Active Directory System Discovery Agent failed to bind in untrusted forests

Within a ConfigMgr Current Branch environment with multiple untrusted forests, the following error message was seen in Site and System status: Active Directory System Discovery Agent failed to bind to container LDAP. This on every 5 minutes (delta discovery).

-Error: The specified domain either does not exist or could not be contacted.
-Possible cause: The AD container specified earlier might be invalid now. The Domain Controller is inaccessible.
-Solution: Please verify that the AD container paths specified are valid. Confirm accessibility of the site server to the Domain Controller to be queried.

Looking in adsysdis.log error 0x8007054B is given:
-ERROR: Failed to bind to LDAP://OU=Test,DC=Contoso,DC=local (0x8007054B)
-ERROR: Failed to enumerate directory objects in AD container LDAP://OU=Test,DC=Contoso,DC=local

When looking in Active Directory System Discovery the following was configured: LDAP://OU=Test,DC=Contoso,DC=local (for example)
This for every untrusted forest given..

When looking in sitecomp.log however the following was seen:
-Processing forest contoso.local.
-Publishing account user account <Domain>\<Account> will be used
-DS Root:DC=Contoso,DC=local
-Searching for the System Management Container.
-LDAP://Contoso.local/CN=System Management,CN=System,DC=Contoso,DC=local container exists.

So yes, there must be an extra FQDN step in between.
Just change LDAP://OU=Test,DC=Contoso,DC=local to LDAP://Contoso.local/OU=Test,DC=Contoso,DC=local for every untrusted forest in Active Directory System Discovery and you will be fine. (for example)

Looking in adsysdis.log again will show the following information:
-INFO: Bound to LDAP://Contoso.local/OU=Test,DC=Contoso,DC=local
-INFO: successfully completed directory search
-INFO: Start to recursively process into group objects
-INFO: Finished recursively processing into group objects

So no errors in adsysdis.log and Site and System status seen anymore. Very happy with the solution!

Source: Anoop C Nair

Install ConfigMgr Current Branch in a Multi Forest situation

Recently it was needed to install ConfigMgr Current Branch (1602) in an environment with multiple forests with a single domain each. Most of times I install ConfigMgr in a single forest, where one or multiple domains resides or multiple forests with a trust in between. This time it was needed to publish site information across multiple forests without any trusts. Let's have a look at the steps taken.

First you need to configure conditional forwarders from the forest where ConfigMgr is installed to all remote forests where site systems are needed. Otherwise no forest discovery is possible at all.

After that the following must be done:
-Add a forest in ConfigMgr with a domain account from the remote forest. This account must have read permissions on the root of the forest at minimum.
-Run a schema update on the remote forest (schema master) manually by copying the files needed.
-Create a System Management container on the remote forest (without additional permissions needed)
-Create a boundary and boundary group for the remote forest (may be created by forest discovery automatically)
-Create a Network Access (NA) account on the remote forest and configure it in the ConfigMgr console
-Create a Push Installation (PI) account on the remote forest and configure it in the ConfigMgr console
-Run system discovery on the remote forest (with the remote NA account), where LDAP locations must be configured manually
-Set publishing in Site properties on the remote forest

After that forest discovery and publishing must be succeeded. When installing remote site systems, make sure the account for the remote forest is used now. This because the ConfigMgr computer account cannot be used in this case. Hope it helps!

Now Available: Update 1606 for ConfigMgr Technical Preview

Today (June 21th) the latest ConfigMgr (preview) version is released: Update 1606 for ConfigMgr Technical Preview. Update 1606 for Technical Preview is available directly in the ConfigMgr console. If you want to install ConfigMgr Technical Preview for the first time, the installation bits (currently based on Technical Preview 1603) are available on TechNet Evaluation Center.

This update includes the following improvements:
-ConfigMgr as a managed installer with Device Guard (ConfigMgr-deployed software is automatically trusted)
-Cloud Proxy Service (manage ConfigMgr clients on the Internet, with an Azure subscription)
-Grace period for application and software update deployments (give users a grace period to install required applications or software updates)
-Multiple device management points for Windows 10 Anniversary Edition devices (automatically configures an enrolled device to have more than one device management point available for use)

This update also includes new features for customers using ConfigMgr integrated with Intune (hybrid scenario):
-Device categories (automatically place devices in device collections when used in hybrid environments)

Hope that nested task sequences will be available soon too!
Just great a new (preview) version is available now!

