anyweb

why not just use capture media as described here ? CM12 in a Lab - How can I capture an image using Capture Media in Configuration Manager 2012 ?

you need to include the smsts.log file from your actual deployment, the error you quoted means as follows:- so you are trying to do something that is unsupported \ post the log and we'll take a look cheers niall

I havn't tried it that way, can you not create a simple example.com test lab and verify that?

in my example windowsintunenoob.com does match a public domain name with the same name even though it's just a lab

all i can recommend is you try another domain name, i'm not 100% sure it's the issue but i wanted to mention it at least, the log files don't really tell me enough to determine the source of the failure

"MDMServer2012R2.konfig.local" <----- that might be your problem ! I had to rebuild my lab and use a 'real' FQDN to get things flowing so for example, my working Windows Intune+ConfigMgr lab has CM12 server has an FQDN of CM12.windowsintunenoob.com, the non-working Windows Intune+configmgr lab was sccm.server2008r2.lab.local I think .local FQDN's will cause problems with iOS, I had no success with iOS and .local in my first lab.

let's stick to one problem at a time please - ok i asked you to state WHEN the problem occurred so I can reference it in your logs, can you tell me when that was ? (i.e. you signed in and then it failed at WHAT time) ?

yup like so How can I password Protect a Task Sequence ? Password Protecting a Task Sequence

you didn't say if you tried any other user yet, if not please do try, as regards your logs i've had a look and it's hard to tell when the failure occured so can you please go through the login process again and when you see the failure take note of the exact time, then attach the new logs here stating WHEN the failure occured ok ?

ok is the device managed by any other mobile device management solution (airwatch for example), if so then those MDM certificates need to be uninstalled first before trying the above, also have you tried using any other user ?? have you verified the user you are testing with is in the Windows Intune Users collection ?

well you have to decide what is more important, security or zero touch, if you want zero touch then remove the password on the DP and instead insert it into the task sequence

i'ts possible via switches when you install the client - see http://technet.microsoft.com/en-us/library/gg699356.aspx /skipprereq:<filename> Specifies that CCMSetup.exe must not install the specified prerequisite program when the Configuration Manager client is installed. Examples: CCMSetup.exe /skipprereq:silverlight.exe or CCMSetup.exe /skipprereq:dotnetfx40_client_x86_x64.exe;Silverlight.exe Note This property supports entering multiple values. Use the semicolon character ( to separate each value.

hmm ok, did you try enrolling more than once ? have you tried signing out of the app and trying again ?

setting the PXE password should only prompt for the password once, where are you seeing it prompt for a password again ?

can you post your logs please

did you follow all the steps in my guide above ? what user account did you use, was it a user@yourpublicdomain.com account or a user@yourpublicdomain.onmicrosoft.com account ?

ok i'll try and make it easier, Installation Instructions 1. download the zip above, extract to a temp folder on your computer so that they are like so... 2. copy the the file in tbe folder called "copy this file to the root of the Toolkit package" to the root of your MDT Toolkit package (you must have installed MDT and Integrated it with Configuration Manager prior to this and created your MDT Toolkit and MDT Settings packages. 3. next copy all the files/folders in the folder called "Files to be copied to the root of the Toolkit Package Scripts folder" to the scripts folder in your MDT Toolkit package 4. Then in configuration Manager update the MDT Toolkit package to your distribution points. In the configuration manager console, import the Task Sequence zip file located in the SP1 or R2 folder in the Task Sequences section of OSD. the unattend xml samples need to be stored in a standard package without any program which are in turn referenced in the task sequence Apply Operating System step and USMT xml files are samples for the imported task sequence and can be placed in the root of the respective USMT architecture folders like below don't forget to update whatever package contains the USMT binaries and xml files to your distribution points after this...

i've replied there, p.s. there are two 'L' s in Niall.

do you have internet access on that ios device ? it doesnt look like it in the screenshot, have you tried shaking the ios device and reading the logs ?

