Quick Tip ! Bitlocker Pin screen gone !

January 11, 2017

 

Hello,

We recently used a partners’ deployment services in order to prestage approximately 5000 laptops for a windows 10 deployment. Today we recieved our first shipment from the factory and we started one in full confidence.

After all the image had been validated on site, everything worked there except for our part 2 sccm task sequence that we use to finish up some minor issues and enable bitlocker.

So all went well, machines booted, startup scripts worked, part 2 was recieved and executed by the client.

But wait … We were expecting to see this after boot

clip_image002

But instead we saw this…

clip_image004

Now this really a tricky issue because it took some time before we realized that the screen was actually there but we did not see it, so if you wait then the machine just shut down.

Ok so now for the solution :

On the machine run bfsvc.exe %windir%\boot /v

Reboot the device and it should be ok.

What probably happened is that some of the fonts that are on the UEFI boot partition are corrupted and result in the “blue” screen, the command bfsvc.exe copies the required files from windows\boot to the required partition.

Saved our day !

Some refs : https://answers.microsoft.com/en-us/windows/forum/windows8_1-security/bitlocker-pin-pre-boot-screen-empty/f985c4f6-dd71-4586-bd46-50f513432bb3?page=1

Enjoy

Gino D

P.S. We were unable to execute this command in the task sequence environment so we had to run it during our startup script.


Quick Tip ! GPO delay Windows 10 DA

December 8, 2016

Hello,

We discovered in one of our customer environments that there was a long delay at computer startup time with Windows 10 build 1607.

Now we had an acceptance environment where the issue did not occur, only difference was that DA was enabled at production site and not at the acceptance environment.

So we activated verbose messaging using :

Computer -> Admin Templates -> System

clip_image002

… This revealed a 60 second timeout during startup : waiting for workplace connectivity.

A quick lookup revealed a default one minute wait time for connectivity before processing gorup policy. So we modified the following policy :

Computer -> Admin -> System -> Group Policy

clip_image004

This resulted in a much quicker computer startup.

Enjoy.

Gino D


#RMS in Azure

December 6, 2016

 

Hello,

Today we’ll run a RMS scenario in our demo office 365 environment. RMS provides the ability to restrict certain actions to documents ( office and other ) depending on the authenticating user by encrypting the required files. This way you can share confidential data in an easy way and make sure only the allowed persons can perform some actions with the documents.

You can find a clear overview here ( https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms )

clip_image002

What is Azure Rights Management? | Azure Information Protection

https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms

 

Now, we’ll start by enabling the feature on a limited group.

Step 1 : we’ll limit the usage to a test group so we’ll use the procedure described in https://docs.microsoft.com/en-us/rights-management/deploy-use/activate-service

We have downloaded and installed the required Azure AD Rights Management Administration toolset.

clip_image004

Hmm. Apparently we need the MS Online Services Sign-in assistant first.

https://support.office.com/nl-nl/article/Microsoft-Online-Services-aanmeldhulp-opnieuw-installeren-6f295d05-ae37-4054-8faf-c89dd48d1827?ui=nl-NL&rs=nl-NL&ad=NL so download and install.

Ok straightforward setup of both components.

clip_image006

Now let’s create a test group that will be used in order to validate the RMS functionality. In this case we create a azure security group.

clip_image008

You’ll need to install the azure AD powershell module in order to retrieve the id of the group.

See : https://msdn.microsoft.com/en-us/library/jj151815.aspx

Then run some commands in order to retrieve the required ID.

clip_image010

Now we can set the RMS feature active for a specific security group and only if the user has the correct

PS C:\Windows\system32> Set-AadrmOnboardingControlPolicy -UseRMSUserLicense $True -SecurityGroupObjectId 532a71c3-f370-47bb-9dd8-34026ea751cf

WARNING: The tenant user on-boarding control policy will be updated by this operation.

license assigned.

clip_image012

Verify the result by using get-aadrmonboardingControlPolicy

clip_image014

Ok done, now let’s add our test user to the group.

clip_image016

And let’s add the required license to our user. In this case the allready assigned E3 license covers RMS ( see https://technet.microsoft.com/nl-be/library/office-365-plan-options.aspx and https://technet.microsoft.com/en-us/dn858608 )

clip_image018

And enable it !

clip_image020

You can now check the status by using portal.azure.com -> Rights management status

clip_image022

If you click through you’ll see that there are 2 templates allready published

clip_image024

On the client device download and install the rights management sharing application for Windows. This application is available for multiple OS’s.

