Chris Jones' blog

Microsoft Store for Business now available to all Government tenants!

Chris Jones [MSFT] — Tue, 05 Dec 2017 11:25:03 GMT

All government tenants are now able to sign-up into the Worldwide Microsoft Store for Business and are no longer blocked. At signup, you will be required to accept a Terms of Usage [TOU] like all other tenants joining the store before you can proceed. For Government customers: The Store’s Shop setting is turned off by default and the Store Admin can enable this if desired. The Shop setting allows customers to turn shopping off (no shopping allowed). To enable shopping, log into the Store with an Admin account, click Manage > Settings > Shop. From there you can enable shopping for your users. More documentation and communication to follow.

Windows 10 Training Resources

Chris Jones [MSFT] — Tue, 15 Aug 2017 13:33:50 GMT

I'm often asked by customers for training resources on Windows 10. There are a ton of resources out there and it's a bit cumbersome to stay on top of. So, I thought I'd compile and share a list of the items I typically provide to my customers. Happy learning! CORE EXPERIENCE Windows 10 IT Center home (Explore Windows 10) Plan for Windows 10 Deploy Windows 10 Windows AutoPilot Manage Windows 10 Support Windows 10 Windows 10 virtual labs Windows 10 release information Windows 10 End User Readiness Application compatibility SECURITY Security and control Windows 10 Security Baseline [1703] Windows 10 Security Baseline [1607] Windows 10 Security Baseline [1709] Deprecation of Security Compliance Manager [SCM] Security Compliance Toolkit [SCM Successor] Windows 10 security approach AppLocker Windows Defender Application Control [Device Guard] Windows Defender Credential Guard Windows Defender Antivirus Windows Defender Application Guard Windows Defender Exploit Guard Windows Hello Windows Hello for Business Windows Information Protection Windows Defender Advanced Threat Protection Bitlocker DEMOS/VIDEOS How to implement Windows as a Service Modern management for Windows 10 What's new with Windows 10 deployment Windows as a Service [WaaS] Windows Update for Business Windows Analytics Upgrade Readiness Fix web compatibility with Enterprise Mode Microsoft Ignite 2017 [Windows 10 tracks] Windows 10 technical demonstrations Microsoft Windows YouTube Channel Try Windows 10 Videos Microsoft Tips Microsoft Virtual Academy ARTICLES Windows 10 Enterprise system requirements Windows 10 release notes Windows 10 FAQ for IT professionals Try it out: Windows 10 Enterprise Evaluation Create a batch of VMs with PowerShell script The case for continuous application management A Windows 10 security rundown Windows 10 Lifecycle Fact Sheet [Refer to the Updates and Service Packs section] WINDOWS DEPLOYMENT FOR EDUCATION Windows deployment for education home Try it out: Windows 10 in the classroom Try it out: Windows 10 deployment (for educational institutions) VIDEO: Use MDT to deploy Windows 10 in a school VIDEO: Reprovision devices at the end of the school year VIDEO: Automate common Windows 10 deployment and configuration tasks VIDEO: Deploy a custom Windows 10 Start menu VIDEO: Manage Windows 10 updates and upgrades VIDEO: Windows Store for Business RELATED TOPICS Surface IT Center Surface Hub IT Center Microsoft Desktop Optimization Pack IT Center Previous versions of Windows Microsoft Deployment Toolkit Microsoft Edge IT Center WINDOWS 10 ENTERPRISE EVALUATION Download Windows 10 Enterprise Evaluation

Disable Bluetooth in Windows 10 [Updated]

Chris Jones [MSFT] — Tue, 20 Jun 2017 17:20:01 GMT

I'm providing a revision to Jeff Stokes' original post for disabling Bluetooth in Windows 10. I found that the removal portion of the original script no longer works on the Creators Update (1703). The script should work on domain joined, AAD joined, ConfigMgr or Intune managed systems.

