Alright, it’s been a while since i posted anything here and have been thinking about my comeback post. Today, i had to reproduce an issue on an older version of Android OS but couldn’t find a physical device so decided to try Android emulator instead. The process is much simpler than i thought. If you ever find yourselves in a similar situation, feel free to to use the instructions below.

1. Start by ensuring Hyper-V -> Hyper-V Platform -> Hyper-V Hypervisor is NOT installed. Your CPU should still support VT-x feature for HAXM to work

2. Install the latest Java Platform JDK.  If you don’t have it, install the Java SE from https://www.oracle.com/technetwork/java/javase/downloads/index.html

a. Download and install Windows x64 version

3. Download and install Android Studio for Windows x64 - https://developer.android.com/studio/index.html

a. Make sure to check them all:

Note: It could take up to 30 minutes or more to finish the installation

b. Start Android Studio

4. On Welcome screen, click Next

a. Select Custom

b. Select All options

Note: If you decide to change the installation path, make sure there are no empty spaces in it

c. Click on Next

d. Wait for installation to finish

e. Note down the name of Android virtual device and click on Finish

5. Click on Configure - SDK Manager

a. Select Android SDK - SDK Tools. Make sure Intel x86 Emulator Accelerator (HAXM installer) is installed

6. Open CMD as Administrator. Run following command to start the emulator using the name you copied in step 4.e

emulator.exe -avd Nexus_5X_API_26_x86

You should now see the emulator running

a. To see the list of installed virtual devices, type Emulator.exe -list-avds. Alternatively, you can also use Android Virtual Device Manager to manage and launch virtual devices.

Note: I had to disable both Hyper-V and Credential Guard from inside the OS for HAXM to work. You can disable Credential Guard by running following command

Error: This computer does not support Intel Virtualization Technology

DG_Readiness_Tool_v3.2.ps1 –Disable

You will now be prompted to reboot the PC. Press F3 or Windows key at both screens during the reboot.

Download link: https://www.microsoft.com/en-us/download/details.aspx?id=53337

7. Download and install Company Portal from here - https://www.microsoft.com/en-us/download/details.aspx?id=49140

I get this a lot from customers who would like to push certificates to mobile devices to work with Resource Access Profiles, S/MIME etc. but can’t have an on-premises Internet facing server that runs Network Device Enrolment Service. If you are facing the same challenge, Intune has a less known feature called PKCS #12 (PFX) based certificate deployment that can be used in this scenario. In the previous    releases, it needed an Administrator to supply a .PFX file which would then be deployed to device but this has now changed in standalone Intune. You no longer need to supply a .PFX file. Intune with the help of Intune Certificate Connector will get a certificate issued from Certificate Authority for User which will then be pushed to device. There is no need to setup NDES.

Administrator creates and deploys a PKCS #12 (.PFX) certificate profile to user.

Step 1: Intune service connects to on-premise Intune Certificate Connector

Step 2: On-premise Intune Certificate Connector connects to on-premise CA to get a certificate issued

Step 3: After certificate is issued, it is uploaded to Intune service via connector

Step 4: Certificate is pushed to device

Configure your infrastructure

Before you can configure certificate profiles you must complete the following tasks. In the example discussed below, we will deploy PFX profile to a Windows Phone 10 device.

Task 1 - Configure certificate templates on the certification authority
Task 2 - Enable, install, and configure the Intune Certificate Connector
Task 3 – Create and deploy a Trusted Root CA certificate Profile and a PKCS #12 (.PFX) profile

Task 1 - Configure certificate templates on the certification authority

1. On the issuing CA, use the Certificate Templates snap-in to create a new custom template or copy an existing template and then edit an existing template (like the User template), for use with PFX deployment.

The template must have the following configurations:

a. Specify a friendly Template display name for the template.

b. On the Subject Name tab, select Supply in the request.

c. On the Extensions tab, ensure the Description of Application Policies includes Client Authentication or any other usage you require.

Note:  Allow private key to be exported needs to be ticked under Request Handling for PFX deployment to work.

2. Review the Validity period on the General tab of the template. By default, Intune uses the value configured in the template. However, you have the option to configure the CA to allow the requester to specify a different value, which you can then set from within the Intune Administrator console. If you want to always use the value in the template, skip the remainder of this step.

To configure the CA to allow the requester to specify the validity period, on the CA run the following commands:

a. certutil -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE

b. net stop certsvc

c. net start certsvc

3. On the issuing CA, use the Certification Authority snap-in to publish the certificate template.

a. Select the Certificate Templates node, click Action-> New > Certificate Template to Issue, and then select the template you created in step 1.

b. Validate that the template published by viewing it under the Certificate Templates folder.

4. On the CA computer ensure that the computer that hosts the Intune Certificate Connector has enroll permission, so that it can access the template used in creating the .PFX profile. Set that permission on the Security tab of the CA computer properties.

Note: To revoke certificates the Service Account needs Issue and Manage Certificates rights for each certificate template used by a certificate profile.

Task 2 - Enable, install, and configure the Intune Certificate Connector

5. Enable support for the Certificate Connector:

a. Open the Intune administration console, click Admin > Certificate Connector.

b. Click Configure On-Premises Certificate Connector.

c. Select Enable Certificate Connector, and then click OK.

6. Download, install and configure the Certificate Connector.

a. Open the Intune administration console, and then click Admin > Mobile Device Management > Certificate Connector > Download Certificate Connector.

b. After the download completes, run the downloaded installer (ndesconnectorssetup.exe). For .PFX certificates, run the installer on the computer that is able to connect with the Certification Authority. Choose the .PFX Distribution option then click Install and configure rest of settings in wizard.

