Microsoft Enterprise Mobility Suite Tips https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/feed.xml Enterprise Mobility -- by Pieter Wigleven (Technical Solution Professional MSFT) Mon, 25 Apr 2016 20:32:48 GMT en-US hourly 1 NDES: Event ID 29 (The password in the certificate request cannot be verified) https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/ndes-event-id-29-the-password-in-the-certificate-request-cannot-be-verified Fri, 12 Feb 2016 01:39:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2016/02/12/ndes-event-id-29-the-password-in-the-certificate-request-cannot-be-verified/ This week I received an e-mail from our support organization about a case regarding NDES. One of our customers (Bechir Hammami from Germany) ran into an issue where NDES stopped working after performing an upgrade on their ConfigMgr 2012 environment.

Luckily the customer managed to resolve the issue themselves and even shared the steps he took - hoping others would benefit from the information. Thanks Bechir for resolving and sharing this info - much appreciated!

 

The issue:

After the upgrade the following error was shown in the eventlog:

NDES: Event ID 29 (The password in the certificate request cannot be verified. It may have been used already. Obtain a new password to submit with this request.)

1) Check installed features

The following features are necesarry for ConfigMgr/NDES:

Install-WindowsFeature Web-Windows-Auth
Install-WindowsFeature Web-ISAPI-Ext
Install-WindowsFeature Web-Metabase
Install-WindowsFeature Web-WMI
Install-WindowsFeature BITS
Install-WindowsFeature RDC
Install-WindowsFeature NET-Framework-Features
Install-WindowsFeature Web-Asp-Net
Install-WindowsFeature Web-Asp-Net45
Install-WindowsFeature NET-HTTP-Activation
Install-WindowsFeature NET-Non-HTTP-Activ

The highlighted ones didn’t appear as active as they got deactivated by the migration.

2) Install mising features

Executed this dism command (Attention: for installation is the ISO necessary):

dism /online /enable-feature /featurename:NetFX3 /all /Source:<d:\sources\sxs> /LimitAccess

Afterwards, for Framework 4.5, install  “HTTP Activation”

Restart SMA_Site_Component_Manager Service, which sorts out the CRP issue on the ConfigMgr and NDES server.

Eventlog after these changes:

Additional information from Kevin Myrup (MSFT)

Whenever you see event id 29 on the NDES server: "NDES: Event ID 29 (The password in the certificate request cannot be verified. It may have been used already. Obtain a new password to submit with this request.)"

And the policymodule for Intune/ConfigMgr is installed, this always means something is wrong on the Certificate Registration Point (CRP) site role (or in the case of Intune Standalone, the CRP web service running on the NDES server itself). The case above is one example. But there are also other reasons it can happen.

The first place to look is the CRP.log. If the server is healthy, crp.log will show the reason why the cert request was rejected (there are several reasons this could happen, such as the challenge password has expired, the subject name doesn't match what is in the ConfigMgr database, for example when someone's display name or email address has changed in AD, or there is some problem with replication between Intune and ConfigMgr).

If the server is not healthy, as was the case for Bechir above, crpctrl.log will usually have some indication of this.

 

]]> Useful ConfigMgr query for Intune Enrolled Devices https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/useful-configmgr-query-for-intune-enrolled-devices Mon, 22 Jun 2015 04:48:38 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/06/22/useful-configmgr-query-for-intune-enrolled-devices/ The following SQL query was shared by Gerjan Eghuizen an Unified Communications Consultant working at Enexis and Niels Buit (Microsoft), useful for anyone who has Mobile Devices enrolled via Microsoft Intune in ConfigMgr 2012 R2.

