Out of Office Hours

Powered by
WordPress

  • What does an enterprise Windows 10 device look like?

    I always get into this “philosophical” debate with IT pros:  When buying new Windows 10 devices, what kind of configuration is recommended?  It’s certainly not “buy the cheapest possible PC you can find” because there are still some truly awful PC devices sold.  To be clear, I’m not saying they are awful from a quality…

  • UUP is (still) coming soon, and dynamic update is (still) important

    How many of you remember the Unified Update Platform, a.k.a. UUP, being announced in 2016?  Let me remind you: And there was another update in 2017: There was some documentation published in 2018: https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-overview And another blog in 2018: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Language-pack-acquisition-and-retention-for-enterprise-devices/ba-p/275404 And it was talked about at Ignite 2018: There’s a slide in that video that…

  • Join me for a Q&A session

    One of the things that I’ve wanted to do for a while is to have an open Q&A call – you know, the typical “office hours” concept from your college days, where someone says they’ll be available during certain times for any questions you might have.  In my case, I’m not an instructor, and true…

  • Configuring the Intune Connector for AD to use a proxy server

    As I discussed previously, proxy servers are a pain.  I wish they could be wiped from the face of the earth.  But since that’s about as likely as everyone being off of Windows 7 by January 14, 2020 (didn’t you people learn from Windows XP?), we have to deal with them. If you are setting…

  • Trying out Windows Autopilot with Windows 10 1903? Install the latest update.

    As you kick the tires on Windows Autopilot scenarios (whether new scenarios like white glove or existing ones), make sure you’ve installed a recent cumulative update and aren’t using just the original unpatched Windows 10 1903 media.  These updates do fix known issues, and will reduce your overall frustration when trying things out. Today’s update,…

  • Want to watch the MDM client activity in real time?

    In the past, you could use the Microsoft Network Monitor to capture network traces, showing the gory details of all the network traffic to and from the machine.  That utility morphed into the Microsoft Message Analyzer, and while it’s now too hard to use for simple network traces (I suggest WireShark instead), it did pick…

  • Windows Autopilot and the joy of networking

    One of the biggest challenges that we run into with customers who want to adopt Windows Autopilot for deploying new devices is the variety of network setups.  This can be broken down into a few high-level categories: Challenges for devices that need to make an initial connection to the corporate network, due to network security…

  • Have you implemented “hybrid”?

    I’ve had lots of conversations with customers about Hybrid Azure AD Join, as it’s used as part of a key Windows Autopilot scenario.  But it seems this leads to a bunch of odd conversations because people hear the word “hybrid” and their minds go in different directions.  Here’s some examples: Q: Have you tried Hybrid…

  • Inside Windows Autopilot user-driven Hybrid Azure AD Join

    I already talked about user-driven mode with Azure AD Join – that’s the easiest scenario.  Now let’s talk about user-driven mode with Hybrid Azure AD Join.  For those who have no idea what Hybrid Azure AD Join means, let’s start with a simple explanation:  Hybrid Azure AD Join devices are joined to Active Directory and…

  • Using MFA with Azure AD Join

    Here’s an easy one to try.  In Azure AD, you can enable an option to require MFA before a user can join a device to Azure AD: When not using ADFS or an external federation provider (the Azure AD team now recommends passthrough or password hash authentication), turning that to “Yes” will result in an…

  • Options for Terms of Use

    Some organizations want to display a “terms of use” page to users when the join or enroll in the organization.  (Personally, I think this is a bit silly, but if it makes the lawyers happy…)  I always knew that could be enabled in Intune: with some simple text fields that can be displayed to the…

  • CSP partners: Add devices to Windows Autopilot using Partner Center and PowerShell

    I’ve given presentations at a variety of events that included this slide, talking about the different mechanisms that are available for registering devices with Windows Autopilot: For customers, you can register devices using the serial number and hardware hash via Intune.  I published a blog last year that showed how to automate that using PowerShell…

  • Automatically setting up OneDrive for Business via Intune

    The OneDrive for Business team has made a number of changes to support automatic configuration of OneDrive, including support for automatically signing in, configuring known folder migration, enabling offline files, and more.  But since the OneDrive client is configured via GPO and not MDM policies, that meant using some rather nasty-looking custom OMA-URI policies in…

  • Inside Windows Autopilot user-driven mode with Azure AD join

    We’ve already talked about device registration and the initial Windows Autopilot profile download.  That’s all prep work for the “real” provisioning process performed by Windows Autopilot.  Now let’s look at the provisioning process itself, starting from where those other blogs left off: If the Windows Autopilot profile specified a naming template, the name will be…

  • TPM Attestation: What can possibly go wrong?

    First off, it would be good to touch on what TPM attestation is, and then talk about why you care.  From some older Windows Server documentation, here’s a decent overview: With TPM key attestation, a new management paradigm is now possible: An administrator can define the set of devices that users can use to access…

  • What happens when a Windows Autopilot-registered device starts up?

    The last time, I talked about the device registration process – preparing for deploying a device using Windows Autopilot.  This time, I want to switch to the device itself and explore what happens when a Windows Autopilot-registered device starts up into the out-of-box experience (OOBE) and is connected to a network. Using a trusty network…

  • Self-serving post: Follow my blog from Outlook

    If you are like me, you live and breathe through Outlook – it’s the center of my work world, enabling me to rapidly sift through obscene amounts of e-mail effectively.  (You might disagree if you are one of the people who has e-mailed me and awaited a reply – my general rule is that if…

  • Which Intune portal do you use?

    Update 2020/07/08: The https://devicemanagement.microsoft.com portal should now be accessed via https://endpoint.microsoft.com. This site is identical to the previous one, just with a new URL. That might seem like an odd question, but there are actually multiple portals that you can use to manage Intune.  As I’ve worked with customers who are implementing Intune, it seems…

  • What happens when you register a device with Windows Autopilot?

    Let’s assume that you are registering a new VM, or some existing device that you want to use for validating Windows Autopilot.  (New devices should be registered by the OEM, distributor, or reseller that you buy the device from – more on that later.)  In that scenario, you need to start off with the hardware…

  • Disk Deduplication: A great feature for lab environments

    I have a reasonably powerful workstation that I’ve been using for testing and validation for many years, an HP z800 Workstation with 8 CPU cores, 96GB of RAM, and 4TB of disk space.  On that server, I have 55 VMs at the moment, including multiple ConfigMgr environments, MDT servers, Active Directory, proxy and VPN servers,…