Out of Office Hours

Powered by
WordPress

  • Publish Certificate Services CRL and OCSP sites to the internet using Azure App Proxy

    I have set up a variety of test domains over the years, and inevitably I need to set up Active Directory Certificate Services (ADCS) on them because I need to issue certificates of some kind for some purpose (e.g. VPN, Wi-Fi access, Windows Hello for Business, etc. – see https://oofhours.com/2020/04/05/intune-certificates-something-everyone-should-set-up/ for details on how to…

  • Random news of the week: New white glove fix, updated Intune module

    In the category of “stuff probably not worth a separate blog” category, I’ll combine some notes together into a single post.  Let’s go through those one at a time. New white glove fix Windows Autopilot white glove scenarios have always supported the provisioning of all device-targeted apps, policies, certs, etc.  And if there is a…

  • Deploying Edge without a desktop shortcut, the easier (but not easiest) way

    As Per Larsen blogged this week, the recent Edge stable release now has a new MSI parameter to skip the desktop shortcut.  From the release notes: Added an MSI command line parameter that lets you suppress Desktop icon creation when you install Microsoft Edge. The following example shows how to use this new parameter:MicrosoftEdgeEnterpriseX64.msi DONOTCREATEDESKTOPSHORTCUT=trueThere…

  • Fun with Windows Autopilot Group Tags

    This one falls squarely in the “I can’t believe I’m doing another blob about group tags” category.  Past examples: Group tags with spaces? Fun with Azure AD dynamic groups Now you can edit group tags and computer names for Windows Autopilot devices Windows Autopilot Companion app updated to support editing the computer name and group…

  • Correlating Hyper-V VMs that are registered with Windows Autopilot

    Over time, I’ve created a whole bunch of VMs for testing Windows Autopilot.  They are named so that I can keep track of the Windows 10 build, the environment they are tied to, the scenario they are configured for, etc.  But overall, it is a still a bit of a mess – cleaning up that…

  • Another new Get-AutopilotESPStatus script posted

    Building on top of the script that I blogged about just over a month ago (time flies), I’ve now posted a new version.  A few changes this time around: Apparently the MSI product ID for the Intune Management Extensions changed, so I updated the script to know about the new ID.  (I hope it doesn’t…

  • Outlook and Azure AD Join: Automatically configuring the user’s mailbox

    In an average day, I provision a bunch of Windows 10 devices using Microsoft Intune and Windows Autopilot, including Office 365 ProPlus.  But somehow I never actually launched Outlook (or if I did, I didn’t pay attention to what I needed to do to configure it).  It’s not very pretty: What you really want to…

  • Intune + certificates: something everyone should set up

    If you are using Intune and haven’t yet set up a mechanism to deliver certificates to your MDM-managed devices, you should probably do so – at some point you’ll need to, and there’s no time like the present. If you are already using Active Directory Certificate Services (instructions for setting it up here), the Intune…

  • Group tags with spaces? Fun with Azure AD dynamic groups

    Many of you using Windows Autopilot have used Azure AD dynamic groups for various purposes, leveraging the Group Tag value that has been assigned to a device.  Somewhere along the line, people started using the -contains operator, described in the Azure AD docs, for doing that.  If you do that, it will work fine, at…

  • Include Microsoft Edge in your ESP blocking app list

    A quick note:  A few people noticed that you couldn’t select the new Microsoft Edge app types when selecting the list of blocking apps in an enrollment status page profile.  That’s been fixed, so you can now include Edge:

  • An experimental script to check out your Windows Autopilot devices

    I published a new script on the PowerShell Gallery called AutopilotDeviceSync.  This grabs a list of all your Windows Autopilot devices, Azure AD devices (including Hybrid Azure AD Join devices synced from your on-premises Active Directory), and Intune devices.  If you weren’t aware that every device existed in three or more places, let me explain…

  • Importing a device hash directly into Intune

    I resisted the urge to add a switch to the Get-WindowsAutopilotInfo script to add the device to Windows Autopilot using the Intune Graph API.  But since people were doing it anyway in worse ways (e.g. writing their own scripts and not leveraging the functionality that was already available, e.g. taking the CSV from Get-WindowsAutopilotInfo and…

  • Podcast episode #1: Windows Autopilot Hybrid Azure AD Join

    I admit it, I’ve been procrastinating. I’ve been carrying around podcasting equipment for months, intending to use it from hotel rooms around the world to create podcasts for those that prefer audio information over written text. Since traveling is no longer a near-term option, I decided it was time to turn my home office into…

  • More Autopilot ESP information

    I published a script last week that I talked about in a previous blog which would dump out information from the registry to tell you what happened during a Windows Autopilot deployment, as tracked by the enrollment status page.  You can read that post here. I’ve now published version 2.0 of that script which has…

  • p.s. A PowerShell conundrum

    In my previous post, I mentioned changing some PowerShell cmdlets.  Here’s the definition for the cmdlet used to create a new item: It’s simple enough:  You specify the required mode and display name, and one of several switches.  If specified, the setting is enabled; if left out, the setting is disabled.  Fairly standard stuff. But…

  • Updated WindowsAutopilotIntune module posted

    As I have been working my way through an e-mail backlog, I have been making adjustments to the WindowsAutopilotIntune module to address feedback and requests from those that contacted me.  The first request was to be able to get the same information as what you can see in the new Windows Autopilot deployment report (which…

  • What happened during Windows Autopilot ESP? Decode it.

    One of the challenges with Windows Autopilot that I’ve talked about at various events is troubleshooting – if everything goes well, you’re happy, but if something goes wrong, figuring out what that “something” was can be challenging.  That’s something that we’re working on improving for future Windows 10 releases, but until then I’ll keep blogging…

  • Deploying the new Microsoft Edge without a desktop shortcut

    UPDATE 2020/04/16: See my updated post for an easier way. Or more accurately, “a crash course into the inner workings of modern browser installers (which really aren’t that modern).”  I really don’t understand why software installers still create desktop shortcuts, especially when that desktop is being synced to the cloud using OneDrive.  But since I…

  • PowerShell on Windows 10 ARM64

    I wrote a blog post back in September that talked about Windows 10 running on ARM64.  In that, I talked a little about WOW64 on ARM64, which enables an ARM64 device to run 32-bit x86 apps, quite useful since many apps don’t yet have ARM64 versions available. But one twist I didn’t expect was with…

  • Configure language settings for any scenario

    You might have noticed that there are new properties available in Windows Autopilot user-driven scenarios, both for Azure AD Join: And for Hybrid Azure AD Join: But if you try it, you’ll find that they do nothing.  That’s because these new options require changes that are present in Windows 10 Insider Preview builds and will…