Recap on a great Configuration Manager Community Event (#CMCE1710) in Zurich

Yesterday the CMCE1710 event took place in Zurich, hosted by Mirko. It was a great community event with huge community power and great technical content delivered by the EM&S MVPs Roger Zander, Ronny de Jong and Mirko Colemberg.

http://configmgr.ch/

Why I do the recap?

With this short blog post, I would like to call more attention on events like that! Specially for people in the Workplace Engineering and Office365 business. If you attend CMCE or other similar great Events, you will get a lot of information about new technologies, best practices. Having a chance to place your questions directly during the sessions to the experts about your current issues or opportunities. A similar Event in Switzerland is the Experts Live Café held in Bern.

What was the content?

First, the content was great! My first session attending, I gave Matrix42 another chance to satisfy me about their Enterprise Manager (EM). The EM is not a tool that replaces ConfigMgr, this was very important to David König – Chef Program Manager of the EM. The tool should help you to easy manage complicated tasks in ConfigMgr. Specially with Reports, Role Based Access and Rollout Plans. Matrix42 made a great effort with the new End-User Agent based on a Chrome Engine. This is how ConfigMgr should notify users in a modern way.

 

2017-10-19 10_26_19-IMG_20171018_085553.jpg ‎- Photos.gif


After a break, I was attending the Session from Ronny de Jong, MVP EM&S. As always, great content delivered here! Ronny was talking about all the possibilities of ConfigMgr and Cloud Services. ConfigMgr has currently nine direct connections to Azure based Applications. One topic he talked about, was the ConfigMgr Cloud Management Gateway(CMG). In my point of view, each customer with Mobile Users – doesn’t matter if they use a Laptop, Surface Book or Tablets – should use a Cloud Management Gateway. The Setup is much easier than the old way to get Internet based clients attached to your ConfigMgr Hierarchy. You don’t need any servers in your DMZ (you need an Azure Subscription instead) and the certificate handling is much more easier. If you not have looked at the CMG, do it now!

 

2017-10-19 10_18_34-IMG_20171018_101701.jpg ‎- Photos
Ronny in Action!

The whole afternoon was just great, with real stuff and information delivered by David James (Director of Engineering ConfigMgr Microsoft Redmond), also known on Twitter as @djammmer.

David presented his personal IT career during the last years, specially at Microsoft and how the product changed from SMS to ConfigMgr. A really great story with a lot of great people working on that product. He took questions by the beginning and answers directly during the whole afternoon. Some topics where Telemetry Data, Co-Management with Intune, a REST-API currently in TP, Cloud Management Gateway and Client Health.  I’m not able to cover everything here because this should be a short recap. But one of my favorite question from David to the audience was: “Do you think ConfigMgr is dead? Then raise your hand(s)”.  Not one hand was raised!


David explained how many times SCCM was declared as dead but the history says something different!

2017-10-19 10_17_08-IMG_20171018_133658.jpg ‎- Photos.gif
Full house at CMCE1710

For me, it was a great honor to meet David personally, the director of the tool I mostly have in front of me: System Center Configuration Manager #ConfigMgr #SCCM. Thanks for being here!

2017-10-19 10_10_12-IMG_20171018_162753.jpg ‎- Photos
From the right: Martin Wüthrich, itnetX – Jakob Filipovsky, itnetX, David James, Microsoft – Roger Zander, itnetX, Alain Schneiter, itnetX

Thanks to Mirko for the great Event!

 

 

 

Microsoft Intune: Enable remote control for Android Devices using the TeamViewer connector

Today I played around with my Android device and Intune using the remote control option in Intune. The initial reason was, that my sister was calling me yesterday to help her out with her new Huawei Android phone. She tried to configure her Office365 account and was not able to do so. Of course, I helped her, but using remote control on the phone would be much cooler :-).

So I logged in to the Azure Portal, went to “Intune” and under Devices I found the Option “Setup” TeamViewer Connector.

2017-09-03 13_31_21-Microsoft Edge

Before you can use TeamViewer to remote control your devices, you have to create an account or use an existing one to authorize Intune with TeamViewer. Go through the sign-in page from TeamViewer and authorize Intune. Make sure that the Connection Status in the portal is set to “Active”. 

