Network connectivity test for Autopilot Hybrid deployment

 There’s 3 method to check network connectivity by using:

•  Test-DeviceRegConnectivity.ps1
• Test-MicrosoftEndpointNetworks
• Run port checking via ns authority/system - PsExec

After a network connection is in place, each Windows device will contact the Windows Autopilot Deployment Service. With Windows 10 version 1903 and above, the following URLs are used:

•  https://ztd.dds.microsoft.com
•  https://cs.dds.microsoft.com 
• https://login.live.com

Copy 3 files in USB

• PsExec.exe
• Test-DeviceRegConnectivity.ps1
• Test-MicrosoftEndpointNetworks.ps1

Test-DeviceRegConnectivity.ps1

Test-DeviceRegConnectivity PowerShell script helps to test the Internet connectivity to the following Microsoft resources under the system context to validate the connection status between the device that needs to be connected to Azure AD as hybrid Azure AD joined device and Microsoft resources that are used during device registration process. It also, checks for SSL/TLS handshake and report as failure if any.

• https://login.microsoftonline.com
• https://device.login.microsoftonline.com
•  https://enterpriseregistration.windows.net

The steps are:

1. Get the script from this link - TestDeviceRegConnectivity/Test-DeviceRegConnectivity.ps1 at main · Azure-Samples/TestDeviceRegConnectivity · GitHub
2. Press Shift + F10 to launch command prompt.
3. Type powershell to switch to PowerShell.
4. Run c:\Test-DeviceRegConnectivity.ps1 and monitor the result.

The result should succeeded to connect 3 URL required.

Success result as per below:

*If failed, please check and verify with your network team.

Test-MicrosoftEndpointNetworks.ps1

This script to test connectivity of port required.

•  Port 443
•  Port 80

The steps are:

1.       Run c:\Test-MicrosoftEndpointNetworks

2.       Get the result.

*If failed, please check and verify with your network team.

PsExec.exe from Sysinternalsuite

Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following conditions:

         i.            Ensure Domain Name Services (DNS) name resolution for internet DNS names.

       ii.            Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP).

Check and test connection via nt authority/system by follow below steps:

1.       Launch powershell with PsExec by run command c:\PsExec -s -I powershell

Verify that the command is run as nt authority\system

2.       Run test-networkconnection for 80, 443 and 123.

a.       Tnc -Port 443 -ComputerName login.microsoftonline.com

b.       Tnc -Port 443 -ComputerName device.login.microsoftonline.com

c.       Tnc -Port 443 -ComputerName enterpriseregistration.windows.net

https://login.microsoftonline.com - This is the main endpoint for Azure AD authentication and authorization.

https://device.login.microsoftonline.com - This endpoint is used for device registration and management.

https://enterpriseregistration.windows.net - This endpoint is used for registering and enrolling devices in an enterprise environment.

*If failed, please check and verify with your network team.

 

Uninstall Office365 Apps exclude Visio, Project and install Office 2021 Apps in with xml file

 

Copy this and save in xml

<Configuration>

    <Add SourcePath="\\sccmatk\SCCMSource\Office2021" OfficeClientEdition="64"

