CCMEXEC.COM – System Center blog

CCMEXEC.COM – by Jörgen Nilsson

A couple of weeks ago TechX Azure 2015 Sweden took place in Stockholm. I had the great honor to present on how to manage Android and iOS devices using Microsoft Intune. The recording is now available here (in Swedish): https://www.youtube.com/watch?v=Tuvd3fVgQSc&list=PLcHuyfrfAe…

As Enterprise Mobility Suite is a really hot topic right now here are two great sessions on Azure RMS and Azure AD Premium as well also in Swedish.

Happy EMS weekend!

On patch Tuesday this month, February 2015, a new version of the System Center Endpoint Protection client was released, which replaces the one released in October. The same way as the latest versions of the Endpoint protection client they are released on Microsoft Update / WSUS and can be deployed as an update to your clients. The scpeinstall.exe file on the Configuration Manager 2012 servers are updated with the Cumulative Updates as it has been before as well. So when you deploy a new System Center Endpoint Protection client it will require this update as well.

New in this release from the KB article, http://support.microsoft.com/kb/3036437:
The KB article was updated 13/2 with this new content.

Update 20150220:

The Update is now pulled back from Windows Update and expired in WSUS, if you are experiencing the issues with downloads being blocked with a message that they contain virus, you should downgrade those effected systems. More details can be found here: Team Blog

  • Improvements to registry and file system protection to counter tampering from malware.
  • Sub-mount points can be automatically excluded, and volumes can be fully excluded in Real time protection (RTP).
  • This update also includes the deprecation of the DisableGenericReports subkey in the following registry location:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft Antimalware\Reporting


    Note Unless this key is edited directly in the registry, this update should not have any effect on telemetry behavior.

    After you apply this update, to disable telemetry that’s sent by Endpoint Protection through Microsoft Active Protection Service (MAPS), open the Endpoint Protection UI, click the Settings tab, select the MAPS section, and then click I don’t want to join MAPS.

    Notes

    • Administrators can manage the MAPS configuration options through Windows Management Infrastructure (WMI), Windows PowerShell, and Group Policy.
    • Endpoint Protection may request file samples to be sent to Microsoft for further analysis. By default, Endpoint Protection will always prompt before it sends such samples. There is an option available to send samples automatically. To opt in to automatic sample submission, open the Endpoint Protection UI, click the Settings tab, select the Advanced section, and then click Send file samples automatically when further analysis is required.
    • Administrators can manage automatic sample submission with additional configuration options through WMI, PowerShell, and Group Policy by using the following registry subkeys:
      • MAPS Configuration Registry location:
        HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft Antimalware\Reporting


        DWORD name: SpyNetReporting
        DWORD values:

        • 0 – Off
        • 1 – Basic Membership
        • 2 – Advanced Membership
      • Sample Submission Registry location:
        HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft Antimalware\Reporting

        DWORD name: SubmitSamplesConsent
        DWORD values:

        • 0 (default) – Automatic sample submission disabled. End-users will always be prompted for samples.
        • 1 – Most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation.
        • 2 – All sample submission disabled. Samples will never be sent and end-users will never be prompted.
        • 3 – All samples will be sent automatically. All files determined to require further analysis will be sent automatically without prompting.

The new version is 4.7.205.0 which can be seen in the UI under help.

SCEP4.7.250.0I have seen some issues being reported on the forums and from customers.

  • WMI related errors in the event logs and SCCM Client Health reports back a faulty WMI, a reboot solves this issue.
  • The next issue with the update is that registry keys needs to be configured as the KB articles states above, to stop the Submit sample consent dialog from being displayed and to be able to configure MAPS membership.
  • There has also been reports about all downloads in IE being blocked as they contains virus, no real solution to that one yet.

I thought I would share how I demo Microsoft Intune and management of devices as it hard to display some devices in a Lync call or in a conference room, and it is heavy to carry all that hardware with you ;-)

Android, for testing Android I use Genymotion which is a Android Emulator that is free for personal use. It uses VirtualBox seamless in the background and runs Andorid virtual on top of Virtualbox. You can download Android images for Samsung Galaxy S4 with Andorid 4.4, Nexus and a lot more.
Genymotion1 To be able to enroll it Google Play must be working on the virtual Android device, here is a blog post on how to enable it http://www.techrepublic.com/article/pro-tip-install-google-play-services-on-android-emulator-genymotion/

After that you can just fire up you Android device and enroll it in Intune.

iOS, For iOS I have used iTools before but it doesn’t work that well with iOS 8.2 anymore so I reverted back to using the Reflector application instead which makes you PC a Airplay device so you can simply use Airplay on you iOS device and select to mirror the screen of your PC. Works really well.
One note though, if you are using guest wireless network it is not always that they allow peer-to-peer connections so I use a small 4G wifi pocket router so I know it works.

Windows Phone, Windows Phone is somewhat easier as in Visual Studio Express 2013 with Update or later you can choose to install the Windows Phone 8.1 emulator as well. https://dev.windows.com/en-us/develop/download-phone-sdk . The Windows Phone 8.1 emulators uses Client-Hyper-V in the background so it cannot run on the same machine as Virtual box and Genymotion, here is one solution that can be used from Scott Hanselman to add a boot option to your Windows 8.1 and choose Hyper-V or VirtualBox.

