Windows Intune v5 implementation experiences

Last week I did a proof of concept on Windows Intune v5 (5.0.2000.0) at customer location. During implementation I did the following experiences on functionality. Pity that Intune still is missing enterprise-ready functionality, but that will be better end of year. Have a look at the Intune roadmap for that. Let's have a look at the implementation experiences. It's not all bad :)
 

• Enrollment and retirement on Windows, Windows Phone, iOS and Android all goes fine (almost realtime), but sometimes retirement takes a lot of time. Microsoft is working on that to make it quicker. It can take up to 24 hours or 30 days total at the moment.
• When you want to have remote wipe functionality on notebooks (or tablets with Windows on it), just make usage of Windows 8.1. That way don't install the Intune agent, but enroll it as a mobile device. Very nice you can have remote wipe on notebooks either!
• When using Active Directory Federation Services (ADFS) there's single sign-on in place. Without ADFS you must fill-in account details every x minutes all over again. Really annoying if you ask me. Maybe DirSync will be a solution for this also. Does anyone know?
• Policies cannot be enforced from the Intune console. Sometimes it can take a while before the policy will be applied, even when you want a remote wipe on the device. Hope there will be a force button in a later release. When synchronize from the mobile device, policy is refreshed immediately. Strange, because you want to force a full wipe quick if your device is missing or stolen.
• Application blacklisting/whitelisting isn't available yet. You can set a deny on the app store (iOS 6+, Windows Phone 8.1) but there's no option to decide which apps may (not) be installed. This is on the roadmap for Q4 this year. Should be great if you can publish apps and app-links, without the need/permission to use the app store.
• Applications can be deployed optional only for users, no way to enforce the deployment. When IT support want to pre-config devices, you want bulk-enrollment for apps and policies, without to fill-in credentials on the app store (Microsoft, Apple, Google). This is on the roadmap for Q4 this year either. Fingers crossed :)
• The user stays in control of the device, and has the possibility to remove the Intune agent also. That way you're not in control of all devices anymore. Should be better if you can deny this I think? It depends if devices are personally or company owned. It would be great if you get an alert on this, that way you know if devices are missing.

 
I still think Windows Intune is (too) light in functionality, when Intune must be the successor of ConfigMgr, there's missing a lot. But..

Later this year there will be bulk enrollment, application blacklisting/ whitelisting, remote lock, secure mail, secure browser, Exchange and OneDrive for business, managed Office apps, app wrapper for iOS and Android, and multiple secure viewers.

Given the fact that the ConfigMgr team is same as the Intune team (and most resources are on Intune, because Microsoft still has a lot of catching up to do, and ConfigMgr is in a finished, almost perfect state), there will fast development on Intune for the next months.

Let's say it again: The future looks bright for Windows Intune!

Using the SQL 2012 dashboard within Operations Manager 2012 R2

Within System Center Operations Manager (OpsMgr) 2012 R2 you can use the new great SQL 2012 dashboard. The dashboard can be used for SQL 2012 only however. Let's have a look.
 
The System Center Management Pack for SQL Server can be found here: Download Center. The Management Pack for SQL Server provides the capabilities for Operations Manager 2007 R2 and Operations Manager 2012 to discover and monitor SQL Server 2005, 2008, 2008 R2, 2012 and their components such as SQL instances, databases, and SQL Server agents.
 
When installing the Management pack from the online catalog, you will not found the SQL 2012 dashboard at all. That's why you need to download it from Download Center. The Management packs you need to import are:
-Microsoft SystemCenter Visualization Component Extensions Library
-Microsoft SQLServer Presentation
 
After this you will find the SQL 2012 dashboard in the Microsoft SQL server, Databases, SQL Server 2012 Databases Summary Dashboard. Remember that only SQL 2012 databases will be showed in the dashboard. One of the new features is the widget that will show the related health state color. With that you have a quick overview of the selected SQL 2012 database.

 

After installation I did not see any health state at all however. That's because the monitors, which are needed for that, are disabled by default. To override these monitors go to Authoring Pane, Management Pack, Monitors. Now paste the monitor “Transaction Log Free Space” into the search bar and select the monitor in the "SQL 2012 DB management pack". You can now enable this monitor when right click and select override “For all object of the class: SQL 2012 DB” and choose enable with the check box.
 
In the override column change false to true and save this setting in a "Overrides SQL server Management pack". Do this for all changes needed in OpsMgr by default! The following four Monitors which must be enabled for the dashboard are:
-Transaction Log Free Space (%)
-DB Total Space
-Disk Read Latency
-Disk Write Latency

After configuration I still did not see any health state at all. Bummer! That's because security is not in place by default too. When SQL 2012 is installed by default - we no longer place BUILTIN\Administrators in the security access list, AND we restrict NT AUTHORITY\SYSTEM to “public” access. Therefore a RunAs account is needed for communication now. This RunAs account will be granted Local Admin over the OS and SA (SysAdmin) rights to SQL. After that you will see the widget that will show the related health state color.