# Must be ran as the System account $namespaceName = “root\cimv2\mdm\dmmap” $className = “MDM_Policy_Config01_Connectivity02”

# Turn off the Bluetooth toggle in the settings menu New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID=”./Vendor/MSFT/Policy/Config”;InstanceID=”Connectivity”;AllowBluetooth=0}

Once the script runs, the following are seen in the Settings menu and the Action Center, respectively:

If you want to remove the setting and revert to default, you can run one of the following lines as they both achieve the same result.

# Modifying the script (from 0 to 2 or vice versa)$x = Get-CimInstance -Namespace $namespaceName -Query 'Select * from MDM_Policy_Config01_Connectivity02'Set-CimInstance -InputObject $x -Property @{ParentID=”./Vendor/MSFT/Policy/Config”;InstanceID=”Connectivity”;AllowBluetooth=2} -PassThru

# Remove policy & return to original settings: Get-CimInstance -Namespace $namespaceName -Query 'Select * from MDM_Policy_Config01_Connectivity02' | Remove-CimInstance

The only options you have for this are to set the AllowBluetooth value to 0 (zero) or 2, as 1 is a reserved value.

0 - Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on.
1 - Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.
2 - Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on.

You should be able to use the same functionality on the following settings:

AllowBluetooth
AllowCellularDataRoaming
AllowConnectedDevices
AllowNFC
AllowUSBConnection
AllowVPNOverCellular
AllowVPNRoamingOverCellular

Source: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider

Disclaimer: Scripts in this post are not supported under any Microsoft standard support program or service. The script here is provided AS IS without warranty of any kind. Microsoft disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the script and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the script be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script or documentation, even if Microsoft has been advised of the possibility of such damages.

Email Notifications for ConfigMgr Application Requests via PowerShell

Chris Jones [MSFT] — Tue, 13 Jun 2017 15:24:48 GMT

A common conversation I have with customers is around the lack of a notification channel for application requests in ConfigMgr. I realize there are already a handful of solutions on the web that provide various ways of doing this. So, I figured why not share mine. It's rather basic, just a PowerShell script that queries ConfigMgr for new Application requests, then based on the app category, it will fire off an email to either the Licensing Management (LM) team or the ConfigMgr team. We categorized apps two ways:

If the app required a license, the application name would be added to the script array and these requests would be routed to the help desk via email, which was then converted into a ticket/service request and eventually routed to the LM team. The LM team had rights in the ConfigMgr console, scoped to only show the Application Approval and reports.
If the app did not require a license, and we wanted to control the users that have access to, let's say, management apps, like the System Center consoles, Putty, WireShark, etc., these requests would be routed/emailed to the ConfigMgr admins to approve or reject the request.

The script was triggered by a simple scheduled task that ran every 30 minutes on the Site Server. The script was configured to check for new requests less than 29 minutes old. It seemed to work well and I never experienced duplicate app requests, nor did I have any users complaining about the timing. It leverages PowerShell's Send-MailMessage cmdlet and the Get-CMApprovalRequest cmdlet within ConfigMgr. Below are screen shots of the request and respective email: It's simple, yet effective and you can download the script file from here: AppRequestNotifications. Make sure you update the items noted in the comments throughout the script to match your environment.

Windows 10: HIPAA Compliance [Updated]

Chris Jones [MSFT] — Fri, 10 Mar 2017 10:08:32 GMT

Hello Community, Earlier this year (Feb 2017), we released guidance for configuring Windows 10 systems to comply with HIPAA requirements. After further review both internally at Microsoft and via customer feedback, we determined that additional clarification was needed. It was quickly determined that if we configured all of the settings in the original documentation, the system would be some what limited on functionality. We also wanted to ensure our customers fully understood the implications of disabling or adjusting the settings outlined in the document, as well as understanding what information may be transmitted via telemetry. Spearheaded by the great Chauncey Larsen, one of the many Windows experts here at Microsoft, he worked a ridiculous number of hours with the HIPAA One team, Microsoft legal, and a whole slew of other brilliant minded individuals to drive these revisions. Chauncey shared the following with me:

I'm happy to inform you that HIPAA One was recently cleared to add an Addendum to their document detailing HIPAA compliance with Windows 10. The addendum states the following:

Appendix B: Response to Microsoft Creators Update 1703 for Windows 10

In April 2017, Microsoft released Creators Update 1703 for Windows 10. This update provided granular details on amended basic level Windows diagnostic events and fields and most importantly, furthered Microsoft's commitment to decreasing the exposure of ePHI.

