-befb-9cb0c2c9280d" Name="Program Files (x86): CITRIX WEB HELPER signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="CITRIX WEB HELPER" BinaryName="*">
 <BinaryVersionRange LowSection="4.5.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePublisherRule Id="ae34303b-e724-4883-ae4e-bdbabae4fb15" Name="Program Files (x86): CITRIX XENAPP signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="CITRIX XENAPP" BinaryName="*">
 <BinaryVersionRange LowSection="14.5.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePublisherRule Id="10a713e2-8f45-46d1-a9f7-dbbbcef14949" Name="Program Files (x86): RECEIVER signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="RECEIVER" BinaryName="*">
 <BinaryVersionRange LowSection="4.5.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 <FilePublisherRule Id="979ca13f-cebb-4d20-9b07-1342e8c4aa86" Name="Program Files (x86): CEIP signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="CEIP" BinaryName="*">
 <BinaryVersionRange LowSection="4.5.0.0" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 </RuleCollection>
Setting Name: MSI Applocker Policy Data Type: String OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/000000002/MSI/Policy Value: 
<RuleCollection Type="Msi" EnforcementMode="Enabled">
 <FilePublisherRule Id="31a7ad3a-d7b3-4e3e-9df0-fe7972f77437" Name="Signed by O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="O=CITRIX SYSTEMS, INC., L=SANTA CLARA, S=CALIFORNIA, C=US" ProductName="*" BinaryName="*">
 <BinaryVersionRange LowSection="*" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 </RuleCollection>
Setting Name: StoreApps Applocker Policy Data Type: String OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/000000003/StoreApps/Policy Value:
<RuleCollection Type="Appx" EnforcementMode="Enabled">
 <FilePublisherRule Id="bae41f27-df1e-4bfd-8f1c-80034807bc74" Name="Signed by *" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
 <Conditions>
 <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
 <BinaryVersionRange LowSection="*" HighSection="*" />
 </FilePublisherCondition>
 </Conditions>
 </FilePublisherRule>
 </RuleCollection>
Deploy the policies to a specific user and you will receive the policies shortly after. The user will be unable to launch anything other than signed Microsoft/Citrix code and Store Applications.
Thanks Erik Radix for working on this together.
Please consider leaving a reply in case this post helped.]]> Windows 10 Upgrade reboot loop or error 0xC1900101- 0x20017 https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/windows-10-upgrade-reboot-loop-or-error-0xc1900101-0x20017 Thu, 10 Nov 2016 14:51:17 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/?p=535
  • Boot from alternate media, I used an USB stick with Windows 10 Anniversary Update media on it
  • Hit "Install Now" and then choose "Repair your computer" on the bottom left corner
  • Choose "Troubleshoot" and "Go build to the previous build"
    • Windows will roll-back and within minutes you should be able to logon the older operating system. Next grab the setupact.log and setuperr.log located underneath the C:\Windows\Panther directory. The thing that moved us into the right direction were the following log entries:
    2016-10-24 11:08:47, Info                  [msoobe.exe] Added IOOBEGlobalSettingsCacheListener RecommendedSettings Plugin 2016-10-24 11:08:47, Info                  [msoobe.exe] Loading OOBE plugin Region Plugin 2016-10-24 11:08:47, Error                [msoobe.exe] Failed to Initialize plugin [Region Plugin] [hr=0x80070057] 2016-10-24 11:08:47, Error                [msoobe.exe] Failed create OOBE plugin from key Region Plugin [hr=0x80070057] 2016-10-24 11:08:47, Error                [msoobe.exe] Failed to load OOBE plugins with hr=0x80070057 2016-10-24 11:08:47, Info                  [msoobe.exe] Wrote End-of-OOBE Timestamp to Registry 2016-10-24 11:08:47, Info                  [msoobe.exe] License for msoobe-FirstLogonAnim-MayBeDisabled is false 2016-10-24 11:08:47, Error                [msoobe.exe] Failed to run OOBE Host with hr=0x800700572016-10-24 11:08:47,
    The device would go through all upgrade phases and fail during the Microsoft Out Of Box Experience (msoobe) after loading the Region Plugin. Further troubleshooting can be difficult. We ended up connecting the device to a network and use a remote Windows Debugger to step through msoobe initializing. This is where we realized that a local of "en-150" was used where we typically see "en-US" or different locale. "en-150" relates to a locale "English (Europe)", a new option introduced in the first release of Windows 10 (1507). Further debugging revealed that the Out Of Box Experience would crash due to a missing value with E_INVALIDARG [0x80070057].

