1. Create and issue a custom SSL certificate for the Cloud Management Gateway (and optionally, the Cloud Distribution Point).
2. Create a client authentication certificate
3. Export the client certificate's root
4. Verify a unique Azure cloud service URL
5. Request the Cloud Management Gateway certificate from the Certification Authority
6. Upload the Cloud Management Gateway (and optionally, the Cloud Distribution Point) management certificate to Azure.
7. Create the Cloud Management Gateway in the Configuration Manager console
8. Install the Cloud Management Gateway connection point in the Configuration Manager console
9. Configure Site System Roles to accept cloud management gateway traffic
10. Verify Client Communication with the Cloud Management Gateway
11. Configure a Cloud Distribution Point (optional)

• Hyper-V support (see Hyper-V requirements below)
• 6 GB or more of RAM.
• 64-bit version of the Pro edition of Windows 8, Windows 8.1, Windows10 or higher
• A processor that supports SSSE3 or later.

• DHCP
• Automatically configured DNS and gateway settings

• In the BIOS, the following features must be supported:
  • Hardware-assisted virtualization
  • Second Level Address Translation (SLAT)
  • Hardware-based Data Execution Prevention (DEP)
• In Windows, Hyper-V must be enabled and running.
• You have to be a member of the local Hyper-V Administrators group.

1. Windows Store for Business sync errors

2. Windows Store for Business does not launch on Configuration Manager client

3. Offline application does not install when the Store is open

• Connect an Ethernet cable into the board. This will allow the board to automatically connect to your network.

• In the Windows 10 IOT dashboard, click on My Devices and find your board. You will see the name, type of board, IP Address, OS version, and can also rename the device using Settings.

• Click on My Devices and click on Configure Device to connect it to Wi-Fi. If the board has a Wi-Fi adapter which has not yet been setup, you will notice that it will start to broadcast itself as a network starting in ‘AJ_’

• Enter your network credentials and the computer will now connect to the board.

reg ADD "HKLM\software\microsoft\windows\currentversion\embeddedmode\processlauncher" /v allowedexecutablefileslist /t REG_MULTI_SZ /d "c:\windows\system32\cmd.exe\0"

• Add to your private store where people in your organization can find and install it (doing this will add the Company Portal to your organization private store. Within the public Windows Store, users will see a new tab with your organization's name with all the apps that have been distributed)
• Assign to people - choose specific emails that this app will be sent to
• Distribute later - add the app to your inventory but don't actually distribute yet

This post will go over how to enroll Windows Phone 8.1 into a Config Manager/Intune hybrid scenario. The general process for enrollment is very similar to enrolling in an Intune standalone model.

Before we enroll our Windows Phone 8.1 device into Intune, we will need to complete a few prerequisites. 

1. The first thing we will need to do within the Configuration Manager console is create & deploy the Company Portal app. This is the app that end users will access on the device to then be able to install apps which have been deployed by their IT staff.

The required ‘.xap’ file for the Company Portal app can be found at Windows Intune Company Portal for Windows Phone - https://www.microsoft.com/en-us/download/details.aspx?id=36060

The process for creating & deploying any mobile application is more or less the same as deploying an application for on-prem devices.

Choose the ‘Windows Phone app package (*.xap)’ application type * browse to the location of the company portal xap file

NOTE: ‘.xap’ is the file type for all Windows Phone app packages 

2. Type ‘Company Portal’ for the app name. All other values can stay default. Add a category if necessary. In my lab, I have a category named ‘Mobile – Windows Phone’.

3.  Finish through the rest of the app creation

4.  Once the app is created, we can go ahead and deploy it to our Intune user collection. Right click on Company Portal – Deploy. On the General page, choose the appropriate collections which holds the users have access to Intune(basically, users who have      Intune licenses). On the Content page, choose the ‘manage.microsoft.com’ cloud distribution point.

 NOTE: The ‘manage.microsoft.com’ distribution point is NOT the same as the ‘Cloud Distribution Point’ option within ConfigMgr. The ‘manage.microsoft.com’ distribution point is specific to Intune, and all mobile apps should be distributed specifically to it. 

5. Continue through the rest of the app deploy wizard. 

The last thing we will want to do before enabling enrollment of Windows Phone is to add it as an operating system within our Intune subscription.

6. In the ConfigMgr console, navigate to Administration – Cloud Services – Windows Intune Subscriptions. Right click the subscription & hit Properties. If you have not yet created an Intune subscription, you can go ahead and create one now (should be an option in    the top left of the console). Click the Windows Phone tab, and check the box for ‘Enable Windows Phone enrollment.’ In the .pfx file section, browse to the location of the Symantec cert for Windows Phone.