Source: Enterprise Mobility and Security Blog

ConfigMgr issues and improvements posted on Microsoft Connect (part 2)

Recently I did some blogposts about ConfigMgr issues and improvements, which I posted on Microsoft Connect.

More about that here:
Issue in ConfigMgr Current Branch (1602) with Intune subscription Some small bugs found in ConfigMgr Current Branch (1602)

The current status after two months looks good to me:
-Issue in ConfigMgr Current Branch (1602) with Intune subscription (when changing tentant) = Fixed
-Order in ConfigMgr and SCEP policies not corrected after removing other policies = By design
-Remote configuration failed on WSUS Server, after ConfigMgr Current Branch upgrade = Active
-The SMS Provider reported an error, Quota violation, when drivers are movged to a different folder = Fixed
-To enable use the Add Site System Roles wizard to add the Intune Connector role = Fixed
-This device might have Activation Lock enabled and might require the user's Apple id and password to be entered to be reactivated = Won't fix
-Default layout for deployment status of task sequences (Monitoring part) = Active
-To identify the Windows Store link for this application, browse to a computer that has the application installed = Active

As for the "Order in ConfigMgr and SCEP policies not corrected after removing other policies" the following details:
This is actually changed by design in ConfigMgr v1511. Several customers asked for the ability to configure security scopes for antimalware policies; there are some existing Connect items for it (e.g. 1015855 and 1015641).
The reason we made this change is because a ConfigMgr admin who is subject to security scopes cannot always "see" the policies of other users. If they change the priorities of their own policies, when the Console cannot "see" the other admins' policies, then it is possible to end up with two policies having the same priority. If both of these policies are present on a client, then the client cannot reconcile the two policies and may encounter errors.
We altered the priority logic to guarantee that no two have the same priority, even when there are scoped users involved. As a result of this we no longer reshuffle priorities when policies get deleted.

Very good to see that Microsoft is still making progress here, with most issues fixed and a few active! Way to go :-)

New update rollup for ConfigMgr Current Branch (1602)

Recently (May 27, 2016) for ConfigMgr Current Branch (1602) is released, also known as KB3155482. It fixes multiple issues on both ConfigMgr and Microsoft Intune. It cannot be downloaded, but will be available in the ConfigMgr console instead.

Here's a list of issues that are fixed:
-Remote Control (1x)
-Site Systems (1x)
-Microsoft Intune and mobile device management (5x)

As you can see it fixes mostly Intune (MDM) parts. When not using Intune, just wait for build 1606 coming soon.

This hotfix is available for installation in the Updates and Servicing node of the ConfigMgr console. If the service connection point is in offline mode, you have to re-import the update so that it is listed in the ConfigMgr console.

For more information on the update have a look here:
Microsoft Support

Hopefully the ConfigMgr certificate issue is solved now too!

Intune Account Portal has merged with the Office 365 management portal

Last year we began moving Intune Account Portal functionality to the Office 365 management portal. This move is now complete (May 26, 2016) and the Intune Account Portal has been retired.

Users and Groups are managed in appropriately named tabs whereas purchasing and subscription management is now under Billing.

Depending on how you purchased, you will access software downloads at either the Volume Licensing portal or the Microsoft Online Services Customer Portal.

Be sure to update your bookmarks.

Read more about the move in our Microsoft Intune blog or go directly to the new Office 365 management portal with your existing credentials.

Source: Microsoft Blogs

Promote the ConfigMgr client in Current Branch (1602)

Within ConfigMgr Current Branch (1602) the production client isn't updated by default anymore. After installation (and/or upgrade) both a ConfigMgr Client Package and ConfigMgr Client Piloting Package are created. This is different in earlier versions, where the production client was upgraded immediately. Benefit of this is to test the client first, before enroll it to all company devices.

Both a ConfigMgr Manager Client Package and ConfigMgr Manager Client Piloting Package are available now.

During upgrade a pre-production collection must be created. Just add a few systems in it for testing purpose, and you will be fine.

Within a deployment task sequence this can be tested to. Just deploy a system with the new pre-production client, and check if it's installing fine. Just choose "Use pre-production client package when available" and browse to the ConfigMgr Client Piloting Package.

When successful go to Cloud Services > Updates and Servicing > and check Client Update options. Check "I am ready to make pre-production client version available to production" to update the Configuration Manager Client Package. The ccmsetup.exe in the ConfigMgr client folder will be upgraded now. Yeah!

Just great to have more control on the client version now!