have you verified that at this point that it has an IP address and can ping the FQDN of your MP ?

can you post the smsts.log ?

you can install the MBAM client and any associated registry keys at the end of the task sequence and once installed MBAM will take control of your bitlocker environment, in the CM12 HTA I do just that here. CM12 in a Lab -The CM12 BitLocker FrontEnd HTA - video CM12 in a Lab - The CM12 BitLocker FrontEnd HTA

Yesterday Microsoft released 11 security bulletins fixing 24 vulnerabilities in Windows, Windows Server, Exchange Server, Microsoft SharePoint Server, Office Web Apps, Lync, ASP.NET SignalR, and Visual Studio Team Foundation Server 2013. Five of the bulletins address at least one vulnerability rated Critical. Another recently-reported zero-day was not fixed. Microsoft says that four of the bulletins (MS13-096, MS13-098, MS13-104 and MS13-106) contain a vulnerability which is being exploited in the wild. Of particular concern is MS13-098 which could undermine code signing, one of the more important fundamental protections available today. MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution (2908005) — This update fixes a vulnerability that was being exploited in the wild. The bug was in TIFF parsing and and affected an odd assortment of Windows and Office versions. MS13-097: Cumulative Security Update for Internet Explorer (2898785) — Seven vulnerabilities, five of them rated critical, are fixed in the latest cumulative update. MS13-098: Vulnerability in Windows Could Allow Remote Code Execution (2893294) — The WinVerifyTrust function, which is involved in verification of code signatures, has a critical vulnerability which could allow a malicious actor to inject malicious code into a signed executable. Microsoft says that this vulnerability is being exploited in the wild. MS13-099: Vulnerability in Microsoft Scripting Runtime Object Library Could Allow Remote Code Execution (2909158) — A critical vulnerability in Windows Script 5.6, Windows Script 5.7, and Windows Script 5.8 could allow a malicious web site to take control of a user's computer. MS13-100: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2904244) — Multiple SharePoint page content vulnerabilities, collected as CVE-2013-5059, could run arbitrary code in the security context of the W3WP service account. SharePoint Server 2010, 2013, and Office Web Apps 2013 are affected. MS13-101: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430) — Five vulnerabilities could allow elevation of privilege. An attacker must have valid logon credentials and be able to log on locally and would have to run a malicious program to exploit this vulnerability. MS13-102: Vulnerability in LRPC Client Could Allow Elevation of Privilege (2898715) — Malicious code could elevate privilege by spoofing an LRPC server and sending a specially crafted LPC port message to any LRPC client. MS13-103: Vulnerability in ASP.NET SignalR Could Allow Elevation of Privilege (2905244) — By reflecting specially-crafted JavaScript back to the user, an attacker could elevate privilege at the user in the context of Visual Studio Team Foundation Server 2013. MS13-104: Vulnerability in Microsoft Office Could Allow Information Disclosure (2909976) — By getting a user to open an Office document on a malicious web site, the attacker could ascertain access tokens used to authenticate the current user on a targeted SharePoint or other Microsoft Office server site. Strangely, Microsoft says both that functional exploit code for this vulnerability is unlikely, and that they are aware of limited, targeted attempts to exploit it. MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2915705) — This describes four vulnerabilities in Exchange Server, 2 of them in a bundled component from Oracle. MS13-106: Vulnerability in a Microsoft Office Shared Component Could Allow Security Feature Bypass (2905238) — Loading a shared Office component as an ActiveX control in IE could allow it to bypass ASLR. The vulnerability has been publicly disclosed and Microsoft is aware of attempts to exploit it. Microsoft also released many non-security updates today.] via Zdnet - http://www.zdnet.com/microsoft-patches-4-zero-day-vulnerabilities-in-major-patch-tuesday-event-7000024145/

the smsts.log file will reveal the success or failure of any step, and that's the place to look when things are not working as you expect

