AlteredAdmin

SOLVED:Because i was setting SilentAccountConfig via SCCM Baseline. SCCM Baselines default to QWORD but the Value needs to be reg_dword, I had to check the box "create the registry value as a reg_dword data type if remediated for non compliant rules"

Wait i re-read what you said. are you saying since our emails are different that it will automatically change? For example: Username: jdoe Email: [email protected]

How did you hand the %username% ? as our emails are different than our usernames. For example: Username: jdoe Email: [email protected]

Ahh that would not work in our case. as it would return a different value than what is the Main email is from Microsoft.

So i have tested the EnableADAL and there is no change in behavior. and Microsoft documentation says you don't have to do it. The second part i have not seen those keys mentioned any where else do you have any more information on them? UserEmail = %username%@ourdomainhere.com Just so i under stand i can use the variable %username% i don't have to put the actual username? Are you also using the the other reg keys i mention in my post? or just those two?

I cant seem to find an answer to this question. I have a question about Silently configure user accounts for one drive, I have the below reg keys being created. to create the below reg keys I'm using SCCM Configuration Items/Configuration Baselines. The test machine is Hybrid Azure AD joined, in Azure AD. [HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"SilentAccountConfig"="dword:00000001" [HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptInWithNotification" [HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptIn"="1111-2222-3333-4444" [HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMBlockOptOut"="dword:00000001" [HKLM\SOFTWARE\Policies\Microsoft\OneDrive\DiskSpaceCheckThresholdMB]"1111-2222-3333-4444"=dword:0005000 However when a user signs into the computer, one drive does not auto sign in. it is running in the system tray. If i launch the OneDrive app it does prompt for an email. But never gets prompted for password. So once the user enters there email it signs them in. I saw on https://docs.microsoft.com/en-us/onedrive/use-silent-account-configuration#verify-that-single-sign-on-sso-is-working that one can enable "EnableADAL" When i tried that i enter the mail and was not prompted for a password so i know that " auth environment is properly configured and SilentAccountConfig should work for your users " I have also read that if you have MFS turned on it does not work, We do not have Azure MFA turned on. however we do have a 3rd party MFA Onelogin. What am i still missing? Reading over all the documentation this should work. but I'm at a loss. I also want to note that Intune/Autopilot AAD machines work fine it auto signs in. Thoughts? Thanks, AA SOLVED:Because i was setting SilentAccountConfig via SCCM Baseline. SCCM Baselines default to QWORD but the Value needs to be reg_dword, I had to check the box "create the registry value as a reg_dword data type if remediated for non compliant rules"

Thanks for this info when i get a chance i will check for that. How did you find out about the scriptMinorVersion?

Standing up a new MP/DP also making it a Software update point, on a server 2022 fully patched. When a new server comes out i try to make a MP/DP/SUP, for sccm just to get something new in there and make sure that works for a while, before standing up new one for the other boundary groups/ locations Like i have done in the past i install the feature and roles so that way when i add the server to sccm, those are already there. BITS differential compression Data deduplication ISAPI Extensions Windows Authentication IIS IIS 6 WMI Compatibility IIS 6 Metabase Compatibility Windows Server Update Services However even before its added to SCCM I'm having some trouble with WSUS. Below is the error i get when i launch WSUS to do the post install things. And yes i rebooted before launching the WSUS, and this is happening before i touches SCCM. Log file is located at C:\Users\USERNAME\AppData\Local\Temp\\WSUS_PostInstall_20211130T122430.log Post install is starting Fatal Error: The schema version of the database is from a newer version of WSUS than currently installed. You must either patch your WSUS server to at least that version or drop the database. When i look in the post install log the only error i can find is RAISERROR('Invalid schema version number', 16, 1) with nowait I have tried Removing the Wsus and deleting the database but when i do that i says Unable to open the physical file "C:\Windows\WID\Data\SUSDB.mdf" when i reinstall the wsus roles So i removed the server from SCCM the MP/DP was working fine btw, but since i felt like it screwed it up beyond repair i removed the roles and deleted the server from SCCM and deleted the VM. I'm now back to fully patched 2022 server. Before i start adding things i wanted to get your input as to what the issue could be with WSUS?

Trying to remove smsprovider from an old server to decommission. However when i follow this guide https://www.prajwaldesai.com/uninstall-sms-provider-role/ I get the below error in Configmgrsetup.log. ERROR: Failed to execute query: IF EXISTS (SELECT * FROM sys.all_objects WHERE object_id = OBJECT_ID('sys.availability_group_listener_ip_addresses') ) ~ SELECT count(*) FROM sys.availability_group_listener_ip_addresses ~ WHERE ip_address IN(SELECT local_net_address FROM sys.dm_exec_connections WHERE session_id = @@SPID) ~ELSE ~ SELECT 0 Configuration Manager Setup 11/16/2021 8:09:50 AM 480 (0x01E0) ERROR: Failed to detect whether always on is enabled or not. Configuration Manager Setup 11/16/2021 8:09:50 AM 480 (0x01E0) ERROR: Could not connect to the SQL Server SCSQL-MEM.DOMAIN.org to determine if the server is always on, or failed to run the query. Configuration Manager Setup 11/16/2021 8:09:50 AM 480 (0x01E0)~ ===================== Failed Configuration Manager Server Setup - Modify Site Settings ===================== Configuration Manager Setup 11/16/2021 8:09:50 AM 480 (0x01E0) Yes, the Site can connect to the database, and it is online. I think its running into a permissions issue. But not sure where to go from here. Thoughts?