Microsoft continues to be forthcoming on the user data that they collect and may have taken all steps necessary to minimize the possibility for exposure of that data. It is here that Microsoft showcases their pledge to exclude ePHI which may possibly exist on any computer operated by any covered entity.

Following the release, Microsoft issued this statement:

Customers subject to HIPAA can use Windows 10 with confidence in the collection of telemetry data at the Basic level. As customers can confirm for themselves, the data collected at Basic includes data about the user's device only and does not include the content of documents, emails, or any other sensitive personal information about them or their clients. -Marisa Rogers, Microsoft WDG Privacy Officer

There may still be items that require additional clarification and we will continue to address these as they are brought to our attention. While still a work in progress, this is certainly a step in the right direction. Please let me know if you have additional feedback as our team will continue to work with HIPAA One to provide the best guidance for our customers. In the meantime, the update was posted at the link below and the document is available today. http://www.hipaaone.com/whitepaper-hipaa-microsoft-windows/

Windows 10 Pro to Enterprise Upgrades Simplified!

Chris Jones [MSFT] — Tue, 07 Mar 2017 11:29:24 GMT

We have made it easy for Windows 10 Enterprise entitled customers to convert their Windows 10 Pro, [OEM, Retail, or VL] devices to Windows 10 Enterprise simply by changing the product key. You don't need to go through an upgrade in place or wipe and load like you had to in the past. The upgrade process can be easily accomplished using one of the following methods:

Why Windows 10 Enterprise?

Windows 10 Enterprise is the most secure Microsoft operating system to date. The security features outside of what Windows 10 Professional offers provide you with enterprise grade solutions to help combat and prevent malware, ransomware and hacking attacks such as Device Guard, Credential Guard, AppLocker, and Application Guard for Microsoft Edge (coming soon!) and our post endpoint detection and response (EDR) solution, Windows Defender Advanced Threat Protection. These are some of our enterprise grade security solutions which offer both pre and post breach protection, providing a strong and compelling defense-in-depth approach to securing your endpoints. To learn about the full set of features available with Windows 10 Enterprise, click: here.

Prevent a Task Sequence from running over a remote connection

Chris Jones [MSFT] — Tue, 07 Mar 2017 11:01:49 GMT

During a recent Windows 10 deployment, my colleague (@NathanOlmstead) and I needed a way to prevent the task sequence from running if a user kicks it off via Software Center from a remote connection. We did not have the deployment set to download all content before running simply because it's a large amount of data (20+ GB of content) to store on the workstation and even a lot to download over a remote connection. I have to admit, we implemented this after we had a few pilot users get their system formatted when they were at home. Configuration Manager saw the Direct Access IP addresses as on premise IP addresses and kicked off the wipe-and-load...Lesson Learned the hard way! :) I tossed around the idea of using a collection membership based on VPN/DirectAccess boundaries, however, this was not as effective as I would have liked it to be, mostly because the collection wouldn't update fast enough. I would have to have the collection constantly evaluating its membership in order for it to be effective. In short, I ended up using a PowerShell script within the task sequence to look for specific VPN / Remote Connection IP ranges and if detected, notify the user and the task sequence will fail, preventing it from running. While this script was successful for my usage, before using this script, test it in your environment. You will need to update any directories and IP addresses that your organization uses.