The end-result is a report with this information (clickable):

image

The SQL query:

CREATE TABLE
          #machines
          (
          DeviceID uniqueidentifier, -- Remove GUID: FROM SMSID to get this
          ResourceID int,
          SMS_Unique_Identifier0 nvarchar(255),
          Name0 nvarchar(255),
          Netbios_Name0 nvarchar(255),
Client_Version0 nvarchar(256),
          Client_Type0 int,
          Operating_System_Name_and0  nvarchar(256),
          DeviceOwner0 int,
                DeviceUser nvarchar(255),
                DeviceIMEI nvarchar(255)
          )

          CREATE INDEX ix_machines2 ON #machines (DeviceID)
          INSERT INTO #machines(DeviceID, ResourceID, SMS_Unique_Identifier0, Name0, Netbios_Name0,
          Client_Version0, Client_Type0, Operating_System_Name_and0, DeviceOwner0, DeviceUser, DeviceIMEI)
          SELECT CONVERT(uniqueidentifier, CASE  LEN(machines.SMS_Unique_Identifier0)
          WHEN 36 then machines.SMS_Unique_Identifier0
          ELSE SUBSTRING(machines.SMS_Unique_Identifier0,6,LEN(machines.SMS_Unique_Identifier0)-5) end),

machines.ResourceID,
          machines.SMS_Unique_Identifier0,
          machines.Name0,
          machines.Netbios_Name0,
          machines.Client_Version0,
          machines.Client_Type0,
          machines.Operating_System_Name_and0,
          machines.DeviceOwner0,

(SELECT UniqueUserName FROM fn_rbac_usermachinerelation(@UserSIDs) relations WHERE relations.MachineResourceID=machines.ResourceID),

(SELECT IMEI0 FROM fn_rbac_GS_Device_COMPUTERSYSTEM(@UserSIDs) computersys WHERE computersys.ResourceID=machines.ResourceID)          FROM fn_rbac_R_System(@UserSIDs) machines          WHERE ISNULL(machines.Obsolete0, 0) <> 1 AND ISNULL(machines.Decommissioned0, 0) <> 1 AND machines.Client0 = 1
          AND ISNULL(machines.AgentEdition0, 0) <> 5  AND machines.Client_Type0 = 3
          Select
          RS.SMS_Unique_Identifier0,
          (case when RS.Name0 is not null then RS.Name0 else RS.Netbios_Name0 end) as DeviceName,
                RS.DeviceUser as DeviceUser,
                RS.DeviceIMEI as DeviceIMEI,
                RS.Client_Version0 AS OSVersion,
          (case when comp.OEM0 is not null then comp.OEM0 else mdmci.Manufacturer end) as DeviceOEMInfo,
          (case when comp.PlatformType0 is not null then comp.PlatformType0 else compsys.SystemType0 end) as DeviceType,
          (case when comp.Product0 is not null then comp.Product0 else mdmci.DeviceOperatingSystem end) as Product,
          cs.LastPolicyRequest AS LastPolicyRequest,
          (Select top(1) v.AgentTime from fn_rbac_AgentDiscoveries(@UserSIDs)  v
          where RS.ResourceID = v.ResourceId and
          v.AgentName = 'Heartbeat Discovery' order by
v.AgentTime DESC) AS LastHeartbeatTime,
          wks.LastHWScan as LastHWScan,
          RS.DeviceOwner0
          from #machines   RS
          left outer join fn_rbac_GS_DEVICE_COMPUTERSYSTEM(@UserSIDs)  comp on comp.ResourceID=RS.ResourceID
          left outer join fn_rbac_CH_ClientSummary(@UserSIDs)  cs on cs.ResourceID=RS.ResourceID
          left outer join fn_rbac_GS_WORKSTATION_STATUS(@UserSIDs)  wks on wks.ResourceID = RS.ResourceID
          left outer JOIN fn_rbac_mdmclientidentity(@UserSIDs) mdmci ON mdmci.DeviceID = RS.DeviceID
          left outer join fn_rbac_GS_COMPUTER_SYSTEM(@UserSIDs) compsys on compsys.ResourceID = RS.ResourceID
          where (@ProductName = '*' or  comp.Product0 = @ProductName or mdmci.DeviceOperatingSystem = @ProductName)

]]> Assigned Access (kiosk mode) Windows Phone and Microsoft Intune https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/assigned-access-kiosk-mode-windows-phone-and-microsoft-intune Tue, 28 Apr 2015 01:13:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/04/28/assigned-access-kiosk-mode-windows-phone-and-microsoft-intune/ Use this example to configure your own assigned access (previously known as Kiosk Mode) for Windows Phone. Don’t forget to restart your Windows Phone after the policy has been applied.