        Channel="PerpetualVL2021">

        <Product ID="ProPlus2021Volume" PIDKEY="enter your key here">

            <Language ID="en-us" />

        </Product>

    </Add>

    <Remove OfficeClientEdition="64">

        <Product ID="O365ProPlusRetail">

            <Language ID="en-us" />

        </Product>

        <IgnoreProduct ID="PrjStd" />

        <IgnoreProduct ID="PrjPro" />

        <IgnoreProduct ID="VisStd" />

        <IgnoreProduct ID="VisPro" />

        <IgnoreProduct ID="PrjStdR" />

        <IgnoreProduct ID="PrjProR" />

        <IgnoreProduct ID="VisStdR" />

        <IgnoreProduct ID="VisProR" />

        <IgnoreProduct ID="VisioProRetail" />

        <IgnoreProduct ID="ProjectProRetail" />

        <IgnoreProduct ID="VisioProXVolume" />

        <IgnoreProduct ID="VisioPro2019Retail" />

        <IgnoreProduct ID="VisioPro2021Retail" />

        <IgnoreProduct ID="VisioPro2019Volume" />

        <IgnoreProduct ID="VisioPro2021Volume" />

        <IgnoreProduct ID="VisioStdRetail" />

        <IgnoreProduct ID="VisioStdXVolume" />

        <IgnoreProduct ID="VisioStd2019Retail" />

        <IgnoreProduct ID="VisioStd2021Retail" />

        <IgnoreProduct ID="VisioStd2019Volume" />

        <IgnoreProduct ID="VisioStd2021Volume" />

        <IgnoreProduct ID="ProjectProXVolume" />

        <IgnoreProduct ID="ProjectPro2019Retail" />

        <IgnoreProduct ID="ProjectPro2021Retail" />

        <IgnoreProduct ID="ProjectPro2019Volume" />

        <IgnoreProduct ID="ProjectPro2021Volume" />

        <IgnoreProduct ID="ProjectStdRetail" />

        <IgnoreProduct ID="ProjectStdXVolume" />

        <IgnoreProduct ID="ProjectStd2019Retail" />

        <IgnoreProduct ID="ProjectStd2021Retail" />

        <IgnoreProduct ID="ProjectStd2019Volume" />

        <IgnoreProduct ID="ProjectStd2021Volume" />

    </Remove>

    <Display Level="None" AcceptEULA="TRUE" />

</Configuration>

Registry result

App result

Export MFA Status Report via PowerShell Simple Step

 Get the script and save to c:\ 

LazyAdmin/MFAStatus.ps1 at master · ruudmens/LazyAdmin · GitHub

1. Save the script to c:\

2. Ensure the file is saved in ps1 file

3. Launch the powershell as admin and run the command as screenshot above. 

The csv file will be like this

Full Requirement for Windows Autopilot Hybrid Azure AD-joined

 Prerequisite

Server Requirement

Activity Checklist

Network Requirement

WinHttp Proxy Configuration for Autopilot Hybrid Azure AD Join

In this environment, the present of proxy and VPN will become a very complex situation that had multiple proxies in play. From the diagram below, it is require to whitelist the URL to reach AAD endpoint of login.microsoftonline.com and enterpriseregistration.windows.net on firewall proxy. And also WinInet and WinHttp proxy to allow the service of device enrolment. 

* Diagram will be useful for the environment that using the same concept.

Windows will have two kind of proxy settings:

1. WinInet proxy, which is the one we configured in windows settings, and it will be applied for browser access. Allow browser to reach an internet connection. 

2. Winhttp proxy, which is the one we configured with netsh winhttp set proxy command, and it will apply to the service/task process. Allow task schedule service to register the computer automatically. 

From the knowledge base that I found, I ran the join using command dsregcmd /status which provide the hint that shows the Error Phase in Discover mode that diagnostics tests are passing but the registration attempt failed with a directory error, which is expected for sync-join.

Run command with netsh winhttp set proxy x.x.x.x:port and monitor the error phase will changed to pre-check.

After a while, device will be hybrid device with the status  per below.

To verify it, launch Task Scheduler and navigate to Task Scheduler Library>Microsoft>Windows>Workplace Join

Disclaimer:

You may use this solution if your environment:

1. Hybrid Azure AD Join with Auto Enrollment via GPO

2. SCCM Co-Managed enabled

3. Require Proxy to access the corporate resource while connected to corporate network

4. Require VPN with proxy to access the corporate resource while connected to external network

Auto Enrollment MDM Policy

One of the hybrid Azure AD joined requirement is GPO settings to be configured and assigned to the target OU. Thus, the credential type to use is the important thing to decide. 

What is the different between device credential and user credential?

• Device Credential is only available for Windows 10, version 1903 or later. And it is only supported for Co-management or Azure Virtual Desktop.
• User Credential is the normal way for GPO auto MDM enrollment. If you are not doing Co-management or using Azure Virtual Desktop, then we recommend to use User Credential option for GPO configuration.

 

Actually, when a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." It will try to enroll the device in Intune, below are the difference for those 2 options:

• Device Credential, this task will use Device token for auto MDM enrollment, so device will enroll in Intune before user log in, which speed up the enrollment process. And after user log in device, device will be mapped with user and you will see device record together with user info in Intune portal.
• User Credential, this task will use User token for auto MDM enrollment, so it will require user log in the device to complete the auto MDM enroll process.

Azure AD Modernize Authentication with Password-less Feature

 

Detect AADC Installation Issue with Microsoft Network Monitor 3.4

In order to install AADC, it is require SQL database with user mapped to the Managed Service Account or Domain Account require. This post will show on how to use the Network Monitor tool to detect any network blockage during AADC installation.

