[Enable Third party updates is not creating a certificate]

Seems that it's normal it won't work while we have a remote Wsus (SUP) server. So when it's hosted onto the same site server (primary) it will work but when you have a dedicated wsus it won't 😞

[Bitlocker - Drives not Encrypting]

We are have this error too Kirill_L but we install bitlocker through Intune, not from SCCM, the machines are co-managed. But for some weird thing 2% of our machines don't receive the encryption policy so 300 machines are still without encryption. The others went well

[Enable Third party updates is not creating a certificate]

Nothing in there 😢

I configured it with extended HTTPS. In my lab I have the same configuration and it works.

A while ago I configured third party updates in prod and the certificate was created by the server but I had to delete the setup and it doesn't create the certificate now.

[Enable Third party updates is not creating a certificate]

I configured the 'third party updates' option but it seems there's no certificate that gets created. I already unchecked the option and resync the windows updates and after this re-enabled the option but it keeps empty.

Anyone?

[Console sees servers as physical and not as virtual]

It's ok, triggered a heartbeat onto the collection and the info was updated

[Console sees servers as physical and not as virtual]

I have some servers being seen as physical machines 'Virtual Machine = no' while these are virtual machines running ESX. I can create queries for collections but on what is the value based in the console?

 

[Edge on W10 is updating itself]

I have the msedge_installer.log but there's no reference to azure or web page content 😞

 

msedge_installer.log

[Edge on W10 is updating itself]

Niall, I don't see any app status 'Edge' in Endpoint Manager admin center.

What I can see is the Discovered apps and versions

These are the workloads for now with co-management

[Edge on W10 is updating itself]

2 hours ago, anyweb said:

is it co-managed ?

Yes it is

[Edge on W10 is updating itself]

Edge is updating itself while we are using SCCM to manage the updates as this printscreen is proving

When I go to the CM console you can clearly see this update isn't deployed nor downloaded to the package. It isn't even advertised on

The latest deployed version is 90.0.818.66

In Intune we don't have an application to install so I cannot figure out, for now, where this thing is coming?

Any ideas?

 

[How to get access to HD when you cannot disable bitlocker?]

Ok, it worked to have the WinRE but when I looked to Azure the bitlocker key was vanished so now I don't know to get the data back. I hope he saved his stuff to OneDrive before

[How to get access to HD when you cannot disable bitlocker?]

22 minutes ago, anyweb said:

leave the disc in the machine and try and boot into recovery mode, you'll need the recovery key (available in AD or in CM/MBAM/Azure) otherwise you can't unlock it...

 

3 failed boots in a row should force it into recovery mode

Yes, I have the recovery key from Azure. I'll try the 3 times step and hopefully the recovery will launch.

[How to get access to HD when you cannot disable bitlocker?]

I have a machine which gives the error 8007139f when starting the machine. The bitlocker recovery is running but 1sec later the BSOD comes up.

There is still some data on the machine which I need to access. Maybe I can take the disk out and access with an external usb cable/dock?

What solutions are there?

[Make a query to find all unlicensed O365 installations?]

Hi Garth, I tried the trick with ospp.vbs as I used to on Office 2010, 2013 and 2016 but as our licenses are activated from the cloud it's like not working. This is the output I get:

To find them we can check on the existence of the folder and tokens created in -> \AppData\Local\Microsoft\Office\16.0\Licensing
But this is per user.

 

[Make a query to find all unlicensed O365 installations?]

Some end-users are having some trouble with 365 Apps (O365ProPlusRetail) that says there license is not valid or active. I want to make a query or something to group these machines and apply a regfix.

But for that I need to find them. We had the ospp.vbs /dstatus before but as the license comes from the cloud (not mak nor kms) I don't know how I can see this. There is a nice guide of Eswar Koneti but not doable for us : https://eskonr.com/2019/09/check-microsoft-office-activation-status-using-sccm-compliance-settings/

 

[Delete machine record in AD and SCCM?]

Is there a way to delete a machine from ad and sccm before or during a TS? We want to do this because it's still linked to collections with app deployments the end-user doesn't need/want.

[Administer more licenses than you have?]

Can you give more licenses than you have in the azure portal? We have 500 and we gave 636 so we are in excess. Does MS not block these things? How long is this lasting? Will the end-user get a warning or will the application stop working?

[IPU is not working on some machines]

The child TS is not disabled on itself but I disabled the step in the main TS

 

On 1/29/2021 at 8:32 PM, anyweb said:

what does the smsts.log tell you ?

