CHiLL

We're using InTune. It was a bit of a mare to set up and it's not as straightforward as the likes of ZuluDesk, but once it's up and running we haven't had that much in the way of problems. A couple of things that InTune can't seem to do that annoy me: Setting a background image on iOS Displaying the device name on the lock screen

Well we do have another script for the delta too, which produces the same message in Powershell.

Usually when a change to an account has been modified and needs to be synced with Azure quickly.

I believe so, we just have a basic script to run it on demand if need be. I'll have another look on Monday. Edit: Though thinking about it, that script doesn't actually call/run the scheduled task. It purely runs the specified AzureAD cmdlet.

So after discovering that the execution policy has been set to Bypass site wide by a GPO, I've changed the configuration to RemoteSigned. I did some testing with scripts that I've made and they executed fine. However we have some scripts that launch tasks on our 2012 R2 servers, such as a manual DirSync...and they're running/executing...but returning this error message: I have performed "Get-ExecutionPolicy -List" on the server with the following results: The GPO that was amended was: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell > Enabled: Allow local scripts and remote signed scripts. I don't understand why the CurrentUser is Undefined when it has been defined at the machine level. (Logged on as a domain admin) Edit: Found this Microsoft blog with the same issue: https://blogs.msdn.microsoft.com/pasen/2011/12/07/set-executionpolicy-windows-powershell-updated-your-execution-policy-successfully-but-the-setting-is-overridden-by-a-policy-defined-at-a-more-specific-scope/. I didn't want to have to go round the servers and set these manually, but if needs must! Edit2: Changed those on the server and now they're all showing as RemoteSigned, but the script is still complaining. The script is only three lines (and one is commented out and the other is a pause command!): Start-ADSyncSyncCycle -PolicyType Initial # & "C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe" Yet the same error is returned. The error references a command for "Set-ExecutionPolicy Bypass", which is clearly not in my script. I wonder if the "Start-ADSyncCycle" command is trying to call something else with a Bypass command in that?

I have two VMware hosts at present that are hosting 20 VMs between them. Our VMware support agreement is nearing it's end and now we're looking at whether Hyper-V is a more cost effective solution for our virtual environment for the coming years. 1) Is it true that there are no extra costs to use Hyper-V, providing that we have server licenses? We are currently on the OVS-ES licensing agreement and have 2x hosts, with 2x CPUs with 8x cores each. So 4x CPUs and 16x cores. Is that license enough to cover all our Hyper-V needs? 2) How does Microsoft deal with the support aspect of Hyper-V? Is it like VMware where you pay for a support contract, or is it included within the licensing agreement described above? 3) Is there anything else from a cost perspective that I need to think about regarding the migration from VMware to Hyper-V?

Cheers, though the .NET Framework 4 Client Profile setup wizard states that it is already included within this version of Windows (1709). We are using the latest Flash player (29 I think). Microsoft Visual Studio Tools for Office 2010 was not installed. I have installed that on my test machine and the same problem exists.

I've just created a new MST with those two options removed, but unfortunately it is still prompting for the reboot at the same stage. During the installation of the SMART Product Drivers, I do hear the 'USB connected' sound, so I'm presuming that is the virtual hardware SMART adds in?

That's how we used to deploy it and I've dug out that script - same issue. That's strange. We install .NET 3.5 during the OSD (and deploy it with SCCM, in-case it fails during the OSD). - which version of Windows are you running? We are entirely a 1709 site at present, which I think may a factor with this issue. I do plan on testing 1803 in the near future, but other projects have taken priority. MST Options (if not specified here, it hasn't been modified): General Options > Product Selection > Activate software during installation General Options > Product Selection > SMART Product Drivers General Options > Language Selection > English (United Kingdom) General Options > SMART Product Update > Do not install SMART Product Update General Options > Customer Experience > Disable the Customer Experience Program on all devices SMART Notebook > Install the Gallery on each computer SMART Notebook > Get Gallery Content > If it is processed in the same order as the settings are laid out in the SMART Install Manager, then it is within the first section that it fails, as the SMART Product Drivers are selected in there.

Yeah, here it is: [ATTACH=CONFIG]49038[/ATTACH] With the /qb command instead, this is what I get (shows the step that is prompting for the reboot): [ATTACH=CONFIG]49039[/ATTACH]

It also comes up with the /qn switch.

Yeah, system and hidden are my usual configuration for applications deployed by SCCM. I have a feeling that the MSI is causing the issues somehow, so if I can nail down the issue that occurrs during the batch file install...hopefully the same fix can be used in SCCM.

We do have a MST file as well, but that does the same thing...hangs prompts for a reboot at the SMART Product Drivers installation. So far I've tried: msiexec /i "\SMARTEducationSoftware.msi" /q /norestart TRANSFORMS="\NotebookONLY.mst" msiexec /i "\SMARTEducationSoftware.msi" /q REBOOT=ReallySuppress TRANSFORMS="\NotebookONLY.mst" msiexec /i "\SMARTEducationSoftware.msi" /q /norestart AdminCFG="\NotebookONLY-New.xml" msiexec /i "\SMARTEducationSoftware.msi" /q REBOOT=ReallySuppress AdminCFG="\NotebookONLY-New.xml"

I'm having issues with the silent installation of SMART Notebook 11.4. Ideally I'd like to be able to push it via SCCM, but first I'd like to get it working through a batch file. We always encounter issues at the same point - during the SMART Product Drivers installation section. This appears to be an issue that started when we migrated from Windows 8.1 to Windows 10. Windows 8 would not prompt for a restart, but Windows 10 does. This prompt for a restart then hangs the installation, which will then timeout and fail. I have tried /norestart and also REBOOT=ReallySuppress in the command line with no avail. I have also used the SMART Install Manager to create a configuration XML file, which yields the same results. Any way to suppress the reboot so it can silently install on Windows 10?