    Workaround

    The workaround is to not use the "English (Europe)" locale, technically it could also be a different locale. In our case the "English (Europe) was used. Use the following steps to change this for all accounts:
    • Go to Regional Settings
    • Change the Format to English (United States) - or anything other than “English (Europe)” or the one you are currently using.
      • You can also select a different language or change any of the date/time formats per your needs
    • Select the Administrative tab and hit Copy Settings
    • Select the bottom two checkboxes and hit OK.
    • Reboot the PC and start the Windows Anniversary Update. Windows should upgrade.
    We need to get this fixed, in the meantime the workaround hopefully helps you upgrade. In case this post helped you - consider leaving a reply.  ]]>         Distribute Office Click-To-Run via Microsoft Intune (MDM) - Part 2 https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/distribute-office-click-to-run-via-microsoft-intune-mdm-part-2 Wed, 17 Aug 2016 10:54:12 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/?p=475 guide in order to deploy Office Pro Plus (Click-to-Run) via Intune, resulting in the MSI being deployed but the Office bits not being streamed. I've found many people in my inbox struggling and eager to find a solution. I'm glad that Pouyan Khabazi and Paul Huijbregts (both from Wortell) have spent time investigating and came with a workaround/fix. This guide is 100% their work and all credits go out to them:

    Leveraging the Office Pro Plus Install Toolkit we generated an .MSI installation file for use with Intune and Configuration Manager in a Hybrid setup. When testing deployment we noticed the installation would not continue – the installer would run but no Office installation followed. We then added our problem description to an existing Github issue after which an engineer made some modifications to the Toolkit.

    After receiving confirmation from the engineer we continued to test and found that the installation would complete successfully using Configuration Manager in tandem with Intune. Oddly, the same installation package would not execute using an Intune-only MSI through MDM deployment targeted to Users (status code 60 ENFORCEMENTFAILED in the registry, no further errors in the Intune console).

    We started troubleshooting, focusing on potential differences between a deployment through Configuration Manager + Intune and through Intune-only (even though there shouldn’t be any). We noticed that upon adding the installer to Configuration Manager the installation behavior "Install for user" would be automatically set:

    1

    We then noticed that the failed installation through Intune would leave behind a registry key that indicated the installation attempt was performed using a Device targeted MSI deployment:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseDesktopAppManagement\S-0-0-00-0000000000-0000000000-000000000-000\MSI\{B2358358-0BB5-427D-9960-88108C9F0780}]

    (Our deployment was set to All Users – Required Install. Other deployments from Intune that are similarly targeted have the User’s SID in the resulting registry key as expected)

    This led us to believe the installation was executing in the machine context when deploying through Intune MDM where we expected the installation to run in the user context instead. So we took a look at the .MSI file using an MSI editor (Orca):

    2

     

    The Property "ALLUSERS 1" show the package installation type is indeed set to a per-machine installation context. We then compared an older .MSI package (as generated by Pieter Wigleven) and found the "ALLUSERS" property was not present:

    3

     

    We used the MSI editor to remove the "ALLUSERS 1" entry and saved the package. The resulting package then installed without any problems to an Intune MDM-managed Windows 10 machine. Note: using "Save as" in Orca resulted in a much smaller package that didn't work. Just hitting save did the trick.