Happy Intune testing!!

In the January 2015 Patch Tuesday update the .Net Framework 4.5.2 is included as an update to all supported platforms. Category: Feature Packs.

NeT452

If you haven’t tested .NET Framework 4.5.2 with your applications already and you are building your images and pulling the updates for those images from Windows Update Directly you need to exclude the .NET Framework 4.5.2.

I wrote a post on this a while ago so just replace the KB article with the one for .NET framework 4.5.2 in this post. http://ccmexec.com/2014/06/exclude-net-framework-4-5-1-building-images-using-windows-update/

Some more information about .NET Framework 4.5.2:

What’s new in .NET Framework 4.5.2 http://msdn.microsoft.com/en-us/library/ms171868%28v=vs.110%29.aspx#v452
K
nown issues with .NET Framework 4.5.2 http://support2.microsoft.com/kb/2962547/en-us

In Configuration Manager 2012 R2 a new variable was introduced to help us solve an issue with installing applications in a task sequence on new computer with SSD drives where all the networking components are not loaded when the Task Sequence tries to access the MP which results in the fact that the Task Sequence fails.

After doing a lot of testing with a lot of help from a new colleague of mine Johan which did a lot of testing (not the Johan you think of;-) ) the value should be entered in Milliseconds instead of Seconds! Combining this value with the following two solved all our issues with applications not installing during the Task Sequence:

SMSTSMPListRequestTimeout=120000

SMSTSDownloadRetryCount=5

SMSTSDowloadRetryDelay=15

Today a hotfix was released as well, KB3007095, Applications may not be downloaded in System Center 2012 R2 Configuration Manager

To answer the question can you use Applications in a Task Sequence? Yes you can, works great when you have solved the above issue. Technet will be updated with this information as well and hopefully the hotfix will make it more stable as well.

I hope this can save time for someone.

Microsoft System Center 2012 Configuration Manager Servicing Extension is now released!

This add-on to the Configuration Manager Admin Console makes it easier to manage Cumulative updates in your environment. When installed it adds a new node to the Administration pane in the Admin Console.

Make sure to check it out!

Servicing

Download it here: http://www.microsoft.com/en-us/download/details.aspx?id=45033

When I logged in my Microsoft Intune account today it was already updated with the new UI which looks great and all the new cool features are there as well, just in time for my session at Microsoft Techdays 2014 in Stockholm tomorrow. It even looks cool in Swedish ;-)

Intune_2014_swedish

The November update 2014 of Microsoft Intune adds a lot of new features and brings the standalone version of Intune or Cloud only if you like up to parity with the Hybrid solution where you integrate Intune with Configuration Manager. There are actually settings/features that can be used only in the standalone version.
Looking at the TechED session of what will come next with a secure way of managing corporate applications, an app wrapper to manage your LOB apps and Office for Android as well I would say that this brings Intune up as a really strong enterprise device management solution with unique features and end user experience!

So what is new in the November release? It is listed here as as well on the Intune blog which you really should follow: http://blogs.technet.com/b/microsoftintune/archive/2014/11/17/new-microsoft-intune-capabilities-coming-this-week.aspx

  • Enhanced user interface for Intune administration console
  • Ability to restrict access to Exchange on-premises email based upon device enrollment
  • Bulk enrollment of devices using a single service account
  • Lockdown of Supervised iOS devices and devices using Samsung KNOX with Kiosk mode
  • Targeting of policies and apps by device groups
  • Ability to report on and allow or block a specific set of applications
  • Enforcement of application install or uninstall
  • Deployment of certificates, email, VPN and WiFi profiles
  • Ability to push free store apps to iOS devices
  • More convenient access to internal corporate resources using per-app VPN configurations for iOS devices
  • Remote pin reset for Windows Phone 8.1 devices
  • Multi-factor authentication at enrollment for Windows 8.1 and Windows Phone 8.1 devices
  • Ability to restrict administrator access to a specific set of user and device groups
  • Updated Company Portal apps to support customizable terms and conditions

There is a recorded webinar here that shows the new features of Conditional Access: https://azureinfo.microsoft.com/US-Azure-WBNR-FY15-11Nov-EMSWebinarSeries4-Registration-Page.html?ls=Social&WT.mc_id=Blog_Intune_Announce_PCIT

And as I wrote above you will be able to use control access and manage you LOB applications as well in the future and it is demoed here at TechED if you want to have a look: http://channel9.msdn.com/Events/TechEd/Europe/2014/EM-B312

If you haven’t looked at Intune before you really should and if you have look again! If you are attending Techdays 2012 in Stockholm 19-20 November I hope to see you there!

Mine and Stefan Schörling’s (www.cmtrace.com) session, System Center Configuration Manager Community Jewels from TechED Europe 2014 is now live on Channel 9. If you think you saw it already in Houston you are mistaking, we have switched some Demos and added new tools in the presentation like Cireson Remote Manage App, 2Pint Software – BranchCache for OSD. Thanks to all who contribute to the community and thanks to all who attended our session!

http://channel9.msdn.com/Events/TechEd/Europe/2014/EM-B308

Teched_Community

Note: And my name is not Stefan…… ;-) ;-) ;-)