Just a beautiful dashboard isn't it!?

Sources:
System Center Dynamics by wwwally
Microsoft TechNet Forums
Kevin Holman's System Center Blog

Update: Albert Neef mentions MSDN Blogs to manage SQL 2008 databases within the dashboard as well. Very nice indeed!

New features in Windows Intune coming soon..

A few months ago the Windows Intune roadmap was published during a Partner Session in February. There were some very interesting features announced, which will make Windows Intune way more advanced then in earlier versions. Because I'm doing a lot of implementation next coming months, it would be great when features are coming in soon. Let's have a look which features are announced during MS TechEd NA 2014.

As a cloud service, Windows Intune is updated on a regular basis, roughly every quarter. We’re currently rolling out an update to the Windows Intune service which provides support for Windows Phone 8.1 and Samsung KNOX Standard (formerly Samsung SAFE) support. In Q3, we will add support for Windows 8.1 Update settings specific to “family safety” which are useful for education environments. 

In Q4, we’ll be releasing major new functionality specifically focused on managed mobile productivity (managed applications and data protection) and IT enhancements, including bulk enrollment and support for Apple Configurator.

Intune will support the ability to bulk enroll iOS and Android (no Windows Phone?) devices, and use a single Intune service account to enroll the devices instead of having separate IDs for each device, since they are not associated with a user each. For iOS, Intune will support Apple’s Device Enrollment Program to do this bulk enrollment.

 

Intune will also support the ability to configure iOS devices using the Apple Configurator tool, allowing more granular and enforced “lock down” policies through the iOS Supervisor mode. This is especially useful in education scenarios where the student should not be able to un-enroll the device or when more stringent management is required (sounds good!). Additional settings include the ability to allow or block a specific set of applications and URL addresses.

Microsoft’s approach is more natural – build manageability and data protection into the apps which people choose to use, and extend that capability for enterprises to use with their own apps. To do this, we will deliver a unique container solution that is different from the traditional containers offered by other mobile device management solutions on the market.

The future looks bright for Windows Intune!
Source: Windows Intune Team

New Jalasoft SNMP device simulator v5 released

Sponsor post
 
During Microsoft TechEd North America in Houston, Jalasoft released the New SNMP device simulator v5. If you are joining TechEd this week, just visit their booth (#1440) and get 30-50% discount in your next purchase. Don't miss that one!
 

 
If you have to test your network or the SNMP tools you use to run it, you know that having the right devices at the right time is harder than the actual testing. Is your network heavily secured or too isolated for testing? Do you need to test a specific device for real world activity? Do you need a test lab with 1000 or more devices? No problem. We have your solution. Jalasoft’s SNMP Device Simulator V5, removes these challenges and gives you the power to dynamically simulate any SNMP device you need. Fast. Efficient. Easy.

Do you need to create a virtual network for yesterday? The SNMP Device simulator has you covered! The easy to use installation wizard and interface let you bring a simulated device online in under 5 minutes. Choose the device that you want to create, select the data your want to simulate, give it an IP address and press play. Changes in V5 allow you to run more than 1,000 simulated devices at one time from a single machine. Need more devices? Need to put a firewall between devices? Deploy the SNMP Device Simulator agents on different computers and manage them through a single console.

Simulate any network device through the Device Recorder feature
Ideal for testing with network devices that you don’t have in your test lab, the Device Recorder lets you mimic the behavior of any real SNMP device. Use the new Device Recorder feature to capture real world data and simulate the selected behavior as many times as needed, without putting your production network at risk.
 
Dynamic Simulation
The SNMP Device simulator grants users the option to perform a dynamic simulation or a normal simulation (the most basic type). The simulator uses a variety of formulas and statistical operations to generate dynamic values on the selected virtual devices, resulting in more realistic behavior. These values are also recorded on log files so they can be used later in the historical simulation mode.

Historical Simulation
Use the logs generated in a dynamic simulation to reproduce a precise behavior during a specific timeframe. With the Historical Simulation feature you can reproduce identical scenarios over and over again to changes to your tools, monitoring software or network configuration. This feature is ideal for tests that depend on identical data in changing environments.

IP Address Manager
This feature is a time saver that you’ll love! Imagine that you need to simulate 100 devices. With the IP Address Manager you no longer have to worry about manually creating IP addresses for all these devices. Instead, create individual IP addresses or a range directly from the simulator’s console, and apply them to the devices that you need to simulate.