    Thanks Pouyan Khabazi and Paul Huijbregts. Please leave some comments if their work has helped you.

    ]]>         Distribute Office Click-To-Run via Microsoft Intune (MDM) https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/distribute-office-click-to-run-via-microsoft-intune-mdm Tue, 12 Apr 2016 10:21:14 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2016/04/12/distribute-office-click-to-run-via-microsoft-intune-mdm/ Update August 17 2016, please consult this new post for a potential solution. Update July 26th 2016, the Office ProPlus generator has been changed and no longer works with Intune distribution. The MSI will get installed but Office ProPlus won't be streamed. We are working with Valorem Consulting to have this fixed. You can use the working example MSI in this blog for testing purposes. --- Using Azure and Microsoft Intune we can support people to be productive while being mobile - better than ever. In previous articles and video’s you’ve had the possibility to learn about the advantages of using a cloud managed Windows 10 device. There are multiple guides available on the internet that explain how to deploy Office C2R via Intune using the PC agent. In this article you can read on how to deploy Office 2016 Click-To-Run using Intune on Windows 10 devices managed as a mobile device, an important step to achieve higher productivity for end-users.

    Generate an OfficeProPlus installer

    First step is to create a Click-To-Run MSI Installer, the easiest way is to use this link. This page provides a graphical method to generate and edit the Office Click-to-Run configuration.xml file. The configuration.xml file is used to specify Click-to-Run installation and updates options. Generate the installation using the “Launch installation” under the “Install Toolkit” section on the left. image Follow the wizard and select the appropriate options, make sure all “unattended” options are enabled. Consider the following options:
    • Exclude products you do not want to be installed (e.g. Access)
    • Enable “Enable Updates”
    • Leave “Display Level” set to the default “None”
    • Enable “Accept UELA”
    Next hit “Generate” to specify some additional configuration options and generate the installation MSI. image Make sure:
    • You select “MSI” as Install Type.
    • Enable “Silent Install”
    • Specify a local path and hit “Generate”
    The result will be a file e.g. Office365ProPlus.msi which is slightly over 2mb in size.

    Upload and deploy the OfficeProPlus MSI

    Open your Intune Management portal, navigate to Apps and choose Add App. 1 Make sure you:
    • Select “Windows Installer through MDM (*.msi)”
    • Do not specify any command line parameters
    After uploading the App, deploy this to an User collection.

    End-result

    After enrolling a Windows 10 device into Intune (potentially via an Azure AD Join) the Office Click-To-Run application will download the Office 2016 applications, this will take several minutes: 2

    Example XML/MSI

    An example of working XML is as follows:
    <?xml version="1.0"?> -<Configuration> -<Add Branch="Current" OfficeClientEdition="32"> -<Product ID="O365ProPlusRetail"> <Language ID="en-us"/> <ExcludeApp ID="Access"/> <ExcludeApp ID="Groove"/> <ExcludeApp ID="Lync"/> <ExcludeApp ID="Project"/> <ExcludeApp ID="Publisher"/> <ExcludeApp ID="Visio"/> </Product> </Add> <Display AcceptEULA="True" Level="None"/> <Updates Branch="Current" Enabled="TRUE"/> <Logging Level="Standard" Path="%temp%"/> <Property Value="0" Name="AUTOACTIVATE"/> <Property Value="TRUE" Name="FORCEAPPSHUTDOWN"/> <Property Value="0" Name="SharedComputerLicensing"/> </Configuration>
    An example of working MSI, with the above XML can be downloaded from this location. Download the zipfile, extract, upload to Intune and deploy to a user collection.