clip_image026

Set it up

clip_image028

All went well

clip_image030

Now if you create a word document and save it then you can use explorer to add RMS based security to this document

clip_image032

If you use the protect in place option then you will see that the client will download the policies from the RMS system and then present the options to use these templates ( 2 templates are created by default )

clip_image034

As soon as the document is protected you’ll see the RMS banner if you open the document in Word.

clip_image036

Now you can also share the content in a secure way, this will create a secured attachment with specific rights included

However when I tried to share it with an external user with commercial email ( @hotmail / @gmail / … ) this will not work ( yet, this functionality will be implemented in a next version of the product )

clip_image038

But you can share it with other ( non commercial ) email addresses. Now there are 2 possbilities :

-> The recipient already uses an azure service so it has a azure active directory and can authenticate

-> The recipient does not already use an azure service so it needs to be enrolled in Azure ad in order to be able to authenticate

The user can use this link ( https://docs.microsoft.com/en-us/information-protection/understand-explore/rms-for-individuals-user-sign-up )

Once done you can track usage etc by using web link ( the specific link will be added to your email message )

clip_image040

Additional info and faqs can be found here : https://docs.microsoft.com/en-us/information-protection/get-started/faqs-rms

Overall some great functionality at your fingertips !

Enjoy.

Gino D


Windows 10 Enterprise IE11

November 6, 2016

 

Hello,

Windows 10 is great but there are some annoyances in an enterprise environment discovered. For example we deploy the Windows 10 to an environment where IE11 is the standard browser so we don’t want to confuse the user with the default edge icon.

You know this one

clip_image002

We can set the default browser and file type associations on a reference machine and export them by using dism /online

clip_image004

And we can import the again using the same toolset, no problem here.

But as soon as a user logs in a windows 10 device he/she gets a default profile and gets the edge and store icon attached to the quicklaunch bar.

Now there are several solutions for this :

-> We can script ( but we don’t want to do that , it starts simple but it ends up being a complete bible )

-> We can modify the default user profile ( copyprofile setting in unattend.xlm doesn’t add the quicklaucnh icons so this would be hardcoded in our default user profile, we don’t like that either)

-> We can use preferences ( it can be centrally managed and we can modify afterwards, not perfect we’ll explain but this is the best option for me )

What do we need :

Well actually 3 things , you’ll see that if you manually modify the quicklaunch bar and add icons to it using the explorer like this ( pin to taskbar Option )

clip_image006

There are 2 modifications : first a change in registry ( HKCU\Software\Microsoft\Windows\Current Version\Explorer\Taskband ) and second a link file that is created in %appdata%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar)

clip_image008

So we’ll create a preference that performs the required actions :

Step 1:

Copy the icons of Office 2013 to the quicklaunch location

 

clip_image010

Copy them from the default startmenu location to the quicklaunch.

Step2 :

Create the shortcut for iexplore (X86 )

clip_image012

Step 3 :

Import the required registry keys

clip_image014

Et voila … Correct quicklaunch icons set.

Now we use an item level targetting so the settings only apply @ a windows 10 device because we have a mixed environment. Now the goal is to use the set once and do not reapply for these settings so they are only applied once but we noticed that when a user gets a new profile the registry settings are not applied the first time so we had to abandon that idea meaning the quicklaunch icons cannot be modified by the user as during logoff/logon they will be back set to default.

We have a call open to investigate the issue further.

Enjoy

Gino D

 

Update better ways available since 1607 : https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-taskbar


Endurance test Revolve 810

October 19, 2016

 

Hello,

Looking back I was very enthusiastic when I first recieved my HP Elitebook Revolve 810 ( 1st generation ).

This was way back in 2013 and a number ( read a lot ) of similar devices have been rolling into the market since then.

But let’s have a look at how the revolve looks now after over 3 years of intense use. And I mean intense as the device travels with me each day to a customer site and back.

The exterior :

clip_image002

-> Some edges show some chipped pieces but no “real” damage

clip_image004

-> Some minor scratches on the front due to “heavy” usage

clip_image006

-> It is still a catchy, elegant and stable device

So overall the device holds out ok.

The interior :

-> Well even according to today’s standards the device still performs ok, Windows 10 was a big improvement in terms of battery usage and even day to day operations like office perform faster compared to Windows 8.

-> I mainly use it in laptop mode, occasionally I read some items in tablet mode.

-> I use the mobile broadband connection quite a lot, the wireless projection to devices from time to time.

-> I don’t really use a stylus, somehow I prefer typing in onenote over writing with a pen.

The rest :

-> I boot using UEFI, secure boot and the device is encrypted by bitlocker.

-> For now it is Azure ad connected and I log on using my company credentials although that’s not really device related.

-> 2 available USB ports are a minimum but at certain sites I use external display, usb docking keyboard and mouse.

