So here it goes. A couple weeks after the amazing conversations at Ignite, here goes my first in a series of posts addressing some of the comments and feedback I heard.

Feel free to drop me a comment here or on Twitter (@jananivasudevan) if you have a specific topic you'd like to hear more about.

So what exactly is the Windows MDM client and how is it related or not related to Microsoft Intune?

The Wikipedia link for Mobile Device Management defines it as this - "Typically solutions include a server component, which sends out the management commands to the mobile devices, and a client component, which runs on the device and receives and implements the management commands. In some cases, a single vendor may provide both the client and the server, in others client and server will come from different sources".

The Mobile Device Management client for Windows (we'll refer to this as "MDM client for Windows" in this post for the future), is this client component that runs on all Windows devices. It receives commands from any MDM server (be it Microsoft Intune, Airwatch, MobileIron etc.) and implements these commands. The advantage is that each of the MDM servers don't have to implement their own client component now to manage Windows devices. Instead, they only need to adhere to the syntax that the MDM client for Windows publishes and can start managing Windows devices straight out of the box.

So there you go, the MDM client for Windows is that operating system component that is intended to make Windows easily manageable through any MDM server out there, be it Microsoft Intune or any of the 3^rd party MDM servers.

Every Windows 10 device (and also Windows 8.1 device) has this mobile device management client that ships along with the operating system. And the syntax that MDM servers need to use to manage Windows devices using this agent is what we call the Windows Mobile Device Management protocols. There are two such protocols – one governing how a Windows device registers with the server so it can start managing the device called MS-MDE, and the second called MS-MDM governing how an MDM server can send down commands to manage the different settings (and which settings) on the Windows device.

For those of you familiar with group policy, the Windows MDM client is like the group policy service which receives the different group policy settings and redirects it to the right handler to have the policy applied.

• The group policy client receives GPOs as commands to implement management of devices while the MDM client for Windows receives SyncML messages as commands to implement management.
• The device once domain joined is subject to receive commands through group policy; a device has to "enroll" with the MDM server to receive commands through MDM channel. (This enrollment can either be done by the user separately or as part of Azure AD join in Windows 10)
• When Group Policy is applied to a user or computer, the group policy client side extensions interprets the policy and makes the appropriate changes to the environment. When an MDM server sends down a SyncML message for configuration, the Windows MDM client hands this off to similar extensions/providers on the device called "Configuration service providers" to interpret the SyncML commands and make configuration changes.

There is a "Configuration service provider" (sometimes shorthanded as CSP) for each different component or feature that needs to be configured. There is one for all "policies" and "simple setttings" called the "Policy configuration service provider", there is one to configure VPN profiles and so on.

The list of the different providers (and hence the settings you can manage) for the Windows MDM client are here - https://aka.ms/ayw20h

So now coming back to my session at Ignite (and //Build), when I talked about the enhancements to the MDM client in Windows 10, it was about these different settings and features that can be managed by any MDM server on a Windows 10 device straight out of the box (ie. not requiring a client side agent from the MDM server product).

You may ask "Why is this important to me if I am using group policy today to manage Windows PCs". If you are using group policy today for PCs, you can definitely continue to use it. However, for Windows phones and tablets that employees use nowadays at work which they cannot or do not want to domain join, Mobile device management is becoming popular as the tool to manage these.

Hopefully, this post helped you understand a little more about the Windows MDM client. Please do leave your comments and any unanswered questions that pop to your mind, and I'll answer them here.

 -------- -------- -------- --------

Links to my "Windows 10 MDM client enhancements" sessions at Ignite and //Build:

//Build: https://channel9.msdn.com/Events/Build/2015/3-654

Ignite: https://channel9.msdn.com/events/Ignite/2015/BRK3313

Diagnosing certificate related issues on Windows Phones has been kind of a hassle so far. Even though you can provision certificates to Windows phones through the MDM channel, there was no UX to view the certificates that are installed on the phone.

The "Certificates" app helps you with this and is available NOW on the Windows store. You can view the certificates installed in the "Personal", "Root" and "Intermediate certificate authority" certificate stores on the phone. You can view the certificate details such as the validity period, subject alternative name and if it is installed in the TPM [This is indicated by a "Yes" against "Hardware"].