Generate simulated devices from scripts You can access almost all V5 features without ever opening the console. This includes creating a new simulated device, loading recorded data to a device and stopping/starting device simulations. Save valuable time through automation and scripts!

Save simulation configurations
Need to create a simulation for your network switches? They are all the same model, but the ones in R&D are configured differently from the ones in Accounting. No problem. Using our templates as a base, load the base data, make the changes needed to match your environment and then same the custom configuration with one for “Switch – R&S” and one for “Switch – Accounting”. With the Save Configuration features, you customizations are waiting for you the next time you do a test or an audit.

For more information click here (PDF): Jalasoft
Xian SNMP Device Simulator: Download for free today

Direct management of Android devices in Windows Intune

Within Windows Intune it's possible to manage (mobile) devices. Because an agent is installed, we can use Direct management instead of Exchange ActiveSync (EAS), which is limited. When Windows Intune v5.0 was released, it was needed to have ConfigMgr 2012 R2 integration configured. Otherwise new functionality (selective wipe, Android support, advanced policies) were not available. With the latest update however these are within Intune standalone now also. Let's have a look how to enroll an Android device (for example).

In this situation I'm using a HP SlateBook 10 x2 PC with Android 4.2 installed on it. Just browse in Google Play and search for "Windows Intune". When installed credentials must be given. Just logon with your Intune credentials (which are [user]@[domain].onmicrosoft.com) and enrollment is done already. When applications and/or policies are deployed, they will be activated within 5 minutes. Same for properties on the device in Admin console. Just give it a minute :-)

Policy is not applied as expected

Pros:
- It's really easy setup, especially on Android devices. No certificates needed at all.
- Enrollment of devices is almost real-time. Retirement is done within approximately 15 minutes.
- APK files can be downloaded for free, without the need to register them or install a certificate.
- Remote Lock and/or Passcode Reset, which are added in the last update.

Cons:
- Retirement is done within 24 hours max. That will be way faster in a later update.
- Every [?] minutes you must fill-in credentials again on Intune console and Company portal.
- Focus is on Microsoft and iOS, not that much on Android. Almost no settings available.
- When retire the device, apps and data remain installed which were installed by Intune before.

No Required install because greyed out

When deploying apps you can choose for a Available install only. No Required install or Uninstall can be choosen. Maybe the're for Windows Operating Systems only!? Pity that this isn't possible.

Next time I will use my iPad for enrollment. Hope that will give me more control on the device.. On Android I can enable passwords, encryption and disable the camera. That's all? Yes for now..

The Windows Intune roadmap 2014 can be found HERE.

Whiteboard Fridays: Disaster Recovery Wars

Sponsor post

A long time ago in a galaxy far, far away...
It is a period of data recovery wars. Join us in May for three episodes of epic Whiteboard Fridays: Recovery Wars saga and become true Virtualization Jedi!

Master your skills during these episodes:
- May 13. Episode IV - A New Host: learn how to prepare for disaster, document your environment, ensure your backups and configure backup
- May 20. Episode V - The Admin Strikes Back: be prepared for recover process of the datacenter and primary VM’s, learn how to rebuild your environment effectively
- May 27. Episode VI - Return of the Admin: deep dive into restoring services, best practices around restores, focus on the getting services up and running for the end-users.
 
Register for a chance to win new Google Glass! Also, we’ll be giving away 15 pizza coupons at every show!

Register now

The World’s Premier Data Center Availability Event

Sponsor post

 

Veeam is launching the World’s Premiere Data Protection Conference with the chance to dive deep into valuable data protection techniques and solutions. There's no better place and time to connect with the Veeam community, meet friends, establish new relationships and build buzz!

Join us at VeeamON 2014 to discover a new level of availability for your Modern Data Center. Pre-register today to qualify for introductory pricing. VeeamON 2014 is scheduled on October 6-9 2014.

Pre-register

Install and update Endpoint Protection (SCEP) during a task sequence

In my daily job I'm doing a lot ConfigMgr and SCEP implementations. Sometimes Endpoint Protection (SCEP) is installed for antivirus and antimalware usage. During installation the SCEP client can be installed and an export of the SCEP policy can be applied. After the task sequence is done the SCEP client still needs to be updated however. This can be done during the task sequence also. Let's have a look.
 