Note that you will need to purchase this cert if you don’t already have it. An alternative to purchasing the cert is to use the ‘Support Tool for Windows Intune Trial Management of Window Phone,’ which can be found here -https://www.microsoft.com/en-us/download/details.aspx?id=39079. The download site will go through the install steps to help you get started with managing Windows Phone 8 with Intune. The tool will allow you to enroll and deploy a few sample apps to Windows Phone

Lastly, browse to the Company Portal app which we created earlier

All prereqs are done! Now we can go ahead and enroll the device

Here is our Windows Phone 8.1 device – 

7.  Enrollment of WP8.1 can be done via WP8.1 Settings. Navigate to Settings – Workplace. Click on Workplace & hit ‘Add an Account’ 

8.  Type in a username of a user who has access to your Intune environment. When you hit ‘Sign In’, you will see a text across the top of the screen saying ‘We’re looking for your settings….’

      Once authentication is successful, you’ll see a text across the top of the screen saying ‘and we’ve found them!’ This verifies that the device has found the Intune subscription.  

9. The next page will display your company’s Intune sign in page. Sign in with a user who has access to Intune

10.  If the sign in in successful, you will be directed to the Account Added page. On this page, you will want to keep the box for ‘Install company app’ checked. This will install the Company Portal app that we created earlier. 

11. Hit Done, and you will see your company’s subscription listed. 

The next thing we want to do is verify that the Company Portal application was installed successfully

12.  Check the list of apps on the device, and you should see Company Portal listed there. (it may take a minute or two after the device is enrolled for Company Portal to show up)

Now, let’s open up the Company Portal app

13.  On the first page, you will see a list of apps that have been deployed to the device. This could be either custom applications deployed by your IT staff, or links to applications in the Windows Phone store.

 Scroll to the next page & you will see a list of all devices the current user has enrolled into Intune 

 On the next page, you will see the IT staff contact info(if this information was included during the Intune subscription setup)

We can also verify successful enrollment within the Config Manager console 

14. Navigate to Assets & Compliance – Devices. Here, you will see the WP8.1 which was enrolled

Also, similar to any other device, we can get hadware inventory information from movile devices. Right click on the Windows Phone device, Start – Resource Explorer

Click on Hardware 

Under Device Information, you will see details regarding this specific device. In this example, I enrolled a Lumia 520 phone.

Here is a collection which you can use in your ConfigMgr environment which will query all Windows Phones (both 8 & 8.1)

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like "%Windows Phone%"

And there you go – the device has been successfully enrolled! Now you can deploy apps, compliance settings, email profiles, view reports, etc for this user/device. 

Teju Shyamsundar

Premier Field Engineer @ Microsoft 

1. Open up the Company Portal app on the Android VM – this will open up a page in which you will start device enrollment. Click next on the first step within the Company Portal app. 

2. Type in your Intune account information. This could either be a custom domain(if that has been setup within Intune), or a ‘.onmicrosoft.com’ account. In this case I am using a custom domain which I have purchased, which has been associated with my                       ‘.onmicrosoft.com’ account within the Intune portal. 

Android builds can be obtained at https://www.android-x86.org/download. In this series, we will be using Android 4.4.

Let’s get started with getting an Android emulator running in Hyper-V!

1. Start with creating a New Virtual machine in Hyper-V, naming it, and storing it as you would with any other Windows VM. Choose the ‘Generation 1’ VM option. 

 

In this post, we will go through getting the ConfigMgr 2012 R2 client for Linux installed, as well as commands that can be run via Terminal to manage the machine.

The installation files for the Linux client can be found here –

SCCM 2012 SP1: https://www.microsoft.com/en-in/download/details.aspx?id=36212

SCCM 2012 R2: https://www.microsoft.com/en-in/download/details.aspx?id=39360

You will need to download these files onto a Windows machine, and extract the contents. These contents then need to be copied onto the Linux machine. 

1. Open up Terminal
2. Switch to root(required to install client)

            sudo su

      3. To use root credentials to run the install script as a program, type

          Chmod +x install

     4. ./install –mp fc-cm01.fourthcoffee.local –sitecode FCH ccm-Universalx64.1.0.0.458.tar

        --MP = management point FQDN

       --sitecode = SCCM Site Code that machine will report to

       The installed client will run with root credentials, root credentials are required to collect HW/SW Inventory and perform software deployment

    5. Linux clients also support a Fallback Status Point

       -FSP <FQDN of FSP>

   6. At this point, you will see the client start to install

      The screenshot below (right) shows that the installation has successfully completed.

Log Files

Scxcm.log

By default, this log file is created in the following location: /var/opt/microsoft/scxcm.log

To change the location of the log file, edit /opt/microsoft/configmgr/etc/scxcm.conf and change the PATH field. You do not need to restart the client computer or service for the change to take effect.