I might suggest you to use Network Monitor tool. You might freely download from this link https://www.microsoft.com/en-us/download/details.aspx?id=4865 and install to the target AADC server. 1. Launch the installer to install

2. Accept the agreement to continue

3. Choose the Setup Type. At this testing, I will install Typical type.

4. Once installed, it will appear in Menu list.

5. To capture the network, launch the application and click on New Capture.

6. And click Start

7. Re-run the error to get the log. To be continued...

Change Screen Saver / Wallpaper from Endpoint Portal

Login to endpoint.microsoft.com as GA or Intune Admin. Navigate to Devices > Configuration Profiles

Click Edit on Configuration to edit the screen saver. 1. This is for enable the setting to Windows 10 Pro version device. 2. This is the OMA-URI to set the screen saver to the target group.

Click Edit on screen saver and paste the public picture link at Value * column.

Edit the script by add download=1 after ?. 

Save and sync the device.

Credit to Abdul Munir for an idea and effort. 

[SOLVED] Excel not launch but run in task manager

If you experience on excel issue, unable to launch but when you check from task manager you can see the file is running.

To solve, click Menu and search Windows Security.

Navigate to App & Browser control > Exploit Protection Settings > Program Settings. Search for EXCEL.EXE. Click Edit and turn off the SimExec settings.

If your environment using Intune/Microsoft Endpoint Manager, we can push the configuration to disable the setting via Security Baseline profile by Endpoint Manager. Copy xml file to notepad and change EnableRopSimExec="false" to disable the settings.

A very good news to the affected user, the hotfix has been released on the latest versions to fix this issue. Please update your Office client app to the latest version.

SCCM Firewall Port

 

Direction of the Communication	Port	Remarks
Client (HQ) à Primary Site Server (HQ)	80 (TCP) 443 (TCP) 445 (TCP)	HTTP HTTPS SMB
Client (Branch) à Primary Site Server (HQ)	80 (TCP) 443 (TCP)	HTTP HTTPS
Client (Branch) à  Distribution Point	80 (TCP) 443 (TCP) 445 (TCP)	HTTP HTTPS SMB
Primary Site Server (HQ) à Distribution Point	445 (TCP) 135 (UDP, TCP) RPC Dynamic TCP	SMB RPC Endpoint Mapper RPC
Distribution Point à Primary Site Server (HQ)	80 (TCP) 443 (TCP)	HTTP HTTPS
Primary Site Server (HQ) à  Client (HQ)	9 (UDP) 80 (TCP) 443 (TCP) 2701 (TCP)	Wake on LAN HTTP HTTPS Remote Control
Primary Site Server (HQ) à  Client (Branch)	9 (UDP) 2701 (TCP)	Wake on LAN Remote Control
Primary Site Server (HQ) à Active Directory Domain Controller	389 (TCP) 3268 (TCP) 135 (TCP, UDP) RPC Dynamic TCP	LDAP Global catalog LDAP RPC Endpoint Mapper RPC
Primary Site Server (HQ) à Microsoft Update Server (Internet)	80 (TCP) 443 (TCP)	HTTP HTTPS

 

VM SPECIFICATION

	HQ	BRANCH
Server Role	SCCM Primary Site Server	SCCM Distribution Point Server
No. & Type of Servers (Physical/Virtual)	1 x Virtual Machine	1 x Virtual Machine per site/facility
Recommended CPU	8 vCPU	4 vCPU
Recommended RAM	32 GB	At least 4 GB
OS / Software	WS2012 R2 / WS2016, SQL Server 2016 SP1 / SCCM 2016 (Current Branch)	Win 8.1, Win10, Win2012R2, Win2016
Disk	100 GB (OS), 500GB (Data)	100 GB (OS), 200 GB (Data)
Ethernet / Others	2 vNIC	1 vNIC

 

 

Summary for MDM assigned policy from user device

There's a few ways to check on the policy that has been assigned via MEM. 

1. Registry Editor for MDM device.

• Launch regedit.msc. 
• Navigate to  Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device

2. Info from Azure AD connected

• Navigate to Settings > Accounts > Access work or school 
• Expand the connected user
• Click on Info button
• The policies applied is appeared

3. Export the MDM Diagnostic report

• Navigate to Settings > Accounts
• At the right pane under Related Settings

• Click on Export your management log files

• Extract the MDMDiagHtmlReport.html and open in Microsoft Edge.

• Under Managed Policies details, you may find the policies assigned. 
• Example of highlighted below, WiFi policy is assigned to Disabled to Allow Auto Connect Wifi Hotspot. 

• Picture below is the WiFi policy assigned from MEM portal.

[MALAYSIA] Microsoft Partner of the Year 2018 & 2020