The SCEP client can be installed with a ConfigMgr package. Just use a program like this: "SCEPInstall.exe /policy <policy>.xml". More about that can be found here: css-security.com
 
The SCEP definitions can be updated during a task sequence also. That way new definitions can be installed during OS deployment. More about that can be found here: chrisnackers.com
 
When using the SCEP definitions a VBS script is used, which downloads new MPAM and NIS definitions each day. When using a scheduled task this will be done automatically. The SCEP definitions package can be synchronized on the ConfigMgr Distribution point daily within package properties. This is needed to deploy the package with the new content downloaded. No SCEP installation with old definitions anymore :)

Download: EP_Definitions.vbs 
The definitions updates can be found on the following location:
-Endpoint Protection antimalware definition update (x86)
-Endpoint Protection antimalware definition update (x64)
-Network Inspection System definition updates (x86)
-Network Inspection System definition updates (x64)

Just use above configuration to automate installation and daily SCEP definitions, so a up-to-date SCEP client will be installed always.

Just great, isn't it!?

The future of ConfigMgr is uncertain for sure!

You all heard the news, Wally Mead, the foremost authority on System Center Configuration Manager (SMS/SCCM/ConfigMgr) and a leading figure within the community, will leave after spending over 22 years with Microsoft. Because of that it's almost like ConfigMgr died too! This emphasizes how Microsoft is changing. ConfigMgr is strictly an on-premises technology and Microsoft is moving us all to the Cloud.
 

 

So after killing Microsoft Management Summit (MMS), this seems to be the next step for Microsoft. Let's have a look at the changes coming. It all has to do with Mobile First/Cloud First vision.
 
Starting this year we are merging MMS with TechEd
Over the past 11 years, the Microsoft Management Summit (MMS) has grown from a small user group event focused on systems management and managing PCs, to a large and passionate gathering of the world’s best and brightest IT Pros. Now it’s time to look ahead to the next step for our industry and this community. Starting this year we are merging MMS with TechEd.. (and so it will be)
 
After merging MMS with TechEd rumours say 2014 could be the last year Microsoft holds a TechEd event.
 
No MS TechEd next year anymore?
If the rumors are right, this year's TechEd may be the last. The content at TechEd North America this year also is expected to include some management-specifc tracks, as the Microsoft Management Summit (MMS) is now being folded into this show. (If MMS content is available on TechEd Europe too is not sure)
 

During the TechEd 2014 Keynote Sneak Peek the message was clear for all IT Pros: Go Cloud or go home.
 
TechEd 2014 Keynote Sneak Peek
Intune is ConfigMgr delivered from the cloud. Last Fall we created a strong connection between both of them for use in a hybrid cloud model. Today there are more than 10k customers using Intune to manage their PCs and devices. The choice is yours: Do you want to manage on-prem or from the cloud -- we give you the option to do either. (For how long it takes)
 
Given the fact that the ConfigMgr team is same as the Intune team (and most resources are on Intune, because Microsoft still has a lot of catching up to do, and ConfigMgr is in a finished, almost perfect state), there will be less development on ConfigMgr for the next years. You can see this in the Windows Intune Roadmap also. Focus is on Windows Intune as a cloud solution, not providing functionality which need ConfigMgr integration anymore. (Richer cloud-only MDM capabilities, Full MDM parity in Windows Intune standalone)
 
And also: With the added development focus (at the expense of ConfigMgr), it won't be long before Windows Intune is an exact match, further blurring the lines of how endpoints are managed. If Microsoft can show that managing on-premise endpoints from the Cloud is viable, ConfigMgr could be history.
 

And now, Wally Mead, the Face of ConfigMgr, Leaves Microsoft after 22 Years. Thanks Wally for being a great inspiration for me, and good luck with your new job as Principal Program Manager at Cireson!
 
Microsoft's Wally Mead Joins Cireson as Principal Program Manager
Wally Mead, pioneer of Configuration Manager, joins Cireson and strengthens the growing System Center focused organization.

Wally Mead, the Face of ConfigMgr, Leaves Microsoft after 22 Years
During one conversation with Wally, he indicated that when Microsoft decided to push ConfigMgr completely into the Cloud, it would be time for him to retire. I won't state that Wally leaving Microsoft indicates anything more than a simple professional change, but it is interesting timing since we're anticipating roadmap announcements at TechEd 2014 in a couple weeks.
 
Rod Trent (CEO & Founder at myITforum.com, Inc.) reacted on the topic with: I think it's safe to put it this way: MMS is dead. Microsoft is moving us all to the Cloud. And, Wally Mead has left Microsoft.
 
So.. The future of ConfigMgr is uncertain. Let's move to the cloud now, that's the message! Lucky me I will do a lot on Intune next months..

Veeam adds NetApp Snapshot Support!

Sponsor post

Veeam is glad to announce their first new feature in the upcoming Veeam Backup & Replication v8 release - NetApp Snapshot Support! With this release their will be better NetApp integration.