You can set the log level to one of four different settings:

• ERROR: Indicates problems that require attention.
• WARNING: Indicates possible problems for the client operations.
• INFO: More detailed logging that indicates the status of various events on the client.
• TRACE: Verbose logging that is typically used to diagnose problems.

To change the log level, edit /opt/microsoft/configmgr/etc/scxcm.conf and change each instance of the tag MODULE to the desired log level.

Scxcmprovider.log

This is the log file for the CIM service of the Configuration Manager client for Linux and UNIX (omiserver.bin). This log file contains information about the ongoing operations of nwserver.bin.

By default, this log is created in the following location: /var/opt/microsoft/configmgr/scxcmprovider.log

To change the location of the log file, edit /opt/microsoft/omi/etc/scxcmprovider.conf and change the PATH field. You do not need to restart the client computer or service for the change to take effect.

You can set the log level to one of three different settings:

• ERROR: Indicates problems that require attention. 
• WARNING: Indicates possible problems for the client
       operations. 
• INFO: More detailed logging that indicates the status
       of various events on the client.

To change the log level, edit /opt/microsoft/omi/etc/scxcmprovider.conf and change each instance of the tag MODULE to the desired log level.

Command Line Operations for Linux

1. Return the client version - /opt/microsoft/configmgr/bin/ccmexec –v
2. Force Policy Refresh - /opt/microsoft/configmgr/bin/ccmexec –rs policy
3. Force Hardware Inventory - /opt/microsoft/configmgr/bin/ccmexec –rs hinv
4. Force Software Inventory - /opt/microsoft/configmgr/bin/ccmexec –rs sinv
5. Tail ConfigMgr Client Install Log - tail –f /var/opt/microsoft/scxcm.log
6. Query Specific Inventory Data

            Example - SCXCM Inventory Class

           /opt/microsoft/nanowbem/bin/nwcli ei root/cimv2 SCXCM_ComputerSystem

      7. Uninstall the Client - /opt/microsoft/configmgr/bin/uninstall

1. Software Updates

         i.  SCCM will not sync updates for Linux distros in the console - to update a Linux machine, you will need to download the updates outside of SCCM, then create a software distribution package with the update files included, and deploy to the Linux Clients

        ii.  Lumension provides the option to deploy Linux software updates directly

            https://www.lumension.com/system-center.aspx

           https://www.lumension.com/Media_Files/Documents/Marketing---Sales/Datasheets/Lumension-Vulnerability-and-Patch-Management-SCCM.aspx

 Supported Hardware Inventory Classes for Linux

• Win32_BIOS
• Win32_ComputerSystem
• Win32_DiskDrive
• Win32_DiskPartition
• Win32_NetworkAdapter
• Win32_NetworkAdapterConfiguration
• Win32_OperatingSystem
• Win32_Process
• Win32_Service
• Win32Reg_AddRemovePrograms
• SMS_LogicalDisk
• SMS_Processor

Software Distribution

Note that all software distribution for Linux must be machine based, SCCM 2012 does not support user based deployments for Linux/UNIX machines

1. Supported Methods of Software Distribution                               
   i. New software deploymen                              
   ii.     Software updates for programs already on the compute                             
   iii.    Operating system patche                             
   iv.    You can run native Linux and UNIX commands, and run scripts that are located on Linux and UNIX servers                            
   v.     You can limit deployment to the operating systems that you specify when you select the program option Only on specified client platforms                        
   vi.    You can use maintenance windows to control when software installs
   vii.   You can use deployment status messages to monitor deployments                  
   viii.  The client can throttle network usage when downloading software from a distribution point

                  b.   Prerequisite                          
                        i.    Use configurations intended for machine based deployments only                   
                        ii.   Configure programs to download software from the DP and run programs from the client ccm cache
                        iii.  Configure Network Access Acount for DP access(because Linux machines are treated as WORKGROUP machines)

Linux Software Distribution Details -  <https://technet.microsoft.com/en-us/library/jj573943.aspx>

Operating System Deployment

Although it is not supported to use SCCM OSD to deploy any Linux
distro, it can potentially be done as outlined here -

https://blogs.msdn.com/b/steverac/archive/2014/01/02/osd-for-linux-imaging-yes-really.aspx

Note that this is not supported in either SCCM 2012 SP1 or SCCM 2012
R2

Additional Information

Introduction to the Linux/UNIX Client - https://blogs.technet.com/b/manageabilityguys/archive/2013/04/11/configmgr-2012-sp1-and-unix-linux-clients-part-1-introduction-and-client.aspx

General Operations & Inventory - https://blogs.technet.com/b/manageabilityguys/archive/2013/05/03/configmgr-2012-sp1-and-unix-linux-clients-part-2-general-operations-and-inventory.aspx

-Teju Shyamsundar