Month: July 2018
Resources for Windows Autopilot
Similar to last month’s post on resources for Windows Analytics, I’m often also asked for a collection of useful resources on Windows Autopilot. With that said, most of these are just cumulatively pulled from my monthly Windows 10 “news you can use”.
- Getting started with an overview of Windows Autopilot, a suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. With Windows AutoPilot, IT professionals can customize the Out of Box Experience (OOBE) for Windows 10 PCs and enable end users to take a brand-new Windows 10 device and—with just a few clicks—have a fully-configured device ready for business use. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Most importantly, users can go through the process independently, without making any decisions and without needing to involve IT.
- AutoPilot provisioning PowerShell script.
- Manage Windows device deployment with Windows Autopilot Deployment.
- Auto-logon for Autopilot
- Automatic enrollment.
- Bulk enrollments.
- Automatic enrollment.
- Enroll Windows devices using Windows AutoPilot Deployment Program.
- AutoPilot prerequisites.
- Techcommunity blog post which outlines the latest enhancements to Windows Autopilot in Windows 10, version 1803, specifically: Enrollment status, OEM and hardware vendor supply chain integration, BitLocker integration, automatic Windows Autopilot profile assignment, and device deletion with Microsoft Intune.
- Video to learn how to setup Windows Autopilot in just over 3-minutes.
- Microsoft Mechanics 8-minute video which explores the most recent updates to Windows Autopilot, which include a zero-touch experience for the deployment of new Windows 10 devices and device reset capabilities, all powered by Microsoft 365.
- Walkthrough for deploying a kiosk using Windows Autopilot.
- Architectural planning posters for Windows 10, including for clean install, in-place upgrades, AutoPilot, servicing, and protection solutions.
- Troubleshooting Windows AutoPilot (level 300/400).
- How to enable BitLocker Drive Encryption and automate the process for an AutoPilot device that is provisioned for a standard user using the Windows 10 Fall Creators Update version 1709. https://blogs.technet.microsoft.com/showmewindows/2018/01/18/how-to-enable-bitlocker-and-escrow-the-keys-to-azure-ad-when-using-autopilot-for-standard-users
- Microsoft 365 powered device lab kit features a fully-provisioned virtual lab environment with Windows 10 Fall Creators Update, Office 365, Enterprise Mobility + Security. Plus, 25 step-by-step lab guides covering Autopilot, Windows Defender Application Guard, Windows Hello, Windows Analytics, and more.
- Announcing new extensions to the Windows Autopilot zero-touch experience with several new capabilities available in preview with the Windows Insider Program today.
Other resources related to Windows Autopilot when using Microsoft Intune.
- Power and sleep settings modification (desktop only) – Prevents the end user from changing power and sleep settings on the device. Windows 10 and later device restriction settings in Microsoft Intune.
- Install types for Intune/MDM and App deployment
- Add apps for Windows PCs that run the Intune software client.
- Deploy apps with Microsoft Intune.
- Manage App Deployments in Intune.
- Add apps for Windows PCs that run the Intune software client.
- Application software install types (.exe, .msi, .appx, .appxbundle)
- Install the Intune software client on Windows PCs
- Remote TeamViewer in Intune.
Auto MDM Enroll: Failed (The system tried to delete the JOIN of a drive that is not joined.)
When setting up hybrid Azure AD join with on-premises Windows 10 environments, if you encounter the an error that “The system tried to delete the JOIN of a drive that is not joined.“, then there is a good chance that the device has not yet synchronized into Azure AD.
A few tips to help you isolate the cause and get past this issue:
- First, confirm the device exists in Azure Active Directory (or not). In the Azure portal, navigate to Azure Active Directory > Devices > All devices.
- Review the steps in Troubleshooting hybrid Azure Active Directory joined Windows 10 and Windows Server 2016 devices. Note that this article points back to another article on How to configure hybrid Azure Active Directory joined devices, which presently contains way more helpful information to help you troubleshoot.
- In the most current Azure AD Connect releases, use the built-in Troubleshooter. Then in the PowerShell windows which launches, use both options to troubleshooting options for Object Sync and Password Hash Sync.
In my case, the troubleshooting guides were useful to confirm that I had configured everything correctly. Then the Azure AD Connect troubleshooter reported an error that “Password Hash Synchronization cloud configuration is disabled”. Searching that issue on the Internet led me to discover that the cause was likely due to mismatched passwords between the Azure AD account “On-Premises Directory Synchronization Service Account” with the password currently set in the local synchronization service.