7. Open a command prompt and type services.msc, and then press Enter, right-click the Intune Connector Service, and then click Restart.

Task 3 – Create and deploy a Trusted Root CA certificate Profile and a PKCS #12 (.PFX) profile

8. Export the Trusted Root CA certificate as a .cer file from the issuing CA, or any device that trusts your issuing CA. You do not export the private key. You will import this certificate when you configure a Trusted CA certificate profile.

Please note this step is optional for PFX itself but needed for e2e scenario to work if you need the cert to be trusted on your client

9. Create a trusted certificate profile:

a. Open the Intune administration console, and click Policy > Configuration Policies > Add.

b. Configure following policy type:

Windows > Trusted Certificate Profile (Windows Phone 8.1 and later)

10. Provide the requested information to configure the trusted certificate profile. In the Certificate file setting, import the Trusted Root CA certificate (.cer) that you exported from your issuing CA in Step 8.

11. When you are finished, click Save Policy and Deploy.

12. Create a .PFX certificate profile:

a. Open the Intune administration console, click Policy > Configuration Policies > Add.

b. Configure following policy type:

Windows > PKCS #12 (.PFX) Certificate Profile (Windows 10 Desktop and Mobile and later)

13. Provide the information requested on the policy form.

Note:

a. Certification authority - Specify internal FQDN of Certificate Authority server. Eg: Server1.domain.local

b. Certification authority name - Specify certificate authority name as displayed in certification authority MMC. Look under Certification Authority(Local)

14. When you are finished, click Save Policy and Deploy.

PKCS #12 (.PFX) Certificate Profiles are currently supported on Windows 10 Desktop and Mobile and Android only. Future service update will add support for iOS.

Note: PKCS #12 (.PFX) Certificate Profiles are now supported on iOS

Date - 29/04/2016

Consider a scenario where a Wi-Fi or VPN profile is pushed either via Configuration Manager or Intune to Windows Phone 10. Profile is configured to use SCEP profile – Certificate for authentication. You can see the profile on device but it fails to connect. Thanks to a colleague in Windows Phone team who suggested this may happen if more than one certificate is present on the device that has at least one same Enhanced Key Usage or an Application Policy as in the certificate pushed via SCEP profile. You can check this by installing Certificates application from Store on device. Look under Personal Store in application.

What’s the solution?

You can add a unique Application Policy to certificate template and configure the profile to use it to fix the problem. See detailed steps below. I’ll use a Wi-Fi profile in Configuration Manager as an example.

1. Edit the certificate template used in SCEP profile.

2. Select Application Policies and click on Edit.

3. Click on Add.

4. Click on New and Type a Name.

Copy and Paste Object Identifier in a txt file. You will need this later. Click on OK and OK again.

5. Select newly added Application Policy and click on OK.

6. You should now see new Application Policy listed along with existing ones. Click on OK.

7. Click on Apply and then OK.

8. Open Configuration Manager console. Refresh Certificate template in SCEP profile linked to Wi-Fi profile. You should now see newly added OID (Step 4) under Enhanced Key usage. Click on Apply and OK.

(To refresh settings – Select some other template, click on Apply and then Select NDES template again.)

9. Edit Wi-Fi profile. Under Security Configuration tab click on Configure.

10. Click on Advanced in Smart card or other Certificate Properties dialog box.

11. Click on Add, Add again, Paste Name and OID of EKU from txt file created in Step 4. Click on OK and OK again.

12. Ensure newly added EKU is listed. Click on OK and wait for ~15 minutes for changes to be uploaded to Intune alternatively you can restart SMS_DMP_Uploader thread from Service Manager.

13. Enrol a WP 10 device and check if it now connects to company Wi-Fi.

Note: Steps would largely be the same for standalone Intune apart from adding an additional EKU in profile. If you use an XML to push Wi-Fi or VPN profile than add new EKU in following section:

<EKUMapping>

<EKUMap>

<EKUName>MobCert</EKUName>

<EKUOID>1.1.1.1.1.1.1.1</EKUOID>

</EKUMap>

</EKUMapping>

~ Karan Rustagi

With the release of iOS 7, Apple introduced the Per-App VPN feature which caters to both IT Professional and end user experiences. With this feature, IT Professionals can specify which managed apps can use VPN on an Intune managed iOS device. It also makes the connection experience seamless for the user by abstracting the steps taken to connect to a VPN server when accessing corporate documents.

The blog post here teaches you how to set up Per-App VPN for your enterprise using Microsoft Intune (cloud only) but if you want to do this using Configuration Manager please continue reading.

Step 1

a. Create a VPN profile and select ‘Per App VPN (iOS 7 and later)’.

Step 2

a. Under Software library – Applications create an iOS application.

b. Select VPN profile created in Step 1.a under App-Per VPN.

On the iOS Device

• Make sure you’re running iOS 7 or later

• Must have the appropriate 3^rd party app installed:

  • Juniper

  • Checkpoint

  • F5

  • SonicWall

• Make sure you have a zero-touch experience:

  • User taps on the 3^rd party VPN app

  • Taps on Connect

  • VPN successfully connects without any extra prompts.

    • User must not be asked to trust the VPN server (i.e., User must not see the Dynamic Trust dialog box)

    • User must not enter any credentials

    • User must be connected to VPN upon tapping the connect button