Integration of NetApp and Veeam allows you to achieve:
-Fast backups: back up VMware VMs from NetApp storage snapshots up to 20 times faster
-Quick recovery: easily recover individual items from NetApp Snapshot, SnapMirror and SnapVault
-Improved protection: improve DR protection by creating instant, secondary backups from NetApp snapshots

You can learn more here or read Luca Dell'Oca’s post
Their is also a webinar on April 17th

NetApp integration will be included in Veeam Backup & Replication v8, which will be generally available in the second half of 2014.

How to upgrade Windows Phone 8.0 to Windows Phone 8.1 Preview

Since April 14 it's possible to upgrade Windows Phone 8.0 to Windows Phone Preview. In my case I want to do this on a Samsung ATIV S, which I'm using for over a year now. Windows Phone 8.0 is still working great, but I like to see new features in Windows Phone Preview also. Let's have a look.

Prerequisites are download the app (Preview for Developers) and register as a developer to use a "developer unlocked" phone. This can be done with payment (publish apps in the MS Store) of free usage (create apps to use on your own phone). In my case I'm using the free register. Just create a Empty App and you will be fine.

Register as a Windows Phone Developer – $19 USD, and publish apps in the Store
Register as a developer with App Studio – Free, and create apps to run on your own Windows Phones
Download the developer tools to register and "developer unlock" your phone

If you meet the prerequisites above, download the Windows Phone Preview for Developers app.

During the Windows Phone Preview installation the device will be installing 3 updates, with a reboot after every update. There will be multiple versions used after each update. In my case they were as follows:
-Microsoft Update 8.0.10521.155 (small update)
-Microsoft Update 8.0.10532.166 (big update)
-Microsoft Update 8.10.12359.845 (big update)

After almost 2 hours waiting all updates were installed. None off my files, apps or settings were lost. I'm happy with the new OS and functionality. Why wait? Just install the new killer OS :)

Experiences so far:
-Battery drain solved by soft reboot. Still using more battery then before, but way better then before the reboot. Reviews mentions that it will take a few days before battery behaves as normal.
-New features: Live Tiles, Agenda, Action Center, Battery Saver, Data Sense, Background on start screen, More apps on start screen, Big photo on screen when calling, are all great. No Cortana can be used because I'm living outsite of United States (pity).
-Strange thing is however I cannot share blogposts to Twitter and Facebook anymore? Miss that one most! Also camera is taken photos with Flash while disabled in photo settings!? Oops! When using Bing Music or Vision the device reboots. Who cares?
-Overall experience is great. Still love the device and Windows Phone. Next time it will be Nokia instead of Samsung, that's all :)

Update (1):
Battery behaves as normal after a few days. I can do 24-30 hours on a full battery load again. Another great thing is Notifications + Actions in Settings. You can decide notification banners, notification sound and vibrate per app now! No annoying vibrations on WhatsApp anymore when having 100 incoming messages a day, just turn it off for a single app. Furthermore I love the new start screen with way more Live Tiles them before. When using swiping for keyboard you can create messages way faster then typing it. Do I need to tell more? Just install the update! :) For questions use comments.

Enable TPM for BitLocker usage during OS deployment on endpoints

Last week I wrote a blogpost about "How to Enable BitLocker, Automatically save Keys to Active Directory". As mentioned in that blogpost the Trusted Platform Module (TPM) chip must be enabled and activated in BIOS. This is disabled by default, so no BitLocker by default when using functionality within ConfigMgr. This is a pre-requisite BEFORE running the deployment task sequence. But you can enable TPM during deployment also! Let's have a look.
 
Step 1. Download the CCTK from Dell HERE.
Once you've download it, install the MSI. Both CCTK and HAPI are used for doing the job.
 
Step 2. Create a CCTK package for x86 and/or x64 usage.
Just copy %ProgramFiles%\Dell\CCTK\* to a location that will be used for ConfigMgr, and create a new package.
 
Step 3. Edit your task sequence with the following changes:
Group: Enable TPM on Dell systems
Group: Prepare CCTK and HAPI
Run Command Line: xcopy CCTK
     xcopy.exe ".\*.*" "x:\CCTK\X86\" /E /C /I /Q /H /R /Y /S
Run Command Line: Enable HAPI
     x:\CCTK\X86\HAPI\hapint -i -k C-C-T-K -p X:\CCTK\X86\HAPI\
Run Command Line: Set BIOS password
     x:\CCTK\x86\CCTK.exe --setuppwd=password
Run Command Line: Enable TPM
     x:\CCTK\x86\CCTK.exe --tpm=on --valsetuppwd=password
Restart Computer
Group: Prepare CCTK and HAPI
Run Command Line: xcopy CCTK
     xcopy.exe ".\*.*" "x:\CCTK\X86\" /E /C /I /Q /H /R /Y /S
Run Command Line: Enable HAPI
     x:\CCTK\X86\HAPI\hapint -i -k C-C-T-K -p X:\CCTK\X86\HAPI\
Run Command Line: Activate TPM
     x:\CCTK\x86\CCTK.exe --tpmactivation=activate --valsetuppwd=password
Restart Computer

This must be placed between the "Partition Disk 0" and "Pre-provision BitLocker" step in the task sequence.