Heads up!

This feature should only be used on devices that are owned or provided by the enterprise company or organization or on a user owned device where the user allowed the device to be fully managed by the enterprise company.
This feature may cause the device to fail or lose connectivity and require that the device be serviced at an authorized repair center to reset to factory settings. Microsoft is not liable for any damage to the device or any loss of productivity that results from use of this feature. Microsoft requires that software vendors provide disclaimers to users when their products expose this feature and capabilities.

And:

A factory reset is required to get out of Assigned Access (kiosk mode)

If you are OK with that, continue as follows:
Create a new OMA-URI setting in Microsoft Intune.

clip_image002

OMA URI:
./Vendor/MSFT/EnterpriseAssignedAccess/AssignedAccess/AssignedAccessXml

Value:
<?xml version="1.0" encoding="utf-8"?>
<HandheldLockdown version="1.0">
                <Default>
                                <ActionCenter enabled="false" />
                                <Apps>
                                                <Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5601}" autoRun="false">
                                                                <PinToStart>
                                                                                <Size>Medium</Size>
                                                                                <Location>
                                                                                                <LocationX>0</LocationX>
                                                                                                <LocationY>0</LocationY>
                                                                                </Location>
                                                                </PinToStart>
                                                </Application>
                                                <Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5660}" autoRun="false">
                                                                <PinToStart>
                                                                                <Size>Medium</Size>
                                                                                <Location>
                                                                                                <LocationX>0</LocationX>
                                                                                                <LocationY>2</LocationY>
                                                                                </Location>
                                                                </PinToStart>
                                                </Application>
                                                <Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA561E}" autoRun="true">
                                                                <PinToStart>
                                                                                <Size>Medium</Size>
                                                                                <Location>
                                                                                                <LocationX>0</LocationX>
                                                                                                <LocationY>4</LocationY>
                                                                                </Location>
                                                                </PinToStart>
                                                </Application>
                                </Apps>
                                <Buttons>
                                                <ButtonLockdownList>
                                                                <!-- Lockdown all buttons –>
                                                                <Button name="Search">
                                                                                <ButtonEvent name="Press" />
                                                                                <ButtonEvent name="PressAndHold" />
                                                                </Button>
                                                                <Button name="Camera">
                                                                                <ButtonEvent name="Press" />
                                                                                <ButtonEvent name="PressAndHold" />
                                                                </Button>
                                                                <Button name="Custom1">
                                                                                <ButtonEvent name="Press" />
                                                                                <ButtonEvent name="PressAndHold" />
                                                                </Button>
                                                                <Button name="Custom2">
                                                                                <ButtonEvent name="Press" />
                                                                                <ButtonEvent name="PressAndHold" />
                                                                </Button>
                                                                <Button name="Custom3">
                                                                                <ButtonEvent name="Press" />
                                                                                <ButtonEvent name="PressAndHold" />
                                                                </Button>
                                                </ButtonLockdownList>
                                                <ButtonRemapList />
                                </Buttons>
                                <MenuItems>
                                                <DisableMenuItems />
                                </MenuItems>
                                <Settings>
                                                <System name="Microsoft.WiFi" />
                                                <System name="Microsoft.About" />
                                                <System name="Microsoft.Feedback" />
                                                <System name="Microsoft.CompanyAccount" />
                                                <System name="Microsoft.VPN" />
                                </Settings>
                                <StartScreenSize>Small</StartScreenSize>
                </Default>
</HandheldLockdown>

------------------------------Do not include this line----------------------------

// Thanks Mike Danoski and David Alessi for supplying this information

]]> Deploying .appx package to Windows Phone via Microsoft Intune failes with 0x0 or 0x87D103E8 https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/deploying-appx-package-to-windows-phone-via-microsoft-intune-failes-with-0x0-or-0x87d103e8 Thu, 02 Apr 2015 01:12:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/04/02/deploying-appx-package-to-windows-phone-via-microsoft-intune-failes-with-0x0-or-0x87d103e8/ Are you trying to deploy a Windows Phone .appx but the installation via Microsoft Intune fails? It could be that your application needs dependencies installed.