Introduction In Part 1 of this mini series we integrated Windows Intune with System Center 2012 R2 Configuration Manager. In Part 2 we added Support for iOS devices (Iphone, iPad). In Part 3 we learned the difference between App Package for iOS (*.ipa file) and applications from the Apple App Store. We learned how to deploy them to iOS devices and configured the deployment type so that the applications were made available to the user based on the iPhone or Ipad operating system version, in addition we also checked device Ownership information and deployed the application based on those requirements. In Part 4 we learned how to use and configure compliance settings in order to enable or disable certain configurable features on iOS devices. We enforced a Password requirement and enforced a minimum password length as this is a common requirement for organizations. Now we will enable support for Windows 8.1 devices (both Windows RT 8.1 and Windows 8.1 Enterprise) to be managed via System Center 2012 R2 Configuration Manager integrated with Windows Intune. Configuration Manager adds to the application experience with Windows 8.1 modern UI apps by adding some new features listed below:- Windows 8.1 introduces the app bundle (or .appxbundle package) to help optimize the packaging and distribution of Windows Store apps and resource packages. Configuration Manager extends the existing Windows app package deployment type to recognize .appxbundle package files. The create application wizard includes a new option that allows you to configure featured applications. These applications are displayed prominently in the company portal. You can specify a privacy link for each application that users can review before they install the application. You can configure an application to automatically open a VPN connection if a VPN profile has been configured. For more information, see VPN Profiles in Configuration Manager. Step 1. Verify your CNAME DNS settings are working In Step 3 of Part 1 you should have created a CNAME DNS entry for your public domain name that redirects EnterpriseEnrollment.yourpublicdomainname.com to manage.microsoft.com. The CNAME record is used as part of the enrollment process. We will now do a couple of quick tests to verify that the redirection is working. In a web browser, type in the following URL. http://EnterpriseEnrollment.yourpublicdomainname.com Replace yourpublicdomain.com with your own public domain name, so for example if your public domainname is windowsintunenoob.com then for the url above use http://EnterpriseEnrollment.windowsintunenoob.com If your CNAME DNS entry is working then the redirection will show something like the following:- If the CNAME DNS entry hasn't taken yet or hasn't been done at all, or was done incorrectly you'll see something like the below:- If you don't have access to a Web Browser you can open a command prompt and ping EnterpriseEnrollment.yourdomainname.com and it should return a result like below (note the redirection to manage.microsoft.com... it IS ok that it doesn't return the ping and that that address may have nsatc.net attached to the end, that's a load balancing server) If you are testing and cannot change the CNAME settings you can install a Registry key on your Windows 8.1 client to help with the above redirection. The registry key is shown below Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM] "DiscoveryService"="manage.microsoft.com" Step 2. Enable Windows RT, Windows RT 8.1, and Windows 8.1 Enrollment In the Configuration Manager console browse to Cloud Services, select Windows Intune Subscriptions and right click on the previously created subscription, choose Properties. Select the Windows tab and place a check mark in the box provided to Enable Windows Enrollment. At this point if you wish you can click on Apply and Ok and you'll be able to enroll Windows 8.1 devices and move to the next step. If however you want to deploy Windows Modern UI type applications (appx Metro apps...) then you'll need to install an appropriate code-signing certificate by clicking on the browse button and selecting your code-signing certificate. Note: To distribute line-of-business apps to Windows RT users, you must also ensure that the apps are signed with a certification authority that is trusted by the users’ devices. You can either obtain a non-Microsoft public certificate, or use a code-signing certificate from your organization’s certification authority. For information, see Acquire a Code Signing Certificate. For Windows RT or Windows 8.1 devices, you can deploy line-of-business apps using a process known as sideloading, or you can deploy links to apps in the Windows Store (deeplinking). Note: Although sideloaded applications do not have