To fix that, first set a new password for the “On-Premises Directory Synchronization Service Account”. To do that, try setting it in Azure directly. However, given that it’s a special account, it may be necessary to reset the password through PowerShell with the MSOL cmdlets. While I’m not getting into the full end-to-end setup and use of those add-on Azure PowerShell cmdlets, the command could be as simple as:
Connect-AzureAD Set-AzureADUserPassword -ObjectId abc123def456xyz980 -Password MyP@ssw0rd! -ForceChangePasswordNextLogin $false
Next, start program Synchronization Service Manager, then click on Connectors. Locate the Windows Azure Active Directory Account and click Properties.
Finally, set the password. Voila, devices will now sync to Azure AD on the next synchronization!
Windows 10 News You Can Use – July 2018
|Windows 10 news you can use, July 2018 edition
Providing insights into Windows 10 deployment & management, security & compliance, and productivity. Also see other news related to Windows 10.
|Deployment & Management|
1) For build 17682 of the Windows 10 Insider Preview, RSAT is now available on demand! What does that mean? You no longer need to manually download RSAT every time you upgrade! http://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682
2) Techcommunity blog post which outlines the latest enhancements to Windows Autopilot in Windows 10, version 1803. Specifically: Enrollment status, OEM and hardware vendor supply chain integration, BitLocker integration, automatic Windows Autopilot profile assignment, and device deletion with Microsoft Intune. https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Autopilot-What-s-new-and-what-s-next/ba-p/201884
3) Microsoft Mechanics 8-minute video which explores the most recent updates to Windows Autopilot, which include a zero-touch experience for the deployment of new Windows 10 devices and device reset capabilities, all powered by Microsoft 365. https://www.youtube.com/watch?v=7t7xaV8sm50
4) Walkthrough for deploying a kiosk using Windows Autopilot. https://blogs.technet.microsoft.com/mniehaus/2018/06/07/deploying-a-kiosk-using-windows-autopilot
5) Announcing new extensions to the Windows Autopilot zero-touch experience with several new capabilities available in preview with the Windows Insider Program today.
6) Windows 10 Updates and Store GPO behavior with DualScan disabled and client managed by SCCM SUP/WSUS. https://blogs.technet.microsoft.com/swisspfe/2018/04/13/win10-updates-store-gpos-dualscandisabled-sup-wsus
7) New FastTrack benefit from Microsoft: Deployment support for Co-management on Windows 10 devices. We’d like to provide a few highlights on what you can expect. https://cloudblogs.microsoft.com/microsoftsecure/2018/06/18/new-fasttrack-benefit-deployment-support-for-co-management-on-windows-10-devices
8) Implementing the Right Inertia in your Windows 10 Deployment Process: measuring and managing risk effectively with systems designed for change management.
9) Two new policies added for Edge when doing MDM management of Windows 10 through Microsoft Intune: Path to favorites file and Changes to Favorites. https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#edge-browser
|Security & Compliance|
1) Virtualization-based security (VBS) memory enclaves: Data protection through isolation. The escalating sophistication of cyberattacks is marked by the increased use of kernel-level exploits that attempt to run malware with the highest privileges and evade security solutions and software sandboxes. Kernel exploits famously gave the WannaCry and Petya ransomware remote code execution capability, resulting in widescale global outbreaks. Windows 10 remained resilient to these attacks, with Microsoft constantly raising the bar in platform security to stay ahead of threat actors. Virtualization-based security (VBS) hardens Windows 10 against attacks by using the Windows hypervisor to create an environment that isolates a secure region of memory known as secure memory enclaves. https://cloudblogs.microsoft.com/microsoftsecure/2018/06/05/virtualization-based-security-vbs-memory-enclaves-data-protection-through-isolation
2) Machine learning is a key driver in the constant evolution of security technologies at Microsoft. Machine learning allows Microsoft 365 to scale next-gen protection capabilities and enhance cloud-based, real-time blocking of new and unknown threats. Social engineering gives cybercriminals a way to get into systems and slip through defenses. The hardening of Windows 10 and Windows 10 in S mode, the advancement of browser security in Microsoft Edge, and the integrated stack of endpoint protection platform (EPP) and endpoint detection and response (EDR) capabilities in Windows Defender Advanced Threat Protection (Windows Defender ATP) further raise the bar in security. https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering
3) What is new in Windows 10 1803 for the Privileged Access Workstation (PAW) solution.