When deploying an .appx from the public Store or via Visual Studio dependencies are installed automatically. When creating an .appx and manually sideloading this to a device OR using Microsoft Intune the dependencies are not installed automatically and the installation might fails. While a proper solution is being investigated, there are two workarounds you could consider:

  1. Install another application from the public store that’s using the same dependency (e.g. Shazam is using WinJS) after that the app should deploy fine.
  2. Instead of (the default in Visual Studio) referencing a dependency in the project, copy the contents of the dependency package into the VS Project and change the reference.

Method 2 explained in a bit more detail:
Copy the contents of the dependency package into the VS project and add those files to project. The only code change you have to make is to change the references like this:

Default reference:

<script src="//Microsoft.Phone.WinJS.2.1/js/base.js"></script>
<script src="//Microsoft.Phone.WinJS.2.1/js/ui.js"></script>

Change to:

<script src="/Microsoft.Phone.WinJS.2.1/js/base.js"></script>
<script src="/Microsoft.Phone.WinJS.2.1/js/ui.js"></script>

Note: the single / in front of the reference.
Build your solution and deploy the application with Microsoft Intune, it should succeed.

]]> Part 4 - Protecting NDES with Azure AD Application Proxy https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/part-4-protecting-ndes-with-azure-ad-application-proxy Wed, 25 Feb 2015 00:38:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/02/25/part-4-protecting-ndes-with-azure-ad-application-proxy/ In the past few months I published a series of posts on setting up certificate distribution to mobile devices. In summary this is what was discussed:

Part 1 – First tips and tricks on how to troubleshoot and check existing ConfigMgr/SCEP/NDES infrastructures.
Part 2 – After many asks for clarity, a full guide on how to install and troubleshoot ConfigMgr/SCEP/NDES.
Part 3– Using an additional reverse proxy in a DMZ in front of NDES. The reverse proxy of choice was Windows Server 2012 R2 with the Web Application Proxy role installed.

In this Part 4 we will discuss a cool solution that just have been made possible!

The Azure AD Application Proxy
Azure AD Application Proxy lets you publish applications, such as SharePoint sites, Outlook Web Access and other web application, inside your private network and provides secure access to users outside your network via Azure. The team has recently updated the Azure AD Application Proxy to allow NDES usage, great news!

Azure AD Application Proxy is built on Azure and gives you a massive amount of network bandwidth and server infrastructure to have better protection against DDOS attacks and superb availability. Furthermore there is no need to open external firewall ports to your on premise network and no DMZ server is required. All traffic is originated inbound. For a complete list of outbound ports take a look at this MSDN page.

Important notes:

Azure AD Application Proxy is a feature that is available only if you are using the Premium or Basic editions of Azure Active Directory. For more information, see Azure Active Directory Editions.
If you have Enterprise Mobility Suite (EMS) licenses you are eligible of using this solution.
The Azure AD Application Proxy connector only installs on a Windows Server 2012 R2 Operating system, this is also a requirement of the NDES server anyway.

Architecture
The architecture of this solution could look as follows:

clip_image002

Installation steps
During the next steps I assume you already got certificate distribution to work, if not please consult Part 2 on this topic.

1. On your PC browse to http://manage.windowsazure.comand login with an account that has Administrative permissions in your Azure AD tenant.

2. On the left side navigate to “Active Directory” and select the desired directory. clip_image004

3. After your Azure Active Directory is selected, hit the “Configure” section.clip_image006

4. Scroll down to the “Application Proxy” and hit the “enabled” button. Afterwards download the Application Proxy connector (AADApplicationProxyConnectorInstaller.msi) to your local PC and transfer it to the NDES server.clip_image008

5. On your NDES server(*), start the installation by executing the previously downloaded AADApplicationProxyConnectorInstaller.msi. Follow the wizard like shown in the print screens below.