When using HP systems this can be done too. The BIOSConfigUtility.exe and TPMEnable.REPSET are used then. More information about that can be found HERE. The code on Dell systems are working great, on HP systems I didn't use it before.

No need to Set BIOS password, Enable TPM and Activate TPM manually anymore. Just use a single Task sequence for BIOS configuration and BitLocker at once. The ConfigMgr task sequence will take care of BitLocker furthermore. Just great!

Source: Windows-noob.com

Update Rollup 2 for System Center 2012 R2 released

Today Update Rollup 2 for System Center 2012 R2 is released. It contains 7 hotfixes for multiple System Center 2012 R2 components, except ConfigMgr. Cumulative Update 1 for ConfigMgr can be found HERE. You can choose between Microsoft Update installation or manually download the update packages.
 
To download the update packages from Microsoft Update Catalog, go to one of the following download websites, as appropriate:
-Data Protection Manager (KB2958100)
-Operations Manager (KB2929891)
-Orchestrator (KB2904689)
-Service Manager (KB2904710)
-Service Provider Foundation (KB2932939)
-Virtual Machine Manager (VMM Console: KB2932942)
-Virtual Machine Manager (VMM Server: KB2932926)

To install the update packages, run the following command from an elevated command prompt:
msiexec.exe /update <packagename>

For more information or download the update have a look here:
Microsoft Support

Hash could not be matched for the downloaded content during OS deployment

Today I had a strange issue when deploying a Windows 7 Capture image to a fat client. With every deployment there was a hash mismatch during the "Apply Operating System" step. In a normal situation this can be resolved easily by updating the distribution point. In my case however this was not the solution. Removing the OS image from ConfigMgr and add it again (so a new Package ID is created) was not the solution also.

Still a hash mismatch, with the following errors:
-Failed to hash file, Win32 error = 23
-Hash could not be matched for the downloaded content. Original ContentHash = <hash>, Downloaded ContentHash = <empty>
-The hash value is not correct 0x80091007

The solution for this is as follows:

Select "Apply Operating System" in the Task Sequence Editor and open the Options tab. Check "Access content directly from the distribution point".

Right-click the reference image package in Operating System Images and open the Properties dialog. Configure the Package share settings on the Data Access tab. Check "Copy the content in this package to a package share on distribution points".

After that OS deployment was running fine again. No hash mismatch anymore! Still strange that updating the distribution point was not helping me this time.

How to Enable BitLocker, Automatically save Keys to Active Directory

When using BitLocker (used for encryption of data on disks) on endpoints the Trusted Platform Module (TPM) chip must be enabled and activated in BIOS. This is disabled by default, so no BitLocker by default when using functionality within ConfigMgr. This is a prerequisite BEFORE running the deployment task sequence. When using BitLocker within ConfigMgr you must select "Configure task sequence for use with BitLocker" during the task sequence wizard. That way the "Pre-provision BitLocker" is added after the "Format and Partition Disk" step. In the end of the task sequence "Enable BitLocker" is added, which saves the BitLocker recovery key in Active Directory Domain Services (ADDS). By default however the recovery key cannot be found in Active Directory. In this blogpost I show you which configuration is needed to find the recovery key.
 
Logon on your Domain Controller first and look at the Operating System version installed. If you will use a domain controller running Windows Server 2003 with SP1 or SP2, you will need to apply the schema extension to store BitLocker and TPM passwords in Active Directory. This file can be downloaded from the BitLocker and TPM Schema Extension page. If you are running Windows Server 2008 (R2) or 2012 (R2) there's no need to do the schema update. These operating systems already include the necessary schema extensions. Another thing to do is to delegate write permissions on the msTPM-OwnerInformation object to the “SELF” account. Tom Acker has a great article on how to do this on the TechNet blog.  Essentially what you need to do is open the AD Users and Computers MMC, right click the OU where your computers are (or the domain root) and Delegate rights to the SELF account using a “custom task” to only the Computer objects.  You grant General, Property-specific and Create/deletion to the “Write msTPM-OwnerInformation” attribute.