Don’t miss the message in the connector:
“The TeamViewer service allows users of Intune-managed Android devices to get remote assistance from their IT administrator. Create TeamViewer sessions by first associating Intune with your TeamViewer account and then authorizing it to work with Intune. If you don’t yet have a TeamViewer account you will need to create one. “

After that, It would probably make sense to deploy the Andoird TeamVewer Quick Support app to all Android Devices from your Company. This can be done by creating an app in the portal an assign it to the devices. This is not covered in this blog post.

2017-09-03 13_47_12-Microsoft Edge

How can you now initiate a remote session?

On your Windows 10 Desktop machine download and install (or just run) the latest version of TeamViewer. In my case it is TV 12. After that, sign-in to the application with the user account you created earlier in the post:

2017-09-03 13_50_44-Microsoft Edge

Go to the Intune Portal, select the device you like to remote control, go to Overview and there on the upper right hand you will find the three-dot option “…More”. Select “New Remote Assistance Session”.

2017-09-03 13_54_56-Microsoft Edge

This will initiate a new session to your Android Device. Click “Yes”.

2017-09-03 13_59_51-Dashboard - Microsoft Azure and 5 more pages -[InPrivate] ‎- Microsoft Edge

The user will have to go to the Company Portal and accept the request. The request is displayed in the notifications area of the Company Portal App.

2017-09-03 14_02_18-s14-162-233 - TeamViewer

TeamViewer Desktop creates a new category for you called “Intune” with all your remote control requests out from Intune. Just double click the invitation you recieved and from there you’re able to remote control the users device.

2017-09-03 14_04_17-Computers & Contacts

Be aware that the user will need to accept and confirm the session again. Now you can remote Control the Android device out from your TeamViewer Software. Very cool.

2017-09-03 14_08_22-s14-162-233 - TeamViewer

A great and nice option which should be used for remote supporting your android devices!

 

Step-by-step configuring Enterprise State Roaming (ESR) with Azure AD Connect Password sync

During the last couple of month, we had a lot of discussions with our customers regarding the new modern way to roam user settings. I’m sure that you agree with me, that roaming profiles are a legacy way to do this.

Microsoft introduced Enterprise State Roaming a while ago. First a consumer version was available when Windows 8 was released. Microsoft accounts did roam user settings to the cloud. Settings like Wi-Fi Profiles, Internet Explorer Settings and Start menu configurations where roamed.

With ESR you can now roam settings to Azure in a professional enterprise way. Some prerequisites are necessary when you would use Domain Joined Devices to roaming user settings:

  • Licensing: Azure AD Premium Plan / or EM&S Licenses
  • Azure AD Connect latest version
  • Device Write back activated in Azure AD Connect
  • Password sync enabled in Azure AD Connect
  • ESR enabled on the Azure Tenant
  • Windows 10 Enterprise 1607 / Windows Server 2016
  • Domain Joined Devices

2017-02-07-08_04_21-s2021-dc

Let’s have a look at the implementation steps:

Step 1: Get Licenses

The first step is to activate a trial license of an Azure AD Premium plan. You can use an Azure AD P1 or P2 or even an EM&S. EM&S is not available for trial. For large enterprises contact your CSP to assign you some EM&S trial licenses to your tenant. Without an active plan, you won’t be able to enable ESR on Azure.

Step 2: Enable ESR on the Azure AD tenant

Go to your old Azure portal (manage.windowsazure.com) and login as a global admin. Under your directory select “CONFIGURE” and navigate to “devices”. “Enable the Users may sync settings and enterprise app data” option. You can select an Azure AD Group or allow ALL users to sync settings.
1-active-directory-microsoft-azure-and-4-more-pages-%e2%80%8e-microsoft-edge

Step 3: Configure your local AD

During the setup, you need to configure device write back in your On-Prem Active Directory. Use the PowerShell scripts bellow to enable device writeback:

Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory\Connect\AdPrep\AdSyncPrep.psm1"

$ aadAdminCred = Get-Credential

Initialize-ADSyncDomainJoinedComputerSync AdConnectorAccount [connector account name] -AzaadAdminCred;ureADCredentials $

When you run $aadAdminCred = Get-Credential, you are required to type a user name. For the user name, use the following format: user@example.com

When you run the Initialize-ADSyncDomainJoinedComputerSync cmdlet, replace [connector account name] with the domain account that’s used in the Active Directory connector account. This is based on the MS article here.

Step 4: Register your devices

I’m not covering the part when you use AD FS. This is a different way to do this and you will need to setup some clame rules on your AD FS Servers. Please follow the steps in the above link under step 3.