to be certified by the Windows Store or installed through the Windows Store, they can only be installed on sideloading-enabled devices. To enable a Windows RT device for sideloading, you must first obtain sideloading product activation keys. For information about how to obtain sideloading product activation keys, see Microsoft Volume Licensing. Step 3. Enroll the device Check the Pre-requirements of your Windows 8.x device here before continuing. In this step we will actually enroll the device with Windows Intune and this involves turning on mobile device management capability in Windows 8.1. Tip: To enable management, you do need to be a local administrator. Logon as a user that is a local administrator of the Windows 8.1 device (do not use the built-in Administrator account). The method used to enroll the devices depends on which version of Windows you are using. If you are using Windows RT 8Select Start, and type “System Configuration”, and click the dialog box to open the Company Apps. Enter your company credentials and the device will be enrolled. Note: I don't have a Windows 8 RT device so cannot show that process, I hope everyone has upgraded to Windows RT 8.1 at this point and that process is shown below. Windows RT 8.1, Windows 8.1 (workgroup joined, no Configuration Manager client installed)Note: If you are trying to enroll a Windows 8.1 device then make sure it is Workgroup Joined (not joined to a domain, otherwise you won't see the MDM Turn On button.) and that there is no Configuration Manager client installed. Swipe in from the right and choose Settings Click on Change PC Settings Select Network Select Workplace and enter your company credentials, then click on Turn On (do not select Join.) it should say connecting to workplace.... if it doesn't and you get an error such as then review the following and more importantly Step 1 above. Also verify that you are not logged on as the local administrator but as another account that has administrative permissions on this device. And in case you have not checked, double check that you actually have enabled Windows Enrollment in the Windows Intune Subscription in the Configuration Manager console. Assuming all went ok, a Connecting to a service screen appears, enter your password when prompted to do so and click on Sign In you'll be prompted to accept an agreement, place a checkmark in the I agree box and click on Turn On. At this point your device is enrolled and the only option shown should be Turn Off (don't select that). Tip: You can confirm a successful enrollment by checking Event Viewer and looking at the SystemSettings log (event ID 510 - should say "Attempted to turn on workplace device management. Result is 0x0 ending at phase 3."). You can also check what certificates are installed, and look at the Trusted Root Certificates Authority, if all went well you should see a SC_Online_Issuing certificate with an Intended Purpose of <All> in your Certificates store such as the one in the screenshot below: Step 4. Install the Company Portal Start the Windows Store and search for Company Portal choose Install once installed, start the application, you'll be prompted for your password, enter it and click on sign in. The Company Portal should appear and any devices you have previously enrolled should be listed. In the screenshot below you can see both a Windows 8.1 device (workgroup joined, no Configuration Manager Client installed) called Hyperv-5 and a Windows RT 8.1 device. Job done ! until next time, adios. Recommended Reading Prepare and set up to manage mobile devices by using Windows Intune - http://technet.microsoft.com/en-us/library/dn408185.aspx#BKMKPrereqs What's New in Windows 8.1 - http://technet.microsoft.com/en-us/windows/dn140266.aspx How can I manage modern devices using System Center 2012 R2 Configuration Manager ? - Part 1 How can I manage modern devices using System Center 2012 R2 Configuration Manager ? - Part 2 How can I manage modern devices using System Center 2012 R2 Configuration Manager ? - Part 3 How can I manage modern devices using System Center 2012 R2 Configuration Manager ? - Part 4 Summary In this post we've enabled support for Windows 8 RT, Windows RT 8.1 and Windows 8.1 devices by enabling the option in our Windows Intune Subscription within Configuration Manager 2012 R2. We've learned how to easily check if our CNAME DNS entry is working and seen the enrollment process in detail. In our next post we'll look at deploying applications to the company portal for users of Windows 8.x devices. Continue on to Part 6. Downloads You can download a Microsoft word copy of this guide here: How can I manage modern devices in System Center 2012 R2 Configuration Manager Part 5 enabling support for Windows 8.1.zip