To see the information that is being stored in AD, you need to install the BitLocker Recovery Password Viewer which is a component of Remote Server Administration Tools (RSAT). On your 2008 R2 Domain Controller(s) you simply start the “Add a feature” wizard and navigate to the RSAT/Feature Administration Tools and select the BitLocker Drive Encryption Administration Utilities. For older Operation System version it can be downloaded at Microsoft Download Center too. Once the Viewer has been added (or installed), you can now open the Active Directory Users and Computers MMC and open the Properties page of any computer account to see the BitLocker recovery tab. There you will see all of the Recovery ID’s and Passwords that have been generated for all drives encrypted by that computer. In my case the BitLocker recovery key was available after this simple steps. already When you don't use ConfigMgr for BitLocker activation you can use Group Policy to do the job also. Just have a look at Microsoft TechNet for more information on that. Hope it is useful information!

Source: Enable BitLocker, Automatically save Keys to Active Directory

Software Updates not deploying at endpoints

Note to myself: when software updates are downloaded in CCMCache, but not installed afterwards, have a look at this (short) blogpost.

When the message "No current service window available to run updates assignment with time required = 1" is displayed in Updatesdeployment.log and/or "Past due - will be installed" within Software Center, just look no further. This is definitely a conflict between the software update deadline and a maintenance window configured on the collection. After changing the behavior of software updates or the service window, all will be fine after all.

Another day, another challenge!

Source: System Center Central

Update: In the end it was a boundary issue after all. No service window was found on collections, but it can be the issue also.

Extreme battery drain on iPad after iOS 7.1 installation

A few weeks ago I installed iOS 7.1 on my iPad 3 device. When using the iPad before, I could easily using it for over 10 hours on one battery load. After the update this was reverted to 3 a 4 hours max. This is called extreme battery drain! After upgrading my iPad to iOS 7.1, while in standby mode with cover closed, will drain from 100% to shutdown in under 4 hours! I did multiple actions to bring battery life back to default, but nothing seems to help. My actions were:

1) Soft restart the iPad, Using the Power button only
2) Double click the Home button and close all running apps
3) Change settings to disable "Background App Refresh" on all apps
4) Hard reset the iPad, using both Home and Power button
5) Bring back the iPad to factory default settings (using iTunes)

In my case option 5 (Bring back the iPad to factory default settings) was the only one which did the job. When using iTunes for that a full back-up must be created first (using This computer & Encrypt local backup). I did a sync off all apps also! Just install iOS 7.1 again (using Restore Files) and do a full restore after that (using Restore Backup). After that iOS 7.1 will be running fine again. Hope it helps!

Install Cumulative Update 1 for ConfigMgr 2012 R2

Today I had finally time to install Cumulative Update 1 (CU1) for ConfigMgr 2012 R2. KB2938441 (CU1) solves a lot of issues in ConfigMgr and is therefore highly recommended. More about CU1 another blogpost. No need to install KB2905002 anymore after installation. This because it's integrated in CU1 now.

Let's have a look at the installation:

First screen when running setup

When successful you can continue

5.0.7958.1203 is the new version

New update packages in the console

After setup you have the benefit of all updates and hotfixes. Don't forget to update other ConfigMgr servers, consoles and clients as well. You can find packages for that in the console after the update.

Intel Management Engine drivers crashes during Windows 7 setup

When deploying Intel Management Engine Drivers on Windows 7 systems, it's possible that the following error message is displayed during setup: "Windows could not configure one or more system components. To install Windows, restart the computer and the restart the installation". After reboot another error message is displayed most of time: "The computer restarted unexpectedly or encountered an unexpected error. Windows installation cannot proceed. To install Windows click OK to restart the computer, and then restart the installation". After that you can deploy Windows 7 all over again.

Nice to see both English and Dutch here

To solve the crash during Windows 7 setup an hotfix must be installed. This is Kernel-Mode Driver Framework (KMDF) version 1.11. You can find that one here: Download Center. This hotfix must be installed before Windows 7 setup takes place. You have the following possibilities here:
-Exclude the Intel Management Engine drivers and install them during Windows deployment instead of during Windows PE.
-Install the KMDF 1.11 update to the WIM image using DISM. That way it's already in place during deployment.
-Install the KMDF 1.11 update during OS deployment after applying Windows 7, but before the "Setup Windows and ConfigMgr step".

I would suggest applying the KMDF 1.11 update during the task sequence. To do this just create a new package containing the hotfix, then run a command to apply the hotfix using DISM. You can find more information on that here: OSD – Injecting the Windows 7 Kernel Mode Driver Framework (KMDF)

In my case it was working first time during Windows 7 setup. Just great!

How to setup a MS Office 2013 KMS Host on Windows Server 2012

Last month I did a blogpost about "Usage of Microsoft Office 2013 KMS Host License Pack". This one is needed to activate Microsoft Office 2013 through KMS. When using the License Pack things can still go wrong. Let's have a look how to setup Microsoft Office 2013 KMS Host on Windows Server 2012 first.

