Category Archives: EMS

EMS, Intune, Powershell

Mapping legacy server shares in your Windows 10 MDM Intune pilot

6 Comments

In a Windows 10 full MDM (AzureAD+Intune) scenario, you’ll move your email, app and file workloads to Office 365 (or alternatives).

In your pilot or hybrid phase, you may still need access to certain file shares on your servers, so here’s a simple PowerShell script you can deploy using Intune Device Configuration that maps your desired share. Deploy multiple times for multiple shares (or groups of users).

It will create a shortcut in a location you define, so the mapping is always user-driven, it will automatically suggest your user’s AzureAD login as username. You can of course customize the script to your liking if you did not change your local AD upn yet.

Gitlab home: https://gitlab.com/Lieben/assortedFunctions/blob/master/intuneServerShareMapper.ps1

Requirements:

  • Windows 10 (MDM)
  • Intune
  • Direct SMB lan connection to share
EMS, Intune, OneDrive for Business, Powershell

Onedrive For Business Silent Deployment, Configuration and Folder Redirection through Intune MDM for Windows 10

20 Comments

I’ve taken information from several sources and written a single “Do It All – Onedrive For Business configuration script” for the Windows 10 Modern Management (Intune MDM Azure AD Join) scenario.

The script can be deployed through Intune to your Windows 10 MDM clients and will do the following silently:

    • check latest O4B version and update to it
    • detect O4B configuration, start auto config
    • completely silent / invisible configuration with SSO
    • optionally, enable Files On Demand
    • optionally, redirect folders to Onedrive
    • optionally, copy old content

O4BClientAutoConfig + source code.

 

Automation, EMS, Intune, Powershell, Security

Automatically bitlocker Windows 10 MDM Intune Azure AD Joined devices

13 Comments

I recently ran into an article by Pieter Wigleven, based on an original idea of Jan Van Meirvenne that I simply have to share, and expand upon.

When you go cloud first, and do light MDM management of your Azure AD Joined Windows 10 devices, you will likely enable a Bitlocker policy in Intune. What you’ll quickly discover, is that your policy will not automatically enforce/enable Bitlocker on non-InstantGo capable devices.

So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.

Powershell source file

enableBitlockerAndRegisterInAAD_v0.04.ps1 (right click, save as)

MSI file

enableBitlockerAndRegisterInAAd_v0.04.msi (right click, save as)

As Intune won’t let you deploy a Powershell script, I’ve also wrapped the script in an MSI file with Advanced Installer for you. What this will do;

  1. Deploy the PS1 file to the machine
  2. Register a scheduled task to run this PS1 file at logon each time
  3. Kick off the scheduled task once so a first reboot isn’t required

Advanced installer package (.aip)

enableBitlockerAndRegisterInAAD.zip (right click, save as)

Requirements

  1. Windows 10, AzureAD Joined
  2. TPM chip
  3. User should be local admin
EMS, Intune, OneDrive for Business, Powershell

Deploying the new Onedrive Next Generation Sync client as MSI through Intune to Windows 10

6 Comments

Onedrive for Business’s client, the new Next Generation Sync client, is awesome. Obviously.

So you want it on your devices, but Microsoft distributes it as .exe. Nasty, because I want to manage Windows 10 as mobile devices through Intune, and that only allowes me to distribute as MSI.

I created an MSI for Onedrive for Business’s Next Generation Client using Advanced Installer. Because I’m not allowed to redistribute Microsoft’s .exe, this MSI downloads the .exe from Microsoft’s website, it uses /silent and /takeover as installation switches. Continue reading Deploying the new Onedrive Next Generation Sync client as MSI through Intune to Windows 10 →

EMS

Enterprise Mobility Technical Checklist

2 Comments

Considering to move to an Anywhere, Anyplace, Anytime lightweight IT environment? Throwing out all local IT?

No more Domain Services, just AzureAD? Windows10, or any other mobile modern client? Here’s a short checklist I sometimes use for clients when assessing their intentions / plan:

  • Intune tenant created and policies have been set, including Conditional Access
  • All my non single MSI applications I want to deploy to my clients have been repackaged
  • All my application servers/services have been moved to SaaS or to RemoteApp or the like
  • My identities have been synchronized or copied to Azure AD
  • All users have an Intune or EMS license
  • I have enabled Azure AD automatic MDM enrollment
  • I have enabled Enterprise State Roaming in Azure AD
  • I have published my internal web sites using Azure Application Proxy and added these sites to Intune as Apps
  • DLP policies have been setup for any sensitive data types/locations in my company
  • Personal data has been migrated to Onedrive for Business
  • Group data has been moved to Office 365 Groups or Sharepoint Online

Just to get you started! 🙂

EMS

Let us extend Intune MDM msi enrollment!

Leave a comment

So, a while back Intune got the ability to deploy native MSI’s to MDM enrolled Windows 8.1 and Windows 10 clients. No Intune client is required, which gives a really awesome out of the box experience.

However, we can only deploy single MSI’s, and we can’t patch them with MSP’s, or deploy installers that are only available as .exe.

To spare us having to repackage them, please vote on my uservoice idea to extend MDM enrollment in Intune.

EMS, Office 365

Is Enterprise Mobility (EMS) and Windows 10 by Microsoft going to make you happy?

Leave a comment

Carrying_Can_Enterprise_MobYou may have been reading up on the Enterprise Mobility Suite by Microsoft. Especially now that Windows 10 has been released, it seems like everything is becoming easier and simpler for end users, managers and admins alike while Microsoft is really pushing the Anywhere, Anyplace, Anytime concept.

Let me state first off that I believe these advancements are incredible, and I really feel Microsoft is heading in the right direction, but there are quite a few ‘gotcha’s’ that you probably don’t know about that could hurt your implementation, they may not always apply to you.

In my opinion, as EMS currently stands as a suite, when used to manage Windows 10 laptops / tablets and desktops, is only suitable for very ‘light’ management situations unless there is an additional device management authority such as SCCM fully configured and implemented as Internet Facing for true device and application management.

The Enterprise Mobility Suite as a standalone product for full Windows 10 is NOT suitable for almost all Application Deployment scenario’s.
Continue reading Is Enterprise Mobility (EMS) and Windows 10 by Microsoft going to make you happy? →