(*) Important note: the connector could be installed on any server within your corporate network with access to NDES. It does not have to be installed on the NDES server itself.

clip_image010

clip_image012

6. During the installation wizard you will be prompted to authenticate to you Azure AD tenant by providing Azure AD Administrative credentials
clip_image014

7. If all goes well, you should be looking at this success message.clip_image016

8. Go back to your Azure management portal (http://manage.windowsazure.com) but this time go to the “Application” section as illustrated in the next screenshot. clip_image018

9. After selecting the “Add” button select the option to “Publish an application that will be accessible from outside your network”. Enter a descriptive name and hit the arrow button to proceed. clip_image020

10. In the next dialog look at the following three things:

  • Make sure you change “preauthentication method” to “Passthrough”. It’s not possible to use any form of pre-authentication, the protocol used for Certificate Requests (SCEP) does not provide such option.
  • Enter the internal URL/FQDN of your NDES server on which you installed the connector earlier.
  • Copy the provided “External URL” to your clipboard.

Hit the checkmark to save your application.
clip_image022

11. Test whether you can access your NDES server via the Azure AD Application proxy by pasting the link from step 10 into a browser. You should see a default IIS welcome pageclip_image024

12. As a final test, add the mscep.dll path to the existing URL you pasted in the previous step:

https://scep-test93635307549127448334.msappproxy.net/certsrv/mscep/mscep.dll

13. You should receive a “HTTP Error 403 – Forbidden”.clip_image026

14. The last step is to change the NDES URL provided (via Microsoft Intune) to devices, this could either be in System Center Configuration Center or in Intune Cloud.

a. For System Center Configuration Center go to the Certificate Registration Point (CRP) and adjust the URL, this is what devices reach out to and present their challenge.

clip_image028

b. For Intune Cloud Only a.k.a. Intune Standalone, either Edit or Create a new SCEP policy and add the new URLclip_image030

Hope this post helped you use Azure AD Application Proxy in combination with NDES, please consider leaving a reply if it did!

]]> Cumulative Update 4 for System Center 2012 R2 Configuration Manager https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/cumulative-update-4-for-system-center-2012-r2-configuration-manager Thu, 05 Feb 2015 00:33:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/02/05/cumulative-update-4-for-system-center-2012-r2-configuration-manager/ Using this linkyou can download the latest ConfigMgr 2012 R2 which contains a few Mobile Device Management enhancements:

Mobile devices
  • Trying to enroll a device in a user collection that contains security groups fails with an "access denied" error.
  • Inventory data that's collected from mobile devices and the Microsoft Intune connector may be for the wrong device if two devices synchronize at the same time.
  • The Exchange Server Connector does not perform a full synchronization when multiple concurrent remote PowerShell connections are active at the same time on the same Exchange Online account.
  • 2990658 Hotfix extends client notification in System Center 2012 R2 Configuration Manager to MDM devices
  • 3002291 Mobile Device Management settings are not applied to cloud-managed users in System Center 2012 R2 Configuration Manager
]]> Create a VPN profile using Microsoft Intune (Standalone) via Custom OMA-URI’s https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/create-a-vpn-profile-using-microsoft-intune-standalone-via-custom-oma-uris Fri, 30 Jan 2015 00:29:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/01/30/create-a-vpn-profile-using-microsoft-intune-standalone-via-custom-oma-uris/ Microsoft Intune allows you to deploy several VPN connection profiles to Windows Phone 8.1 devices. The available options are:

  • Juniper Pulse
  • F5 Edge Client
  • Dell SonicWALL Mobile Connect
  • CheckPoint Mobile VPN

If you want to deploy another type, e.g. IKEv2 based – it’s possible to use custom URI’s. In order to create one, select “Policy” on the left side of the management portal, navigate to “Configuration Policies” and select “Windows Phone OMA-URI Policy”.

clip_image002

After creating a new policy, add the custom URI’s like shown in the screenshot below.

clip_image004

Below is a set of example settings.  Be careful with the data types and formatting (e.g. XML).