Download the app from the link here - https://www.windowsphone.com/en-us/store/app/certificates/c356e3f2-451f-4d82-87df-e53b644bec01

Try it out and post your comments on what you think! You can also post your feedback/suggestions on https://windows.uservoice.com

]]> https://docs.microsoft.com/archive/blogs/jananiv/windows-10-enterprise-management-sessions-ignite Sat, 25 Apr 2015 00:04:00 GMT https://blogs.msdn.microsoft.com/jananiv/2015/04/25/windows-10-enterprise-management-sessions-ignite/ The next couple weeks are exciting!! We are going to have a lot of interesting sessions at both the //Build conference in SFO (April 29 – May 1) and the Ignite conference in Chicago (May 4 – May 8). Lots of great keynotes, sessions, speakers and lots of technology in the air!

I have the below session @ Ignite where I'll talk about the new MDM features in Windows 10. I'm super excited to walk you through this and am looking forward to hearing your comments and feedback.

Windows 10 Mobile Device Management (MDM) in Depth

Thursday, May 7, 1:30pm - 2:45pm

https://meme.ms/d5y5q3n

Below are some of the other sessions that you might find interesting.

May 5

17:00 | Chris Green & Dilip Radhakrishnan | Securing Access to Exchange and SPO with Intune [Link]

May 6

13:30 | John Vintzel | Windows 10 Universal App Deployment for Enterprises [Link]

13:30 | Jason Githens | Managing Windows 10 with Microsoft Intune and SCCM [Link]

13:30 | Deepak Manohar | Next Generation Malware detection with Windows Defender [Link]

May 7

9: 00 | Aman Arneja | Secure Enterprise Network Access and VPN platform enhancements [Link]

10:45 | Vladimir Holostov | Provisioning Windows 10 Devices with New Tools [Link]

13:30 | Tejas Patel | Using the Business Store Portal with Windows 10 Devices [Link]

13:30 | Yogesh Mehta | Protecting your data with containers without boxing yourself in [Link]

May 8

10:45 | Nelly Porter | Secure authentication with Windows Hello [Link]

12:30 | Jairo Cadena | Microsoft Azure AD and Windows 10: Better together for work and school [Link]

See you all @ //Build and Ignite!

-Janani

I moved to the Windows Security team in 2010 where I worked for around 4 years on smartcards & biometrics first, then Bitlocker for a while and the last couple years on Platform security focusing on TPM, secure boot and UEFI.

It has been a great experience and I've learnt a lot during this time.

For the last one year, I've been on the Operating system management team working on Mobile Device management client for Windows devices. And I'm looking forward to get back to blogging on this topic and hearing your comments & feedback.

Simple...Microsoft released the XP mode for Windows 7 users who wanted to run their productivity apps that weren't compatible with Windows 7. If your mobile broadband device works on Windows XP but does not work on Windows 7, you now do not have to throw away the device.

Just follow the below steps and you could have internet connection on your Windows 7 machine using the XP compatible device. The commands that you could use are given in blue in braces. The applications and scripts required to run these commands can be found on the Windows 7 machine itself or in the attached ZIP file.

• Download the XP mode Virtual PC from the link above on your Windows 7 machine.
• Download the ZIP file from this post to your Windows 7 machine.
• Install loopback adapter on the Windows 7 (host machine) [devcon.exe install %windir%\inf\netloop.inf *msloop]
• Insert the mobile broadband device now to the host machine (Windows 7 machine) manually.
• Attach the loopback adapter of the host (Windows 7) to a network adapter of the virtual machine and power on the XP virtual PC. [cscript AttachLoopback.vbs "Virtual Windows XP"]
• Attach the mobile broadband USB device to the guest machine (Windows XP). [cscript AttachUSB.vbs]
• Open the 'Virtual Windows XP' VPC from '%USERPROFILE%\Virtual Machines' directory and install the drivers and setup the connection on the XP VPC.
• Once you have the connection setup on the XP VPC, run ShareDevice.vbs inside the XP VPC.
• Renew the IP address on the Windows 7 host machine after this [ipconfig /renew]

You now have internet connectivity on your host Windows 7 machine by means of Internet connection sharing with the guest Windows XP machine.

Signing off,

Janani

ShareDevice.zip

Hope many of your there would have got your hands on the Microsoft Windows 7 beta by now. But as a friend on the internet said "However awesome a computer may be, it is useless without the internet...". I realize that many of you might be having teething issues with using your USB modem or the data card from your ISV on Windows 7, though they worked perfectly in Windows Vista. This can be due to a lot of reasons - a driver compatible with Windows 7 might not be available, the connection manager application might have application compatibility issues etc. However, most of these issues would get solved soon.

However, here are a few troubleshooting steps/work arounds that you could put to use to continue enjoying internet access on Windows 7. If you still have an issue which you couldn't solve using these tips, do post the issue as a comment on the blog - https://blogs.technet.com/teammb, so that it can be made note of.