    How to troubleshoot

    You can validate the installation of the OfficeProPlus.msi if the following path is created:
    “C:\Program Files (x86)\Microsoft Office 365 ProPlus Installer”
    Next check if the Click-To-Run installation is actually streaming bits by looking at this location:
    “C:\Program Files\Microsoft Office\root”
    You can also start “resmon”, go to the network tab and sort by “received bytes” to see if the Office Click-To-Run downloader is streaming data. Credits go out to Håvard Pettersen, Bjorn Axell and the people from Valorem Consulting for sharing information and testing. Please let us know in the comments whether this solution is working for you.]]>         Silently push the Microsoft Intune Company Portal to Azure AD Joined Windows 10 devices https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/silently-push-the-microsoft-intune-company-portal-to-azure-ad-joined-windows-10-devices Fri, 25 Mar 2016 06:31:00 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2016/03/25/silently-push-the-microsoft-intune-company-portal-to-azure-ad-joined-windows-10-devices/ Starting today Microsoft Intune has been integrated with the Business Store. This means that you can use Microsoft Intune to manage public store applications and silently deploy them to users. End-user won’t have to go to the public store and therefore won’t need a Microsoft Account.  

    When it comes to Microsoft’s Enterprise Mobility Suite it’s possible to use the Company Portal for a uniform cross-platform experience.

    On Windows, installation of the Company Portal can be automated using the Business Store which is capable of pushing applications from the Public Store. We can use this to silently push any modern app from the public store, including the Company Portal, to the end-user’s Windows AAD joined (or Domain Join + AAD registration) 10 device. End-users won’t need an Microsoft Account (MSA) to obtain the application.

    You configure this as follows:

    1) Browse to http://microsoft.com/business-store and logon with an administrative user in your tenant.

    2) Select settings and navigate to Management Tools

    clip_image002

    3) Select Add a management toolclip_image004

    4) Search for Microsoft Intune

    clip_image006

    5) Press Ok followed by Activate in the bottom right corner

    clip_image008

    6) In the upper right Search Store textbox search for Company Portal, next select Get the app and afterwards select distribute later.

    clip_image010

    7) Open a new tab and navigate to Microsoft Intune via http://manage.microsoft.com

    8) Navigate to Admin/Mobile Device Management/Windows/Store for Business and select Configure Sync

    clip_image012

    clip_image014

    9) When for the initial sync to finish and navigate to Apps/Apps/Volume Purchased Apps

    clip_image016

    10) Now you can deploy the Company Portal as a required application to your user collection.

    End result:image

    Users on Windows devices that sign in with their Azure AD account (or PIN/Passport) or domain account that has been registered in AAD will get the Company Portal added in their Start Menu without having to do anything. And the best of all: without the need for a Microsoft Account to access the public store.

    For more information:

    • IT Professional resources: https://aka.ms/business-store/it
    • Developer resources: https://aka.ms/business-store/dev

    ]]>         Automatic Bitlocker on Windows 10 during Azure AD Join https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/automatic-bitlocker-on-windows-10-during-azure-ad-join Mon, 14 Mar 2016 14:08:00 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2016/03/14/automatic-bitlocker-on-windows-10-during-azure-ad-join/ Update June 2017 - please read my post here for a workaround on all devices.

    There are a lot of myths on how to automatically trigger Bitlocker on an Azure AD Joined Windows 10 device, let’s hope this post will get you some answers.

    Windows 10 will automatically encrypt the local drive when joining an InstantGo capable device to Azure Active Directory (AAD). An AAD Join can either done during the “Out Of Box Experience” (OOBE) or when Window is installed by going to the “About” screen, here you have the option to Azure AD Join the device. As an admin you can configure Azure AD in such a way that the device is automatically registered in your Mobile Device Management solution. Important note: You cannot use Microsoft Intune (or any other MDM) to specify a policy and force Bitlocker on a Windows 10 PC. This is done automatically during an Azure AD Join.

    What does “InstantGo capable device” mean?