Type

OMA-URI

Value

string

./Vendor/MSFT/VPN/MYVPNTEST/Server

vpn.contoso.com

string

./Vendor/MSFT/VPN/MYVPNTEST/SecuredResources/DNSSuffix

dns.contoso.com

string

./Vendor/MSFT/VPN/MYVPNTEST/TunnelType

IKEv2

string

./Vendor/MSFT/VPN/MYVPNTEST/Authentication/Method

EAP

string

./Vendor/MSFT/VPN/MYVPNTEST/Proxy/Manual/Server

proxy.contoso.com

int

./Vendor/MSFT/VPN/MYVPNTEST/Proxy/Manual/Port 

8080

bool

./Vendor/MSFT/VPN/MYVPNTEST/Proxy/Manual/BypassProxyForLocal 

True

bool

./Vendor/MSFT/VPN/MYVPNTEST/Policies/SplitTunnel 

false

bool

./Vendor/MSFT/VPN/MYVPNTEST/Policies/BypassForLocal

false

bool

./Vendor/MSFT/VPN/MYVPNTEST/Policies/TrustedNetworkDetection 

false

string

./Vendor/MSFT/VPN/MYVPNTEST/Policies/ConnectionType 

manual

string - XML

./Vendor/MSFT/VPN/MYVPNTEST/Authentication/EAP

(see below for contents – doesn’t fit this table)

This should go into the “Value” field of “EAP” mentioned above:

<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
  <EapMethod>
    <Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type>
    <VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId>
    <VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType>
    <AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId>
  </EapMethod>
  <Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
    <Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
      <Type>13</Type>
      <EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
        <CredentialsSource>
          <CertificateStore>
            <SimpleCertSelection>true</SimpleCertSelection>
          </CertificateStore>
        </CredentialsSource>
        <ServerValidation>
          <DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation>
          <ServerNames></ServerNames>
        </ServerValidation>
        <DifferentUsername>false</DifferentUsername>
        <PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">
false</PerformServerValidation>
        <AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">
false</AcceptServerName>
      </EapType>
    </Eap>
  </Config>
</EapHostConfig>

Special thanks goes out to James Lieurance (MSFT) who supplied the OMA-URI’s.

]]> Deploy Wi-Fi profiles to Windows Phone devices with Microsoft Intune OMA-URI policy https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/deploy-wi-fi-profiles-to-windows-phone-devices-with-microsoft-intune-oma-uri-policy Mon, 19 Jan 2015 00:28:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2015/01/19/deploy-wi-fi-profiles-to-windows-phone-devices-with-microsoft-intune-oma-uri-policy/ One of our partners in The Netherlands that has a lot of experience with EMS deployments is Inovativ. In this blog Ronny de Jong will explain how to deploy WiFi Profiles using OMA-URI policies using Microsoft Intune Cloud (also known as Standalone).

Hi, I am Ronny de Jong and as consultant I am working for Inovativ – a Dutch Microsoft Partner specialized in System Center, Cloud & Data Center Management. My primary focus is on Enterprise Mobility, System Center and Microsoft Azure. As trainer I'm delivering Microsoft courses and being active in the community as blogger & member of System Center User Group NL. Further I'm speaker at community events like TechDays, Experts Live & UG meetings.

With the December update of Microsoft Intune a cool feature OMA-URI support has been added. This seemingly small a feature but it introduces ‘endless’ management capabilities and scenario’s which allows you to take full advantage of managing Windows Phone with Microsoft Intune. This is useful when the setting you need is not configurable in a mobile device security policy.

A good example is the missing feature of deploying Wi-Fi profiles to Windows Phone devices with default policy templates. This is currently only available yet for Android and iOS. With the introduction of OMA-URI support in Microsoft Intune for Windows Phone devices we are able to deploy Wi-Fi profiles with Microsoft Intune. In this blog I’ll show you how to add multiple settings including a Wi-Fi profile with a single OMA-URI policy.

Creating a new policy select Windows Phone OMA-URI Policytemplate.

clip_image001

Provide a meaningful description for further reference as a policy can be used to configure one or more settings.

clip_image002

Next step is to add a OMA-URI WiFi setting, is this example we’ll add DonnystyleWi-Fi profile (WPA2PSK) to our OMA-URI policy. Hereby some imported pointers take into account!