Defer Windows 10 upgrades in Group Policy and ConfigMgr Current Branch

With Windows 10 in enterprises, it's recommended to devide systems between Current Branch (CB) and Current Branch for Business (CCB). Where few systems will be in CB for testing new functionalities, most systems will be in CBB probably. Difference is a 4 months delay for new Windows 10 builds, which can be extended for another 8 months to have a 12 months delay in total. After 1 year you're out of support, and no security updates will be offered anymore.
 

To divide systems between CB and CBB, Group Policy and/or ConfigMgr can be used. Within the new group policy templates, the following settings is available: Defer Upgrades and Updates

When this policy is enabled and linked, a 4 months delay is the result. This can be extended for another 8 months on upgrades and 4 weeks on updates. You can pause upgrades and updates too. Nothing wrong with that.

When using ConfigMgr Current Branch things get a bit different. Now you have a Windows 10 Servicing dashboard and CB is called Release Ready (RR). CBB is called Business Ready (BR) here. Why using different terms here is not handy and not logical to me. It's also not easy to move systems from RR to BR. Therefore lot's of prerequisites must be in place.
 
When looking on: Manage Windows as a service using System Center Configuration Manager you will see the prerequisites:
- Windows 10 computers must use ConfigMgr software updates with WSUS for software update management
- WSUS 4.0 with KB3095113 must be installed on your software update points and site servers
-Enable Heartbeat Discovery (7 days by default)
-The service connection point must be installed and configured for Online, persistent connection mode to see data on the Windows 10 servicing dashboard
-Specify the group policy setting, Defer Upgrades and Updates, to determine whether a computer is CB or CBB
-IE9 or later must be installed on the computer that runs the Configuration Manager console
-Software updates must be configured and synchronized
 

Strange thing is however, you need to configure group policy and a servicing plan too. Here you can choose between CB or CBB and there's a delay of 120 days possible. This is around 4 months, and not the same as the 8 months which can be configured in group policy. Why the difference here, on days instead of months?

On Manage Windows as a service using System Center Configuration Manager you will see the following on that: "How many days after Microsoft has published a new upgrade would you like to wait before deploying in your environment". Maybe I want to wait 12 months, how to configure that? Hope that someone or Microsoft can clarify something on that.

For now I see most environments with systems in CB/RR without the possibility to move them to CBB/BR easily.

Request: Besides of that I want to click on the dashboard, to see which systems has which build installed and which ring is configured. That will has benefit above off the value displayed.

Will be continued..

Windows 7 SP1 stuck for hours on checking for updates

During a new Windows 7 SP1 installation, it went stuck on checking for updates. I did see Windows update issues a lot last years on Windows 7 SP1. This one is really nasty, because it stays on "Checking for updates" for hours.. Not that cool if you ask me.

The solution is really easy. Just download KB3102810 (Installing and searching for updates is slow and high CPU usage occurs in Windows 7) here and install it on the client. Better stop the Windows Update service first, to speed up the installation process.

Another solution is to download both KB3138612 (Windows Update Client for Windows 7: March 2016) and KB947821 (System Update Readiness Tool) and install them on the client. Better stop the Windows Update service again as mentioned before.

When still having issues, you can try Microsoft Easy Fix also! Hope it helps for you too :)

Source: superuser
 
In the meanwhile the following solution is available too:
Simplifying updates for Windows 7 and 8.1

It mentions: We’re happy to announce that we’re making available a new convenience rollup for Windows 7 SP1 that will help. This convenience rollup package, available to download from HERE, contains all the security and non-security fixes released since the release of Windows 7 SP1 that are suitable for general distribution, up through April 2016.  Install this one update, and then you only need new updates released after April 2016.

Other blogposts on Windows update:
Some clients not updating, reporting 8007000E error
Software Update Error 0x80004005 on client systems

Difference between Intune Standalone and ConfigMgr hybrid mode (part 4)

Recently I did some blogposts about the difference using Intune Standalone or ConfigMgr hybrid mode.
You can find them here: part 1 / part 2 / part 3

For ConfigMgr hybrid mode I mentioned the following:
As for ConfigMgr hybrid mode, this must be done in Configuration items and baselines, where not sure when they arrive. Monitoring - deployments is not the right place also, given a 'Unknown' status most of times. Did a lot of compliance checks and reboots on mobile devices, but nothing seems to happen..

Trick is, you need to do some additional configuration. When policies in Intune are working immediately, they are in ConfigMgr not.

When creating configuration items in ConfigMgr, "Remediate noncompliant settings" is turned on by default.

When creating and deploying configuration baselines, this is not the case. "Remediate noncompliant rules when supported" is not turned on by default. Trick is, you need to enable this for making them active.