    InstantGo (formerly known as Connected Standby) is a very low power state that some devices support. It’s very like your mobile phone, it’s almost switched off but still can receive text messages, e-mails and switch to a different power state when receiving phone calls. A growing list of devices support InstantGo, you can manually check if your device supports this powerstate as follows:
    • Open a command prompt
    • Type “powercfg /a”
    Devices that have InstantGo support will return “Network Connected”:

    clip_image002

    If your device does not support InstantGo (and therefore: no automatic Bitlocker during Azure AD Join) you will get something similar to this: clip_image004 Keep in mind that this also applies to Virtual Machines. Automatic Bitlocker during Azure AD Join requires physical InstantGo Capable devices.

    Where do I find the recovery key?

    Users can retrieve their recovery key by going to http://myapps.microsoft.com, select Devices and select the device for which they would like to get the recovery key:

    clip_image006 As an Azure tenant admin you can find the recovery keys for your users by going to https://manage.windowsazure.com, browse to your Active Directory, go to the Users tab and select the user who enrolled a specific device. Browse to Devices and change the dropdown list to view Devices. clip_image008 Find the device for which you would like to have the recovery key and hit Details. clip_image010

    “I have InstantGo capable devices but Bitlocker is not enabled automatically during an Azure AD Join”

    If you are sure your device is InstantGo capable (e.g. Surface Pro 3 or Surface Pro 4) it could be that the image you are using has Automatic Bitlocker during AAD Join disabled – this is controlled by a registry key. Update October 2016: The surface recovery image has been updated to fix this issue. Recently we have seen this issue with the Surface Pro 4 Recovery Images. Until the Recovery images are updated you can work around this by either:
    • Use a vanilla Windows 10 (1511) ISO or media, install Windows 10, perform the AAD Join. Either inject the Surface Pro drivers into the image in advance or install the drivers manually afterwards.

    OR

    • During the Out Of Box Experience (OOBE) hit SHIFT-F10 on your keyboard, this will bring up a command prompt. Fire up REGEDIT and browse to
    HKLM\System\CurrentControlSet\Control\Bitlocker\ Make sure that “PreventDeviceEncryption” is set to “0” clip_image012 If you liked this post - please consider leaving a reply. ]]>         Get mobile users going fast using Windows 10 and EMS! https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/get-mobile-users-going-fast-using-windows-10-and-ems Wed, 28 Oct 2015 05:37:00 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2015/10/28/get-mobile-users-going-fast-using-windows-10-and-ems/ Get mobile users going fast!
    Use Windows 10 and Enterprise Mobility Suite (EMS) to have end-user self-provision their work device. Using the power of Azure this will give you the ultimate cloud managed workstation, ready for the future!

    This video shows you how the end-user experience is when Windows 10 is combined with EMS, it illustrates the following technologies:

    • Self Service Password Reset
    • Azure AD Join devices
    • MDM (Intune) auto enrollment
    • Azure AD User Authentication
    • SSO Access to SaaS Apps
    • Applications (MSI’s) installed via Intune
    • Business Store for available apps

    [View:https://www.youtube.com/watch?v=BJW-1FH1ECs:0:0]

    Feedback is greatly appreciated!