Turns out - Don't install MBAM on the SCCM server. SCCM is so reliant on IIS for the clients to connect that when the SPN was specified for MBAM, it caused the clients to stop communicating. Removing MBAM and the SPN configuration and installing it on another server worked fine. Moral of the story? Leave the SCCM server the hell alone!

The issue was caused by using the server's self-signed certificate and the clients not trusting it. This was evident by browsing to the SSP/Helpdesk page for MBAM and checking the certificate in the browser. I issued a signed certificate from our on-site CA and assigned that within both IIS and the SQL Reporting Services and the devices were able to communicate and trust the MBAM server.

For 1) and 2) - Turns out the GPO wasn't working correctly. I recreated it from scratch and it worked. For 3) - You can enable the setting 'Enforce drive encryption type on operating system drives' in the normal (non-MBAM) GPO settings (Windows Components > BitLocker Drive Encryption > Operating System Drives) and it won't cause issues with the MBAM settings. That does then enforce full disk encryption.

I'm currently testing the MBAM BitLocker encryption for removable and fixed data drives and wondering if it is possible to disable the 'How do you want to back up your recovery key?' page during the BitLocker wizard? The key will be stored in the MBAM Recovery database and users can use the SSP or Helpdesk to recover their drive if need be. So with that, why am I not able to disable/skip the 'How do you want to back up your recovery key?' page? I have tried the following settings too: Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives > Choose how BitLocker-protected removable drives can be recovered > Omit recovery options from the BitLocker setup wizard Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Removable Drive > Choose how BitLocker-protected removable drives can be recovered > Omit recovery options from the BitLocker setup wizard However the BitLocker wizard complains of conflicts when either are enabled.

@Steve21, @Arthur and @sted thanks for the clarification! That makes sense now, so I'll be sticking with Windows 10 Education and leaving Pro Education alone!

I'm looking at modiying our 1803 WIM and importing it into SCCM, but I've noticed that there are now two versions of Windows 10 Education: Windows 10 Education Windows 10 Pro Education We've previously been using Windows 10 Education for our prior builds since 1607. What's the difference between these two new versions of Education and which one should I chose?!

I have recently installed MBAM 2.5 SP1 on the same server as our SCCM installation (Server 2012 R2 VM).It appeared to be working fine, but I've found that since I've configured the SPN for MBAM, our SCCM are not talking to the server any more. I performed the following commands for SPN: setspn -s http/ \ setspn -s http/ \ If I remove those SPNs entirely, our SCCM clients will start talking to the server again...but the MBAM client cannot talk to the server. So it appears only one can be enabled. I've found an error in the System Logs of a client that attempts to authenticate with the SCCM server whilst the SPN is registered for MBAM: [ATTACH=CONFIG]48914[/ATTACH] When the SPN is deregistered and the SMS Agent Host service is restarted on the client, the error doesn't reappear and the client receives the applications/updates. What's the best solution to get both services running on the same server?

@Arthur, is that still the latest version of the script?

I have installed MBAM on our site and deployed the client to a test laptop. However the client is not launching. Checking the Event Viewer under Application abd Services Logs > Microsoft > Windows > MBAM > Admin...I get the following error when mbamclientui.exe is executed: Error - Event ID 2 An error occurred while applying MBAM policies. Volume ID:\\?Volume...................................................... Error code: -2146762487 Details: A certificate chain processed, but terminated in a root certificate which is not trusted by the provider. The MBAM server is installed on the SCCM server (with SQL 2012)...MBAM server appears to be set up correctly. I have checked the SQL Reporting Services Configuration and tried using the ConfigMgr SQL Server Identification Certificate (which binds fine), but the client produces the above error. I have also tried using a self-signed certificate by creating one from the IIS Server Certificates options. Any ideas?

I have installed MBAM correctly, deployed the MBAM client to a test laptop and now looking at the GPO configuration. I understand that I'm only to change the settings within 'MDOP MBAM (BitLocker Management)' section, not the 'BitLocker Drive Encryption' section, as those settings are autoamtically configured when the MBAM settings are changed and changing those manually could break the BitLocker configuration (stated by MS in MBAM articles). With that, I've enabled the settings for the OS drive encryption and noticed three things: 1) I have set the 'Encryption Policy Enforcement Settings' to '0', which should automatically start the encryption on the device - but it isn't. The device is only being encrypted when I manually enable BitLocker on the OS drive (right clicking the drive) 2) When the BitLocker wizard is manually started by right clicking the OS drive, it opens the wizard but then asks 'Choose how to unlock the drive at start-up' and gives three options; Enter a PIN (recommended), Insert USB flash drive or Let BitLocker unlock my drive automatically. As encrypting OS drives will only be for laptops, I'd prefer to use the latter option, as the drive will be encrypted if it is stolen and a local username and password is required to log in to access any data on it. How to I set the GPO using MBAM to have this as the automatic option? Ideally so that window doesn't appear at all. 3) From what I've gathered the default disk encryption level is used space only. Ideally I'd prefer it to be full disk encryption, but I can't seem to set that via MBAM GPO. Any idea how I can set this? Thanks.

We have a bunch of shared iPads that different students use throughout each day. These iPads connect to our Internet through our Smoothwall filtering by entering their AD username/password. This is working fine, however we've noticed that some students have decided it's a good idea to save their passwords in the browsers. Now, I've managed to effectively disable password saving in Safari, but I cannot configure Chrome in the same way. We use Microsoft Azure as our MDM and noticed that they do have a section for 'App configuration policies'. However I don't know how to configure this, or even if it can actually do what I'm after. Anyone have any ideas?