I put the machine in the debug state to see if I can get more info. (TSDebugMode=True) This is the log for now (waiting for debugger)

We're on CB 2006. Waiting to upgrade to 2010

[IPU is not working on some machines]

On 1/29/2021 at 8:32 PM, anyweb said:

what does the smsts.log tell you ?

I put the machine in the debug state to see if I can get more info. (TSDebugMode=True) This is the log for now (waiting for debugger)

We're on CB 2006. Waiting to upgrade to 2010

smsts.log

[IPU is not working on some machines]

I've got the weirdest thing on some machines (200). These were the first bare-metals on 1803 we did, and now we want them to upgrade to 1909. When launching the IPU TS it runs like 8 seconds and the status goes to failed and quickly (like 50ms) it changes to available again.

I monitored the CCM\logs and "C:\$Windows.~BT\Sources\panther" folders but there's no change at all.

@niall always says that logs are the answer, but I don't even know where to look for them 😪

 

[Prequisite check 1910 to 2010 stuck]

Ok, without doing anything the connection came on and was green. I then executed following sql:

USE CM_PS1
EXEC spDiagChangeTracking @CleanupChangeTracking = 1

And redo the prerequisite check and all was good. The upgrade to 2010 went super 🙂

Case closed

[Prequisite check 1910 to 2010 stuck]

Ok I found the issue. It was a combination 🙂

I changed some rights in SQL for the installation user and system account to be able to write to the DB. And finally removed an extra nic adapter used for internet access. It's going further now but I have another error:

This can be solved by opening an admin session on SQL but I have an errormessage:

 

[Prequisite check 1910 to 2010 stuck]

I just created a lab with 1 AD server and 1 CM server hosting the SQL server service and wsus. After the install I want to upgrade to 2010 directly but I have some network/auth complications with the prerequisite check

For some reason there's a 'GetFileSize' error on a file which seems to be related to the pt-BR language as everything is en-US based on the servers:

I attached the logfiles. I enabled 'named pipes'

I disabled all firewall

But the prequisite check is still running

How can I stop/restart this?

CMUpdate.log distmgr.log

[How can I install Windows 10 language packs offline with an MDT Integrated Task Sequence in System Center Configuration Manager (Current Branch)]

@anyweb we are on CM 2006 with W10 1803 machines (planning to move to 1909) but the regional settings have to be changed to this:

I tried by deploying a TS with an XML to the actual machines but this only works for the welcome screen and new user accounts, not for the actual already known users. This is an XML I deployed
 

 <gs:GlobalizationServices xmlns:gs="urn:longhornGlobalizationUnattend">
    <!--User List-->
    <gs:UserList>
        <gs:User UserID="Current" CopySettingsToSystemAcct="true" CopySettingsToDefaultUserAcct="true" />
    </gs:UserList>

    <!--Display Language-->
    <gs:MUILanguagePreferences>
        <gs:MUILanguage Value="en-US" />
        <!--<gs:MUIFallback Value="en-UK" /> -->
    </gs:MUILanguagePreferences>

    <!-- system locale -->
    <gs:SystemLocale Name="en-US"/>
    
    <!--User Locale-->
    <gs:UserLocale>
        <gs:Locale Name="fr-BE" SetAsCurrent="true" ResetAllSettings="true"/>
    </gs:UserLocale>

    <!--input preferences-->
    <gs:InputPreferences>

        <!--en-BE-->
        <gs:InputLanguageID Action="add" ID="0409:00000813" Default="true"/>
        
        <!--en-US-->
        <gs:InputLanguageID Action="remove" ID="0409:00000409"/>

        <!--en-UK-->
        <gs:InputLanguageID Action="remove" ID="0809:00000809"/>

    </gs:InputPreferences>

    <!--location-->
    <gs:LocationPreferences>
        <gs:GeoID Value="21"/>
    </gs:LocationPreferences>
</gs:GlobalizationServices>

 

Any ideas how to fix that for the known users on the machines?

[How can I deploy a customized Windows 10 start menu using System Center 2012 R2 SP1 Configuration Manager ?]

15 hours ago, xerxes2985 said:

@Kingskawn
 

Here's my XML file I'm using. Feel free to use and modify etc. 

Also, there is a group policy under
Computer Configuration > Policies > administrative templates > Start Menu and Taskbar > Start Layout. Enable the setting, and give it a path (C:\windows\tb_layout\layoutmodification.xml).

Use a group policy preference to place a folder and the file into whatever location for the machines needing the custom layout. 

When group policy runs and the next time those computers log in, they should have the custom start menu layout.

LayoutModification.xml 3.51 kB · 0 downloads 

Ok thanks Xerxes, I'll try that out today 😉