-> I update HP drivers and firmware regularly using HP utilities

The issues :

-> Well there were some issues with the fan. Now this is a “known” issue with this model so the fan was replaced and together with the latest chipset this has improved the spinning noise of the cooling a lot.

http://h30434.www3.hp.com/t5/Notebook-Hardware-and-Upgrade-Questions/HP-Revolve-810-Noisy-Fan/td-p/5063770

What I would like to see added :

-> Some kind of biometric authentication ( fingerprint or Windows hello capable camera )

-> more energy efficient processor or more battery power , no matter how much battery you have you always run out at a bad time 🙂

Enjoy

Gino D


Quid Pro Quo EMS

September 14, 2016

Hello,

Quid Pro Quo …or in the words of Austin Powers : Squid Pro Quo, meaning “a feavour for a feavour”. From the corporate ICT’s perspectieve this translates to : we provide additional services that you can use whenever, wherever but … We need to have some information about the location and device before we do that.

Sounds good … Let’s take a popular cloud service like mail/calendar or cloud storage as an example.

What might be a good compromise :

We’ll provide you access to onedrive for business but … We like to make sure the device is locally encrypted , has a minimum of security applied to it and is not jailbroken.

And we provide you with a single sign on experience on your corporate machines but require some kind of multi factor authentication on BYOD.

Let’s see how we could do this. You’ll need active directory Premium to start with this.

First we open our admin center -> Azure AD -> Domain -> and use the applications tab

clip_image002

Now we’ll continue for the Sharepoint online service and configure it.

clip_image004

Now we’ll activate the MFA for a sepcific Office 365 security group of users and request MFA only when the user is not in a “work” location.

clip_image006

You’ll need to define what work locations are by clicking the link . So first we’ll go for the scenario when we require MFA when the user is not @ Work.

Additional info can be found here : https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access-azuread-connected-apps/?rnd=1

So we’ll define the work locations in this case based on ip / subnet combination.

Now if I logon to the onedrive from my machine in that ip subnet -> we expect no MFA

Unfortunately I kept on recieving the Additional verification box …

BTW : the Microsoft Authenticator App is simply a great tool !

No more hassles with copy/paste of codes through sms or applications. The app simply allows you to approve or deny the authentication request.

Install the app -> link your account by scanning a QR code ( use myapss.microsoft.com )

clip_image008

And approve or deny

clip_image010

Great functionality there … But back to the subject … Why do I require MFA now ? …

clip_image012

Now if I modified the trusted IP range with my external IP address recieved from my ISP ( as my Wifi router is of course using NATting )

clip_image014

Bingo ! No MFA request …

clip_image016

While if I do this from another machine -> I recieve the request for MFA.

clip_image018

 

Okay now let’s go one step further and deny access if not @ work.

clip_image020

 

Now let’s see the result if we try to connect on a not @ Work location machine.

clip_image022

 

 

Yes ! No access …

So overall this is some great functionality , MFA is not a on/off scenario and we can have a granular implementation per service and define different settings per location.

We can select to force MFA when not on work location or simply block access completely. It’s clear that cloud first mobile first is really on track.

Next up : device based access rules.

Enjoy.

Gino D


Teamviewer in Intune

September 8, 2016

Hello,

Since the beginning of the computer era , endusers require support, preferably on site with some coffee and chocolates to go. But reality is remote using some kind of tool that allows remote control.

Windows 8 and above lack that functionality with windows intune, not the fault of Intune but something proper to the OSE itself.

Now we can integrate cloud service 1 ( Intune ) with cloud service 2 ( Teamviewer ) for remote assistance. Great ! Let’s see how it goes.

First we need to activate the teamviewer functionality in Intune.

Check out Administrator -> Teamviewer -> Activate

clip_image002

Now follow the wizard as it will guide you through the creation of a user with the required service and allows the creation of a trial account for testing.

clip_image004

Now let’s pretend to be a needy user on a Windows 10 anniversary update build so he/she opens the intune portal and requests assistance

clip_image006

Now we ( the admin ) actually the same person 🙂 sees the alert in the intune admin console

clip_image008

Now we can immediately start the session from the console …

clip_image010

Teamviewer software is being downloaded and installed

clip_image012

And request validation is launched on the client machine

clip_image014

After installation connection is created automatically

clip_image016

The user grants access …

clip_image018

… Et voila we have client side to see who is taking control …

clip_image020

… And the admin side for helping out our customer.

clip_image022

You can perform some more advanced actions like blank screen on user side, block input, lock screen etc.

clip_image024

And you recieve a free word of advice from and a pat on the back from Teamviewer ! We (always) play it fair.

So there you have it, easy and simple but a world of difference for our connected enduser.

Enjoy

Gino D