In a no federated scenario you need some requirement do have a device registered automatically:

  • You are either running Windows 10 and Windows Server 2016 on your device
  • Your devices are domain-joined
  • Password sync using Azure AD Connect is enabled

If all of these requirements are satisfied, you don’t have to do anything to get your devices registered.

Registerd devices appearing after that in you on-Prem AD under the root\RegisteredDevices. Make sure you have Device Wirteback enabled on your Azure AD Connect configuration.

2017-02-06-15_59_38-s2021-dc

Step 5: Create a Group Policy object to control the rollout of automatic registration

To control the rollout of automatic registration of domain-joined computers with Azure AD, you have to deploy the Register domain-joined computers as devices Group Policy to the computers you want to register.

GPO to enable: Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration. Right-click Register domain joined computers as devices and “Enable” the policy.

2017-02-06-16_05_30-s2021-dc

During a reboot or a user’s sign in to Windows the device will be registered to Azure and written back to the On-Prem Active directory. You will not be able to see the device name in the dsa.msc. For that launch the Active Directory Administrative Center where you have an additional row of the devices “Display name”.

2017-02-06-16_13_01-s2021-dc

Step 6: Usage

When a user now logs in to his domain joined (or Azure AD joined)  Windows 10 machine using his UPN, the user account is added to the users profile and visible under Settings – Accounts – Email & App accounts as a Work Account.

2017-02-06-16_20_05-hwa10001

The user sync setting is enabled by default and users can change this options. Under Settings – Accounts – Sync your settings you will also recognize that the users UPN is used to sync all the settings.

2017-02-07-07_51_20-hwa10001

Conclusion::

Try it out! You will recognize that settings are changed immediately. For example, change the wallpaper, the taskbar position or even Internet Explorer favorites. This is a great feature for roam user settings across enterprise devices. The next step will be to use conditional access for those users:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access

First look at the new #OneDrive Admin Center (Preview)

The new OneDrive Admin Center Preview  is now available since a few days. During the past it was just a pain in the a** for admins to manage the OneDrive for Business settings. This has pretty changed a with the new portal which is not yet GA.

If your tenant already has been upgraded then you will be able to access your portal with a Global Admin account using the URL https://admin.onedrive.com

Let’s have a look on the settings.

Home Tab
The home tabs shows just the welcome message.

2017-01-09-11_38_02-onedrive-for-business-admin-preview-internet-explorer

Sharing Tab
On the sharing tab you find all the settings for sharing files outside of your organization. Let them share files outside the company using OneDrive or SharePoint, setting up sharing links, anonymous accces, limiting sharing to a sepzific domainand also what external users can do.

onedrive-for-business-admin-preview-sharing

Sync
The sync tab allows the admin to have control over the syncing settings. Also you have a link for downloading always the latest and newest OneDrive Client and another link to the support.office.com website to see the latest syncing issues.

Following options can be configured:

  • let users install the sync client from the OneDrive website
  • Allow syncing onlx PCs joined to specific domain
    • Enter a GUID for your domain(s)
  • Block syncing of specific file types
    • Enter file extentions you don’t want. For example mp3

onedrive-for-business-admin-preview-sync

Storage
Use the storage tab to configure the limits of the users storage. Default OneDrive value is 1024 MB. In here you can also set the retention time for accounts that have been marked as deleted.

Device Access
These settings applies to OneDrive an SharePoint.

  • Control Access based on a network location
    • Enter here your IP addresses or ranges for access to OneDrive. IPv4 & IPv6 is supported.
  • Mobile Application Management trough Intune is supported. You need an Intune license to use this option.

onedrive-for-business-admin-preview-intune

After assigning an Intune license to your GA Account you will be able to modify the settings for device management. This is an disadvantage in my point of view. It should be possible to change settings as admin without having any licenses applied.

Compliance
A few regulatory, legal and technical standards for OneDrive can be set here. This part helps to protect your data and preform security standard settings.

  • Auditing
    • View users activities related to OneDrive – deleted, shared, moved files
    • DLP – Data loss prevention, protect your organizations sensitive data
    • Configure retention policies
    • eDiscovery for emails, documents an Skype for Business conversations
    • Alerting, user and admin logs will be created

Note also the title of the page which gives you a hint to the Security and Compliance Center of Office 365.

I’m pretty sure that the new portal will be integrated into the Office 365 Admin Center. Until then, the admin portal is a good way to manage your OneDrive settings. Try it out today.