In the baseline deployment properties "Remediate noncompliant rules when supported" must be selected. I did change the schedule for 7 days to 5 minutes too. After that configuration was starting on mobile devices right away.

Why this isn't configured by default is the question? Without this setting you can wait forever for policies to come through..

Deploy printer drivers during ConfigMgr task sequence (part 2)

Almost 3 years ago I did a blogpost on deploying printer drivers during a task sequence. That one is based on PnPutil.exe which is fine, but probably not the best solution. Therefore using a CMD file, with multiple commands for different printer models may be better. Let's have a look at that.

When you want to deploy a single print driver or multiple printer drivers, use the following command instead:
RUNDLL32 PRINTUI.DLL,PrintUIEntry /ia /m "<Printer model>" /f "<INF path>\<INF filename>"
RUNDLL32 PRINTUI.DLL,PrintUIEntry /ia /m "<Printer model>" /f "<INF path>\<INF filename>"
RUNDLL32 PRINTUI.DLL,PrintUIEntry /ia /m "<Printer model>" /f "<INF path>\<INF filename>"

This command can be placed multiple times in a CMD file (for example), so just create folders for different models and drivers, and have a CMD file in the root, which is pointing to the different locations. That way printer drivers can be installed easily.

Hope it helps!

Using the new Windows Store for Business for apps on Windows devices

Within the post: Windows 10: A Store That’s Ready for Business, Microsoft is mentioning the following: 'with Windows 10 we will deliver one Windows Store for all Windows devices'. But therefore the new web-based Store portal must be used. They will become visible in the Windows Store at a later time.

First you need to create a new Business portal on businessstore.microsoft.com and sign in with a work or school account, or Azure account if you prefer. In the Windows store on Windows 10 devices this account is used, next to your Microsoft Live ID. In that case a new tab will be present (next to Home, Apps, Games, Music, Movies & TV). This based on the company name used during creating the Business portal.

When adding apps you can choose between: 'Add to your private store where all people in your organization can find and install it', or 'Assign to people' only. That way they won't be present in the private store, but only for specific people. Last one is 'Distribute later', which isn't a deployment at all, but can be done later.

In this case I added apps to the private store, where all people in your organization can find and install it. Unfortunately the app is not ready for deployment yet, but 'Add in progress' is shown.

When adding apps to the Business portal, it can takes up to 24 hours for the app to get present in the Private store. When looking on Windows store on Windows 10 (full edition) or Windows 10 Mobile the same apps are there.

 

As mentioned earlier; When signing in with your Azure account (or add it next to your Live ID) a new tab in Windows Store will be present. This is how it looks like on my Surface (5 apps, but 6 deployed).

And this is how it looks like on my Phone (4 apps, where 6 deployed). For it seems LinkedIn and Translator are Phone only, Sway and Buienradar are Windows (full OS) only.

So unfortunately the same story as before (using the Company portal). Where does this fit in the One unified app store across devices, One great experience model, when apps differs between Windows 10 and Windows 10 Mobile devices? Because Microsoft is saying it's one platform, I hope this will be more clear in future..

Hope things will get more clear this way!

Update: It's possible to use 'My Library' too, and see which apps works and which apps doesn't work on your device.

Difference between MAK, KMS and ADBA activation

Last years I did multiple blogposts about activation based on MAK and KMS. Recently I did mention the ADBA license Pack too. This time some pros and cons beween these activation tools.

Multiple Activation Key (MAK) usage:
- For workgroup-joined systems (when no domain is used)
- Systems which are used outside the domain, and not connected in 180 days or more. Otherwise activation will be expired.

Key Management Service (KMS) usage:
- CMD-line based & domain wide, therefore a KMS host is need for every (child) domain.
- A minimum of 25 devices and/or 5 servers for activation
- Valid for 180 days, where every 7 days a check is done
- Windows 7 & Server 2008 support or later

AD-Based Activation (ADBA) usage:
- GUI based & forest wide, so no need to have a KMS host for every (child) domain
- No minimum on devices and/or servers (!)
- Activated during domain-join immediately, and removed when domain-join is undone or 180 days has passed.
- Windows 8 & Server 2012 support or later
- No TCP 1688 (KMS) is used, but default LDAP instead

Hope it's clear that ADBA is the way to go. Less servers needed and easier in communication and activation. Hope you like it too :-)

A setup guide can be found here: Installing Volume Activation Services Role in Windows Server 2012 to Configure ADBA

More blogposts about activation tools:
Update KMS hosts for Windows 10 activation
Usage of Microsoft Office 2016 KMS Host or ADBA License Pack
And many, many more...