4) Go beyond external defenses. Eradicate attacks faster when they get inside. Download the 5 risk points to avoid in enterprise security—crash course. You’ll see how solutions built in to an operating system can (a) Make user identities more secure to prevent malicious access to devices and systems, (b) Detect the hidden actions of attackers already inside your systems more quickly, and (c) Leverage the largest data sets that index billions of sources to alert you of attacks immediately. https://info.microsoft.com/5RiskPointsEbook.html
5) Zero Trust networks eliminate the concept of trust based on network location within a perimeter. Instead, Zero Trust architectures leverage device and user trust claims to gate access to organizational data and resources. Read more about building Zero Trust networks with Microsoft 365, based on Azure Active Directory, conditional access, Windows Defender Advanced Threat Protection, Windows Defender System Guard runtime attestation, and Microsoft Intune. https://cloudblogs.microsoft.com/microsoftsecure/2018/06/14/building-zero-trust-networks-with-microsoft-365
6) Announcing the pre-release (v0.9) of “AaronLocker:” robust and practical application whitelisting for Windows. AaronLocker is designed to make the creation and maintenance of robust, strict, AppLocker-based whitelisting rules as easy and practical as possible. The entire solution involves a small number of PowerShell scripts. You can easily customize rules for your specific requirements with simple text-file edits. AaronLocker includes scripts that document AppLocker policies and capture event data into Excel workbooks that facilitate analysis and policy maintenance. https://blogs.msdn.microsoft.com/aaron_margosis/2018/06/26/announcing-application-whitelisting-with-aaronlocker
1) Windows 10 Tip: How to start creating in Paint 3D. http://blogs.windows.com/windowsexperience/2018/06/04/windows-10-tip-how-to-start-creating-in-paint-3d
2) Windows 10 Tip: Go back and forth in time with Timeline, new in the Windows 10 April 2018 Update. http://blogs.windows.com/windowsexperience/2018/06/11/windows-10-tip-go-back-and-forth-in-time-with-timeline-new-in-the-windows-10-april-2018-update
3) Windows 10 Tip: How to start using Nearby Sharing with the Windows 10 April 2018 Update.
4) SwiftKey intelligence comes to the touch keyboard in Windows 10 Insider Build 17692.
5) Windows 10 Tip: Search, shop and learn through the photos you take with Visual Search.
|In other news related to Windows 10…|
- Public preview support for Windows 7 and Windows 8.1 with Windows Defender Advanced Threat Protection (WDATP).
- We live in a time of both great opportunity and great responsibility. Our children have access to more information, entertainment and more ways to connect than ever before, but with that comes plenty of new things that parents like you and I need to worry about and new ways to distract their attention. Today, we are excited to introduce new features that make it easier and safer for families to interact with technology and, each other, across devices and platforms. One feature announcement is with Microsoft Edge giving the ability to allow or block websites has always existed on your PCs….and now, we are extending this feature to you and your family’s Android devices. If you have set up a Microsoft family group, any websites you have already tagged as allowed or blocked for your kid(s) will carry the same settings as they try to access websites in Microsoft Edge on their Android devices. http://blogs.windows.com/windowsexperience/2018/05/31/microsoft-gives-parents-peace-of-mind-with-new-family-features-across-devices
- Getting the most value out of your security deployment. This blog is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 security solutions. In this series you’ll find context, answers, and guidance for deployment and driving adoption within your organization. In the last blog Now that you have a plan, it’s time to start deploying, we covered some of the tactical issues that you’ll want to consider planning your Microsoft 365 Security deployment. Now we’ll move to the third and final step of an effective planning process: Drive Value. https://cloudblogs.microsoft.com/microsoftsecure/2018/05/31/getting-the-most-value-out-of-your-security-deployment
- The Microsoft Cybersecurity Reference Architecture describes Microsoft’s cybersecurity capabilities and how they integrate with existing security architectures and capabilities. We recently updated this diagram and wanted to share a little bit about the changes and the document itself to help you better utilize it.
- Defining a crisp modern security strategy to support business success. A modern security agenda needs to define the purpose of the security team, its vision and mindset. It should also explain the high-level strategies it will employ, and how it will be organized, including the definition of priorities and deadlines and how the results will be measured. More detailed information regarding enabling and accelerating digital transformation is available in this whitepaper. It is designed to articulate what a modern security strategy can look like, and is useful for CISOs, CIOs, CDOs, and potentially board members who want to learn more about secure transformation and benchmark their own teams. https://cloudblogs.microsoft.com/microsoftsecure/2018/06/12/updating-your-cybersecurity-strategy-to-enable-and-accelerate-digital-transformation
- Artificial Intelligence (AI) continues to be a key area of investment for Microsoft, and we’re pleased to announce that for the first time we’ve leveraged AI at scale to greatly improve the quality and reliability of the Windows 10 April 2018 Update rollout. Our AI approach intelligently selects devices that our feedback data indicate would have a great update experience and offers the April 2018 Update to these devices first. As our rollout progresses, we continuously collect update experience data and retrain our models to learn which devices will have a positive update experience, and where we may need to wait until we have higher confidence in a great experience. Our overall rollout objective is for a safe and reliable update, which means we only go as fast as is safe. http://blogs.windows.com/windowsexperience/2018/06/14/ai-powers-windows-10-april-2018-update-rollout