Symptom:1: There is an application that works fine on XP, but has issues in Vista & Windows 7

Possible workaround:

One of the reasons could be privilege issue. You can modify the compatibility settings for the application to enable it to run in Administrator mode and then run it. Steps to do this are as below:

• Right click on the application in explorer. Click on Properties.
• Navigate to the 'Compatibility' tab. Check the checkbox 'Run this program as an administrator' under ‘Privilege level’.
• Click on OK.

Symptom:2: You have a driver package/connection manager installer package which worked on Vista but isn't working for Windows 7

Possible workaround:

In such a case, you could try running your installer/application in Vista compatibility mode. See below for steps to enable 'Vista compatibility' settings on an application so that when you run it, it is launched in Vista compatibility mode.

• Right click on the application in explorer. Click on Properties.
• Navigate to the 'Compatibility' tab. Check the checkbox 'Run this program in compatibility mode for:’.
• Select 'Windows Vista (Service Pack 1)' or 'Windows Vista (Service Pack 2)'  from the drop down as shown below, depending on which OS it worked well for you. Click on OK.

Symptom:3: The drivers for the device installed successfully, but the ‘Connect’ button is disabled in the connection manager or the connection manager/dialer application reports that the device is not found.

Possible workaround:

You could check if the drivers for your device are successfully installed. Open device manager (Start –> Control Panel –> Device Manager). Check if your device is recognized here ie. there is no yellow bang on the device and device manager reports it to be working properly.

If this is the case, but the connection manager/dialer application reports that the device is not found (or connect button is grayed out), then you can create a dial-up connection manually using the modem and use it for connecting to the internet.

For this we need to first get the phone number, username and password details to use in the connection. Use one of the below methods to get this information: 
1) Get it from the RAS tracing logs collected when dialing using your ISV's application
     (i) netsh ras set tracing * disable
     (ii) del %windir%\tracing\*.*
     (iii) netsh ras set tracing * enable
     (iv) Dial your connection using the connection manager/dialer application
     (v) netsh ras set tracing * disable
     (vI) Open %windir%\tracing\RASMAN.log and search for "UserName:" and "PhoneNum:" (The password is usually the same as the username or empty. the password isn't present in the logs for security reasons)

2) You could get these settings from the Connection Manager Advanced settings/Options too.

3) The device manual might have this information too.

Once you have this information, you need to create a new dialup connection using your modem.

Steps to create a dial- up connection

1)    Start –> Control Panel –> Open ‘Network and Sharing Center’

2) Click on ‘Set up a new connection or network’ -> ‘Set up a dial up connection’ -> Next --> Enter the phone number, username /password details.  
Enter a connection name, say 'ModemDialup'
(If you have more than one modem attached to the device, be sure to select the right one)

3) Click on ‘Connect’

You can access this connection by clicking on the Network icon in the taskbar at the bottom right (highlighted below).

You will find ‘ModemDialup' connection here. You can use this to connect/disconnect your connection.

Symptom:4:  Even after installing drivers from the CD, the device is still not recognized in device manager

Possible workaround:

In spite of installing the drivers from the CD that accompanied the device, lets say the device still shows a yellow bang in device manager.

• In this case, note the folder where the drivers were installed, say it is C:\Program Files\FooDriver.
• Open device manager (Start –> Control Panel –> Device Manager)
• Right click on the device (which is still showing a yellow bang) –> click on ‘Update driver software’
• Select ‘Browse my computer for driver software’ –> In the text box ‘Search for driver software in this location:’ , type the install location on your computer where the drivers were installed from the CD. In our example it would be C:\Program Files\FooDriver. Click on ‘Next’

This might sometimes help in recognizing the device successfully.

Symptom:5:  USB ports on the computer might stop working after installing drivers for certain devices on Windows 7

Possible workaround:

For certain devices after installing the drivers from the accompanying CD, all USB ports on the computer stop working. To get the USB ports working, use the below steps:

• Note the install location on the computer where the drivers were installed from the CD
• del %systemdrive%\windows\syswow64\drivers\swmsflt.sys
• del %systemdrive%\windows\system32\swmsflt.sys
• Search for swmsflt64.sys in the install location (dir /s swmsflt64.sys) and note the location
• Copy swmsflt64.sys from the above location in step (4) to %systemdrive%\windows\system32\drivers\
• Rename swmsflt64.sys to swmsflt.sys in %systemdrive%\windows\system32\drivers\
• Reboot the machine

These are the symptoms and troubleshooting tips that I have for now. If you have figured out a workaround that isn’t here, do leave your comments explaining the workaround. It might help hundreds of people out there!