Difference between Intune Standalone and ConfigMgr hybrid mode (part 3)

In an earlier blogpost i wrote about pros and cons between Intune standalone and ConfigMgr hybrid mode, and the difference in speed between both solutions. This because Intune standalone (SAAS) is very fast (few seconds, sometimes few minutes) on enrollment of applications and/or policies. With ConfigMgr hybrid mode this is way slower, and can take up to multiple hours (or more) for making it happen. This time I want to share something on difference for Windows and Windows Phone devices.

With Windows 10, Microsoft is saying that there is One universal app platform, One security model, One management system, One deployment approach, and One familiar experience. Unfortunately that's not true when using a Windows 10 Mobile, managed by Intune standalone or ConfigMgr hybrid mode.

When deploying applications from one of both solutions, you will see that sometimes it's needed to choose Windows, the other time Windows Phone. Some apps are available for Windows, but not for Windows Phone (or the other way around). Very confusing if you ask me! So you must choose between a Windows app package or Windows Phone app package. That's hard to explain to customers..

When choosing a Windows app package (like I did), applications will not be offered on Windows 10 Mobile. In my perception this is not a Windows Phone anymore, with a different Windows Phone store. So yes, you must still use Windows Phone app package to make them available on Windows 10 Mobile. Very confusing if you ask me. Where does this fit in the One unified app store across devices, One great experience model? But wait there's more..

Within the post: Windows 10: A Store That’s Ready for Business, Microsoft is mentioning the following: 'with Windows 10 we will deliver one Windows Store for all Windows devices'. But therefore the new web-based Store portal must be used. So open Windows Store for Business and start adding apps to your inventory. When signing in with your Azure account (or add it next to your Live ID) a new tab in the default Store will be present.

After that a new tab is present in Windows Store, with the company name used, with apps added in Windows Store for Business. Because it can take up to 24 hours for the app to get present in the Private store, you must be patience on this :-)

More on that in a next blogpost. Thanks for reading.
Read more on part 1 and part 2

ConfigMgr issues and improvements posted on Microsoft Connect

Recently I did some blogposts about ConfigMgr issues and improvements, which I posted on Microsoft Connect.

More about that here:
Issue in ConfigMgr Current Branch (1602) with Intune subscription
Some small bugs found in ConfigMgr Current Branch (1602)

The current status after one month looks good to me:
-Issue in ConfigMgr Current Branch (1602) with Intune subscription (when changing tenant) = Fixed
-To enable use the Add Site System Roles wizard to add the Intune Connector role = Fixed
-This device might have Activation Lock enabled and might require the user's Apple id and password to be entered to be reactivated = Won't fix
-Default layout for deployment status of task sequences (Monitoring part) = Active
-To identify the Windows Store link for this application, browse to a computer that has the application installed = Active

Very good to see that Microsoft is making progress here, with one issue and one improvement fixed! Way to go :-)

HP Client Integration Kit for ConfigMgr 2012 R2 or Current Branch (update)

Recently I did a ConfigMgr Current Branch upgrade. To import driver packages easily I like to use additional Dell and/or HP tools to import driver packages. This time however the HP tool has some new functionality. Let's have a look at this first.

The HP Client Integration Kit for ConfigMgr has an update on 03/31/2016 with the following changes:
- Provides the Client Integration plug-in for ConfigMgr 1511 or 2012 R2 SP1 CU1 or later or 2012 SP2 CU1 or later.
- Adds the ability to create and import custom driver pack or import drivers only.
- Adds the ability to enter the keyword to search for HP product name when creating and importing driver pack.
- Adds the ability to sort the category such as driver name, version, SoftPaq number when selecting driver to import
- Adds the ability to choose the type of download file such as FTP or HTTP. By default, CIK uses HTTP.
- Adds BitLocker to CIK task sequence examples
- Revises the pop up messages when the server does not meet the requirement.
- Updates the CIK installer to fix the copyright string.
- Updates the CIK User Guide and ConfigMgr & CIK support matrix.

Let's have a look in the ConfigMgr console now:

There are 3 buttons in the ribbon now, one for 'Create and Import Driver Pack' one for 'Download and Import Driver Packs' and one for 'Import Downloaded Driver Pack'.