# Log directory if ((Test-Path -Path c:\sdc\logs) -eq $false) { New-Item -Path c:\sdc\logs -ItemType dir } else { # Setting known VPN/Remote connection IP ranges to array $array = @("10.10.120.*","10.10.121.*","10.10.122.*","10.10.123.*","10.10.124.*","2608:300:180:1150:*","2608:300:180:1151:*","2608:300:180:1152:*","192.168.*.*") $computer = $env:COMPUTERNAME @() # Excluding local system IP addresses $ips = Get-NetIPAddress| ? { $_.IPAddress -ne "127.0.0.1" -and $_.IPAddress -ne "::1" -and $_.IPAddress -notlike "fe80*" -and $_.IPAddress -notlike "169.254.*.*" } | select IPAddress foreach ($ip in $ips) { $ip = $ip.IPAddress foreach($item in $array) { if ($ip -like $item) { #Popup notification presented to user trying to run task sequence $wshell = New-Object -ComObject Wscript.Shell $wshell.Popup("This task sequence cannot be ran while connected via DirectAccess or VPN. Please try again when you are physically connected to the corporate network. `n `n Contact the DTRA Service Desk for further assistance.",0,"Windows 10 OS Deployment",0x1) $date = Get-Date $errormsg = " `n The Windows 10 Task Sequence failed because a remote connection was detected. The system must be phyically connected to the corporate network to upgrade or install Windows 10. `n Detected IP(s): $IP `n Script runtime: $date" | Out-File -FilePath c:\sdc\logs\Win10_TaskSequenceForcedFailure.log -Append -Encoding default -NoClobber; Write-Output -1; exit -1 } else { # Log result to file $date = Get-Date "A remote connection was not detected: $IP. Finishing loop. Script runtime: $date" | Out-File -FilePath c:\sdc\logs\Win10_TaskSequenceForcedFailure.log -Append -Encoding default -NoClobber } } } # Log result to file "A DirectAccess or VPN connection was NOT found, continuing with Task Sequence" | Out-File -FilePath c:\sdc\logs\Win10_TaskSequenceForcedFailure.log -Append -Encoding default -NoClobber }

You can grab the script file here: TaskSequenceRemoteConnectionDetection.ps1

Disclaimer: Scripts in this post are not supported under any Microsoft standard support program or service. The script here is provided AS IS without warranty of any kind. Microsoft disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the script and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the script be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script or documentation, even if Microsoft has been advised of the possibility of such damages.

Group Policy Search

Chris Jones [MSFT] — Tue, 07 Mar 2017 10:02:12 GMT

The GPS is a fantastic group policy search tool for Microsoft Active Directory Group Policy settings. Use this when you're looking for various Group Policy settings and respective registry data. Data is available for Windows Client, Server, Internet Explorer, Edge, Office, User & Machines polices.

Source: Group Policy Search

Interactive Azure Platform & Sizing Overview

Chris Jones [MSFT] — Tue, 07 Mar 2017 09:45:41 GMT

An interactive Azure Platform Big Picture with direct links to Documentation, Prices, Limits, SLAs and much more.

Source: Interactive Azure Platform Overview

PowerShell: Export all ConfigMgr 2012 R2 task sequences

Chris Jones [MSFT] — Wed, 17 Jun 2015 06:56:00 GMT

Here's a quick script that will export all of your task sequences in ConfigMgr 2012 R2: ]----code Import-Module 'F:\Program Files\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1' CD 'F:\Program Files\Microsoft Configuration Manager\AdminConsole\bin' CD CM0: #Change 'CM0' to your site code $ts = Get-CMTaskSequence foreach ($t in $ts){ $path = "F:\TaskSequenceBackups" $exportname = $t.Name +".zip" Export-CMTaskSequence -TaskSequencePackageId $t.PackageID -ExportFilePath "$path\$exportname" } code----[ Change the file paths in the first two lines to match your CM installation directory. Change the Site Code to your site code. Change the $path variable to your export destination. You may get errors during the export process if the Task Sequence name has a colon in the name such as: "Testing: Win8.1 Refresh". Change any colons to a dash to avoid errors. Hope this helps.