The KMS activation process for MS Office 2013 is the same as what it was for MS Office 2010. However, the interface to setup the KMS host for MS Office 2013 on a Windows Server 2012 has been updated to use the Volume Activation Tools.

1: Download the Microsoft Office 2013 Volume License Pack from the Microsoft Download Center (MSDL) site;
2: Double-click the downloaded EXE to run it;
3: Once the EXE finishes running, the Volume Activation Tools wizard will appear;
4: On the next screen, choose Key Management Service (KMS) and browse to, or specify the name of, the system running Key Management Service. Typically, this would be the system you are running the Volume Activation Tools on;
5. Next, enter the KMS host (CSVLK) key;
6. Choose activation method, online or phone;
7. Activation Succeeded (or not);

When the activation fails because of STATUS_SUCCESS error, change the KMS listening port from 0 to 1688. Then it will be fine after all!

Configuration succeeded! Yeah!!

To trigger activation manually on the KMS client, run ospp.vbs /act at the command prompt. cscript "%installdir%\Program Files\Microsoft Office\Office15\ospp.vbs" /act

Source (partly): How to setup Microsoft Office 2013 KMS Host on Windows Server 2012

Chassis Types and query-based Collections (part 2)

Last month I published a blogpost about WMI queries on PCSystemType. This blogpost can be found here: How to add devices to different OU’s during deployment. This can be used during a task sequence deployment to decide if the system is a desktop or laptop (for example). This time I want to create collections on PCSystemType. Because this can't be found in a collection query (no PCSystemType there) you can use the following configuration.
 
A good way to target systems in queries and collections is by Chassis Type. When using a query rule on collections, use these values:

Choose System Enclosure - Chassis Types in the query

 

Choose a value based on the Chassis Type (see list below)

 
Let's have a look at the possibilities: 

• 1 Other (Virtual Machine)
• 2 Unknown
• 3 Desktop (Virtual machines as well)
• 4 Low Profile Desktop
• 5 Pizza Box
• 6 Mini Tower
• 7 Tower
• 8 Portable (Laptop or Notebook)
• 9 Laptop (Not as popular)
• 10 Notebook (Popular)
• 11 Hand Held
• 12 Docking Station (Laptop or Notebook)
• 13 All in One (Apple Inc.)
• 14 Sub Notebook
• 15 Space-Saving (Thin Client)
• 16 Lunch Box
• 17 Main System Chassis (Physical Server)
• 18 Expansion Chassis
• 19 Sub Chassis
• 20 Bus Expansion Chassis
• 21 Peripheral Chassis (Laptop or Notebook)
• 22 Storage Chassis
• 23 Rack Mount Chassis (Physical Server)
• 24 Sealed-Case PC

 
To see which device you are using, use the following query: wmic systemenclosure get chassistypes. Because I have the choice between 1, 3, 10 and 15 (for example) this should be Other, Desktop, Notebook and Space-Saving (Thin Client).

Let's use query-based Collections in ConfigMgr as much as possible!

More blogposts on this topic:
How to add devices to different OU’s during deployment

Windows Server 2012 R2 and Windows (RT) 8.1 update available now!

Today on Microsoft Build Developer Conference keynote multiple great announcements are done. This for both Windows Server 2012 R2, Windows (RT) 8.1, Windows Embedded 8.1 and Windows Phone 8. Also new Nokia devices (630 and 635) are announced for next month. Great to see that the start menu will return in Windows 8 (with app support), Windows Phone will have voice control (Cortana) and Windows on 9" or smaller Phone and Tablet screens will be free from now on! Can it even better? Way to go Microsoft!

The start menu will return in a later update

This is a smart move from Microsoft to let Windows Phone grow, instead of Android and iOS which still rules the market. There's also extended Mobile Device Management (MDM) coming with Enterprise Mobility Suite. Windows Azure and Intune will be even more important that way. Also great that Windows Server 2012 R2 and Windows (RT) 8.1 update is available for MSDN subscriptions now! The update will be generally available in 6 days on April 8th for everyone else on Windows Update. Let's have a look at MSDN right away ;)

Choose between update or whole package

There you go! It's possible to download the update only (360MB for x86 and 770MB for x64) or just download the whole package, which is OS and update in one. Within the update package 6 MSU files can be found and a readme.txt. In the txt file you can find the recommended installation order for the MSU files. No unified installer this time.

Let's install Windows 8.1 update right away ;)

Source:
Day 1 Keynote <- A must see!
Windows Phone Blog <- Windows Phone 8.1
Windows Experience Blog <- Windows 8.1 Update