  • There is an undocumented value which requires for the hex value of the Wi-Fi name. This value should be added before the SSID name (see example below). If this value is not configured, the Wi-Fi profile will function but Microsoft Intune will report this as an error (0x87D1FDE8) non-compliant.

clip_image003

  • The OMA-URI must contain the SSID of you Wi-Fi profile further the name used must match the SSID name
  • The pre-shared key value must be unencrypted value when configured in the Intune Management Portal
  • The OMA-URI value is case sensitive

OMA-URI

./Vendor/MSFT/WiFi/Profile/Donnystyle/WlanXml

Data Type

String XML

Value

<?xml version="1.0"?>

<WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">

               <name>Donnystyle</name>

               <SSIDConfig>

                              <SSID>

                                             <hex>446F6E6E797374796C65</hex>

                                             <name>Donnystyle</name>

                              </SSID>

               </SSIDConfig>

               <connectionType>ESS</connectionType>

               <connectionMode>auto</connectionMode>

               <MSM>

                              <security>

                                             <authEncryption>

                                                            <authentication>WPA2PSK</authentication>

                                                            <encryption>AES</encryption>

                                                            <useOneX>false</useOneX>

                                             </authEncryption>

                                             <sharedKey>

                                                            <keyType>passPhrase</keyType>

                                                            <protected>false</protected>

                                                            <keyMaterial>Welcome1234</keyMaterial>

                                             </sharedKey>

                              </security>

               </MSM>

</WLANProfile>

clip_image004

When complete you can add more settings configured by this OMO-URI policy. As mentioned before in this example we configure a Wi-Fi profile and previous configured settings to lock-down our Windows Phone devices.

clip_image005

When all settings are configured we’ll deploy the policy to a device group which our Windows Phone is member of.

clip_image007

When successfully deployed the OMA-URI Wi-Fi profile policy, the Donnystyle Wi-Fi profile is available now on the Windows Phone devices. Based on the configuration (connection mode) automatically a Wi-Fi connection is established. The Wi-Fi profile can’t be edited neither removed.

clip_image009 clip_image011 clip_image013

In this example we deployed a Wi-Fi profile based on WPA2PSK including the pre-shared key. This is just an example how powerful OMA-URI is and how it can be used to deploy Windows Phone settings that are not configurable with a Microsoft Intune policy. An overview of Wi-Fi profile samples for various wireless configurations can be found here. Further you can use your Windows 8.x device to easily retrieve your Wi-Fi profile(s) definition at C:\programdata\Microsoft\Wlansvc\Profiles\Interfaces. In that location should be the various Wi-Fi profiles the machine is aware of in XML format.

For completeness there’re several requirements of defining Wi-Fi profiles which are described in the Windows Phone 8.1 MDM Protocol guide (P.164). Further this guide provides an overview of all possible settings which can be configured by OMA-URI. Special thanks to Joel Stevens (MSFT) for figuring out this problem!

]]> Force a refresh of Microsoft Intune policies on iOS https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/force-a-refresh-of-microsoft-intune-policies-on-ios Fri, 12 Dec 2014 00:26:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2014/12/12/force-a-refresh-of-microsoft-intune-policies-on-ios/ When testing new policies or deploying applications it’s useful to force a policy refresh. In iOS you can force this when using the latest Company Portal.

Follow these easy steps:

  1. Open the Company Portal
  2. Select your device in use
  3. Hit the Sync button

Checkin

]]> Hotfix: Large URI request in Web Application Proxy on Windows Server 2012 R2 https://docs.microsoft.com/archive/blogs/tune_in_to_windows_intune/hotfix-large-uri-request-in-web-application-proxy-on-windows-server-2012-r2 Thu, 11 Dec 2014 00:25:00 GMT https://blogs.technet.microsoft.com/tune_in_to_windows_intune/2014/12/11/hotfix-large-uri-request-in-web-application-proxy-on-windows-server-2012-r2/ In one of the last postswe discussed the option to put a Web Application Proxy in the DMZ as a reverse proxy for NDES. You could request a hotfix via Microsoft Support in order to get this to work. The good news is that you no longer have to contact support, it’s available in the in the December Windows Update:

Large URI request in Web Application Proxy fails in Windows Server 2012 R2
http://support.microsoft.com/kb/3011135

Just install the latest Windows Update on your Windows Server 2012 R2 and you should be good to go:
December 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2
http://support.microsoft.com/kb/3013769

]]>