    ]]>         Windows 10 Setup Command Line Switches https://docs.microsoft.com/archive/blogs/home_is_where_i_lay_my_head/windows-10-setup-command-line-switches Mon, 14 Sep 2015 02:01:19 GMT https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2015/09/14/windows-10-setup-command-line-switches/ Command Line Switches
    Switch Parameters Action
    /auto <migration choice> Upgrade; DataOnly; Clean Automate install with migration choice for the installation. The media setup UI and progress screens are shown by default, but are automated. This switch also assumes the following default configurations: EULA acceptance, Dynamic Update is enabled, telemetry collection and upload opt-in, OOBE will be skipped, PBR will be updated or created. Example: setup.exe /auto upgrade
    /quiet N/A The quiet flag will suppress any setup UX, including rollback UX Example: setup.exe /auto upgrade /quiet
    /pkey <product key> 5x5 product key Supplies setup with the specified product key. This parameter is not necessary when upgrading with volume licensed media or media that contains a pid.txt in the sources folder. Example: setup.exe /auto upgrade /pkey ABC12-DEF34-GHI56-JKL78-MNP90
    /showoobe <parameter> Full; None When /showoobe is set to Full, the end user must interactively complete OOBE. Alternatively, when /showoobe is set to None, OOBE is skipped and components are set to their default settings. Example: setup.exe /auto upgrade /showoobe full
    /noreboot N/A Setup will not automatically reboot the PC when it completes down-level OS tasks. The next time the PC is rebooted, setup will continue. Example: setup.exe /auto upgrade /noreboot
    /DynamicUpdate <parameter> Enable; Disable Specifies whether setup will perform Dynamic Update operations (search, download, and install updates). Example: setup.exe /auto upgrade DynamicUpdate disable
    /Postoobe <location>\setupcomplete.cmd Local file path or UNC network path to a file named setupcomplete.cmd Injects setupcomplete.cmd file from the specified location. Setupcomplete.cmd is a customized script to perform tasks after the installation completes but before first user login. It is run with System privileges. Example: setup.exe /auto upgrade /postoobe c:\script\setupcomplete.cmd
    /Postrollback <location> Local file path or UNC network path to a file named setuprollback.cmd Injects setuprollback.cmd file from the specified location. Setuprolback.cmd is a customized script to perform tasks after the installation fails and the PC has rolled back to its previous OS. It is run via RunOnce key on login and runs with same permissions as the “user” that is logging in. Example: setup.exe /auto upgrade /postrollback \\MyShare\script\setuprollback.cmd
    /installfrom <location> Local file path or network path to a specific .wim Specifies location for installation source media/files Example: setup.exe /auto clean /installfrom d:\myWim\customwim.wim
    /PBRUpdate <parameter> Enable; Disable When /PBRUpdate is set to Enable, setup will update or create the PBR partition. Conversely, when /PBRUpdate is set to Disable, setup will not update or create the PBR partition Example: setup.exe /auto upgrade /PBRupdate disable
    /migratealldrivers <paramenter> All; None When /migratealldrivers is set to All, setup will attempt to migrate all drivers as part of the installation. In contrast, when /migratealldrivers is set to None, setup will not migrate any drivers as part of the installation. NOTE: this switch should only be used in testing and test envoriments. It should not be used in production. Example: setup.exe /auto upgrade /migratealldrivers none
    /installdrivers <location> Local file path or UNC network path to a folder that contains .inf files Setup will inject all driver .infs found in the specified location during the installation process. Setup will recursively search through all the subfolders of the specified location. Example: setup.exe /auto upgrade /installdrivers c:\myUpgrade\drivers
    /Telemetry <parameter> Enable; Disable When /Telemetry is set to Enable, setup will collect and upload telemetry generated by the installation. However, when /Telemetry is set to Disable, setup will not collect and upload installation-related telemetry. Example: setup.exe /auto upgrade /Telemetry enable
    /copylogs <location> Local file paths and UNC network paths Upon failure, setup will copy or upload compressed logs to the specified location. Please note that the PC and/or user must have permission and network access to the specified file path. This command runs in the system context so may not have permissions to copy to locations that require user permissions Example: setup.exe /auto upgrade /copylogs \\MyShare\UpgradeLogs

    Scenario-Based Usage

    An admin wants to upgrade the departments PCs from Windows 7 Enterprise overnight. He does not want the setup user interface to appear, but she does want the end users to manually go through the Out of box experience (known as OOBE) experience. The following command line can be used to orchestrate the full upgrade to Windows vNext, requiring user input only once the machine reaches OOBE: Setup.exe /auto upgrade /quiet /showoobe full Alternatively, a deployment engineer may want to collect logs and other diagnostic information from test PCs in the event of a failure. The following command line instructs setup invoke the setuprollback.cmd script after an installation failure: Setup.exe /auto upgrade /installdrivers c:\myUpgrade\drivers /postrollback c:\setuprollback.cmd ]]>