When choosing 'Create and Import Driver Pack' you can search on types/models and select which driver(s) must be part of it. This is the latest add-on available! That way you can create driver packages yourself, and decide which driver must be part of it. Therefore searching on the HP website yourself isn't needed anymore. Just great that a new feature is part of this ConfigMgr integration.

When choosing 'Download and Import Driver Pack' you can search on types/models and download/import driver packs, but no selection on drivers is possible. When choosing 'Import downloaded driver packs' you must download them manually and import them afterwards (as usual).

Download HP CIK right away!

More blogposts about importing driver packs:
HP Client Integration Kit for ConfigMgr 2012 R2 (update)
HP Client Integration Kit for ConfigMgr 2012 R2
Download Driver packages for Dell, HP and Lenovo systems

Difference between Intune Standalone and ConfigMgr hybrid mode (part 2)

In an earlier blogpost i wrote about pros and cons between Intune standalone and ConfigMgr hybrid mode. Is this post I will mention the difference in speed between both solutions. This because Intune standalone (SAAS) is very fast (few seconds, sometimes few minutes) on enrollment of applications and/or policies. With ConfigMgr hybrid mode this is way slower, and can take up to multiple hours (or more) for making it happen. This is very annoying indeed!
 
I'm using the SAAS solution myself; using it for demo purpose on my Windows 10 Mobile (Lumia 950). When doing enrollment on that and start a deploying applications and/or policies, they will be visible in a few seconds. Just have a look at some examples on that:
 

When deploying applications, or changing icons (or something like that), they are visible almost immediately.
 

When using Allow manual unenrollment (No), Intune cannot be removed from a Windows Phone or Windows 10 Mobile. Way better, because this isn't possible on iOS or Android devices, or special configuration is needed (iOS).
 

When using Allow application store for Windows 10 Mobile (No), the store isn't available anymore. Just an example how easy an application can be blocked, but again for Windows Phone only.
 

This for both the tile on start screen as for the start menu present on Windows Phones. They will be greyed out on start screen and start menu. Just want to see more off that.

When using Allow Camera (No), the following message is given, presenting a black screen when choosing OK. A message that the camera is blocked would be better I guess then presenting a black screen, but maybe it will be in future.

As for ConfigMgr hybrid mode, this must be done in Configuration items and baselines, where not sure when they arrive. Monitoring - deployments is not the right place also, given a 'Unknown' status most of times. Did a lot of compliance checks and reboots on mobile devices, but nothing seem to happen..

As mentioned in an earlier blogpost: Still I truly believe in ConfigMgr hybrid mode, having best of both worlds. But Microsoft still needs some development for a way better experience on that!

More on that in a next blogpost. Thanks for reading.
Read more on part 1 and part 3

How to audit changes in ConfigMgr 2012 R2 or Current Branch

Sometimes it's needed to audit changes within ConfigMgr 2012 R2 or Current Branch. When changes are made, and you want to know who did some actions, it's good to know that most actions are logged.

Just start the ConfigMgr console, and go to the Monitoring tab. There choose System Status > Status Message Queries. There you will find 41 queries, based on: auditing, boundaries, collections, deployments, packages, programs, remote control activity, security roles, server components and site systems. Lot to find there :-)
 
Recently it was needed to audit changes, which were found in audit messages. One for the site and for a specific user. Those will tell you who did what and when: 

All Audit Status Messages for a Specific User: Audit status messages that track activity initiated by a specific user (when prompted, use the form DOMAIN\username).  

All Audit Status Messages from a Specific Site: Audit status messages reported at a specific site.

 

When needed it's good to know that this functionality is built-in the console. Hope it helps!

 

Source: Microsoft TechNet

Failed to create BitLocker recovery password on Surface Pro 4

When deploying tablets like Microsoft Surface or Lenovo Helix with Bitlocker encryption, I get the following error message:
Failed to create recovery password. Ensure that Active Directory is properly configured for use with BitLocker.

This with ConfigMgr Current Branch (1511). After deployment you will an yellow exclamation mark at the operating system drive.

Trick is, when deploying tablets you need to add another step in the task sequence. This step (Run command line) must be added before the 'Enable BitLocker' step. It can be done various ways, but Powershell is recommended here:
Powershell.exe -command "New-Item -Path HKLM:\SOFTWARE\Policies\Microsoft -Name FVE; Set-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\FVE -Name OSEnablePrebootInputProtectorsOnSlates -Value 1 -Type DWord -Force"

After that you will see that BitLocker encryption is working, and the yellow exclamation mark will be gone! The recovery key is written in AD now. Just happy with this easy solution :-)

Source: www.niallbrady.com