[This posting is provided "AS IS" with no warranties, and confers no rights.]

A: You can write your own application using the MPRAPIs for this.
1) Call MprAdminConnectionEnum to enumerate all active connections on the
server. This will return the RAS_CONNECTION_2 structures which will have the
username used for the connection. Compare this to the user that you want to
disconnect and get the connection handle for this case alone.
2) Use this connection handle in the next call to MprAdminPortEnum. This
will return the port on which the user has connected as RAS_PORT_0
structure. This will have the member hPort whihc is the handle to the port.
3) Use this handle in the call to MprAdminPortDisconnect to disconnect the
particular port.

This will disconnect the client connection

Thanks,

Janani

1.  Track users who log on through Remote Access Services

2.  Track/monitor the amount of time each user spends logged in

   These can be achieved using the IAS log files that are generated in %windir%\system32\Logfiles. Additionally the tool “IASParse.exe” will be of immense use to help you parse these logs. Information about IASParse.exe is available at https://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/5859c567-8c92-4212-b461-87729bb5daf7.mspx

 The IAS log files will have the information logged in a format which will be difficult to comprehend. (Please see attached file iaslog.txt for sample IAS logs). However, IASParse can be used to decode these IAS log files into readable format . The IAS log files should be in ‘IAS’ format for this (There are two options – IAS format and database compatible format)

 1. Track users who log on through Remote Access Services

A portion of the log file generated by IASParse is as follows:

 …

 …

 NAS-IP-Address      : 65.52.46.226

 User-Name           : FAREAST\jananiv

 Record-Date         : 07/25/2005

 Record-Time         : 10:59:03

 Service-Name        : RAS

 …

 …

 Packet-Type         : Access-Accept

 Reason-Code         : The operation completed successfully.

 An “Access-Accept” is logged when the user is successfully authenticated. So, parsing this file will help in getting information about all users.

2. Track/monitor the amount of time each user spends logged in

 Apart from the authentication requests as above, if we choose to log the ‘Accounting requests’ also - This needs to be selected in the RRAS console à Remote Access Logging à Doubleclick ‘Local file’ à Checking both ‘Authentication requests’ and ‘Accounting requests’ – a accounting request is logged once during the connection establishment and once during connection termination and both have the Record-Date and Record-Time logged. From these values for the both accounting requests, the time for which the user was connected can be calculated.

 User-Name           : FAREAST\jananiv

 Record-Date         : 07/25/2005

 Record-Time         : 10:59:03

  …..

  …..

 Acct-Status-Type    : Start

 Client-IP-Address   : 65.52.46.226

  …..

  …..

 Packet-Type         : Accounting-Request

 Reason-Code         : The operation completed successfully.

User-Name           : FAREAST\jananiv

 Record-Date         : 07/25/2005

 Record-Time         : 10:59:18

  …..

  …..

 Acct-Status-Type    : Stop

 Client-IP-Address   : 65.52.46.226

  …..

  …..

 Packet-Type         : Accounting-Request

 Reason-Code         : The operation completed successfully.

2. Another solution would be to use the RAS Administration DLLs.

 A RAS Administration DLL can be written whose MprAdminAcceptNewConnection2 can be implemented such that the username for the connection is logged (This can be got from the ‘wszUserName’ member of the pRasConnection2 parameter passed to MprAdminAcceptNewConnection2) and also the user connect time is logged.

MprAdminConnectionHangupNotification2 need to be implemented such that the time for which the user has been connected should be calculated. (Additional checking may have to be done here to see which user disconnected and if it is the same connection)

Information about administration DLL functions is available at

https://msdn.microsoft.com/library/default.asp?url=/library/en-us/rras/rras/ras_administration_dll.asp

3. To get the activity on a WAN Miniport (PPTP/L2TP) – which is the case when a VPN client connects to the server – the “Performance Counters” which come with the OS can be used. Performance logs can be generated for each port. However, this will not give the details about the user who connected to that port.

Thanks,

A brief intro about me - I work for the Routing and Remote Access test development team in Microsoft India R&D Pvt. Ltd.

I actually had a difficult time figuring out how to create a blog after creating an account. So am posting it as my first blog :-)

1) Create an account by going to https://blogs.msdn.com

2) Log in using the username and password.

3) When you are logged in goto the link https://blogs.msdn.com/Createblog.aspx

4) The steps after that are intuitive enough to create your blog