Bios Updates are always good to do. But i did test Self-deployment last night everything worked so yours should be working as well.

Yes, Status:Service degradationIncident ID:IT291245User Impact:Admins' TPM attestations may fail during Autopilot self-deployments or pre-provisioning deployments.Latest Message:Title: Trusted Platform Module (TPM) attestations fail during Autopilot self-deployments or pre-provisioning deployments User Impact: Admins' TPM attestations may fail during Autopilot self-deployments or pre-provisioning deployments. Current status: We're investigating a potential issue and checking for impact to your organization. We'll provide an update within 30 minutes.Updated:10/14/2021, 3:19:24 AMStart Time:10/12/2021, 7:40:00 PM Updated:10/14/2021, 2:17:37 AMMessage:Title: Admins' Trusted Platform Module (TPM) attestations fail during specific deployment scenarios User Impact: Admins' TPM attestations may fail during Autopilot self-deployments or pre-provisioning deployments. More info: Specifically, Autopilot self-deployments or pre-provisioning deployments may fail due to this issue. User-driven autopilot deployments are not impacted. Current status: We're continuing to adjust throttling to our service to help mitigate impact. Scope of impact: Your organization is affected by this event, and any admin attempting to use TPM attestations are affected. Start time: Tuesday, October 12, 2021, at 11:40 PM UTC Root cause: A portion of infrastructure that facilitates TPM attestation requests isn't processing traffic as expected, resulting in impact. Next update by: Thursday, October 14, 2021, at 5:00 PM UTC

Hey everyone, we are aware of this issue and our engineering teams are actively collaborating to resolve this. More information will be provided in the Service health dashboard: https://aka.ms/MEMSHD as it becomes available. We apologize for the inconvenience and thank you all for the reports!

I would also like to add i get the error 0x81039024 for securing hardware on windows 11 machines self-deploy.

Ah ok, i know on (https://discord.gg/winadmins) its being discussed as well. So we are not the only ones. other info:

Yea, not sure what is going on the sysadmin discord there is another admin having the same issue. In your 1st post did you say it just started working correctly for you?

HP or Dell?

I was getting FAILED on registering your device for mobile management (6, "0x80180014") Deleted device in Intune per (https://docs.microsoft.com/en-us/mem/autopilot/known-issues#delete-device-record-in-intune-before-reusing-devices-in-self-deployment-mode-or-pre-provisioning-mode)Reloaded Windows now Autopilot Fails at "0x81039001" on securing your hardware....There is hardly anything on google for 0x81039001... I have Cleared TPM. and Confirm device was deleted from Intune. What else Could Cause this? Device info: Windows 10 TPM 2.0 Self-Deploying Thoughts?

I see KMS keys under the products, for example i click windows server 2022 standard i see KMS keys, i just want to make sure those are the ones I'm supposed to use. And there is not a product called "KMS host key" if that makes sense.

But when you say "host key from VLSC" this is the windows server key correct? there is not a Single KMS key you get form VLSC?

I just took over KMS from another admin that is leaving, I got the basics from him, but wanted to ask some questions to make sure I understand what’s going on here, as I have never managed a KMS server before. We needed to add the key for server 2022, from my understanding this will also activate win11 win10 and previous versions of server and desktop. For example, “the KMS host key Windows Srv 2019 allows you to activate all previous versions of Windows, starting from Windows 7/Windows Server 2008 R2.” I would assume the same for win server 2022 standard key form VLSC? When Guides/blogs refer to KMS host key, they are talking about the Host key one gets from the VLSC? So, if I want servers and desktops to be activated I just get the key for Windows Server 2022 standard and import that? The commands I used was the below, is this standard procedure on how to do this? And I fell like those command is for KMS/DNS not KMS/AD. .\cscript.exe slmgr.vbs /ipk 12345-33333-55555-ZZZZZ-XXXXX .\cscript.exe slmgr.vbs /ato .\cscript.exe slmgr.vbs /dlv Mostly Followed this guide: https://theitbros.com/activate-windows-with-kms-server/ If the above is for KMS/DNS what are the commands for KMS/AD (Yes, I know I need enterprise admin). I know one can use “Volume Activation Tools” to add the Key for AD, but how does one do it from the command line? I know we use both KMS/DNS and KMS/AD, as we can find records for both. After running the above commands my test windows server 2022 did activate after a reboot. However why do I hear some people say you need to run 5-25 clients before the KMS will activate them. For example, I would need to spin up 25 windows 2022 server before KMS would kick in? A question about he VLSC, we are EDU So how long before Windows 11 ISO is released on there? I already see it in SCCM an servicing update… Thanks in advance, just need some these cleared up to have a better understanding. -AA