CHiLL

You'd want 'System Center Config Mgr (current branch 1702)'. Once it's installed, you'll probably notice that there are some updates available, which will bring it up to version 1710, with the latest hotfix rollup iif KB4086143). Like others have said, one VM is fine, though I'd recommend being a bit generous with the RAM, as it can be quite heavy. Ours is currently assigned 36GB, which may well be overkill. I'm considering dropping it to 24GB at some point

We are looking into using BitLocker for our off-site staff laptops. I have incorporated MBAM 2.5 into SCCM for reporting and monitoring, which created a collection of MBAM supported devices. I have modified that collection only count laptop/portable devices, which works fine. One of the rules within the query created was that the 'TPM.SpecVersion' is 1.2 or greater. So to find out which devices don't have a TPM or they do and it is lower than 1.2, I have copied the collection and changed the rule to 'is less than' 1.2. However, both collections are displaying the exact same results of 79 devices, and they are the same 79 devices. The query for supported MBAM devices is: select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_OPERATING_SYSTEM_EXT on SMS_G_System_OPERATING_SYSTEM_EXT.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId left join SMS_G_System_TPM on SMS_G_System_TPM.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceId = SMS_R_System.ResourceId where (SMS_G_System_OPERATING_SYSTEM.Version like "6.1.%" and SMS_G_System_OPERATING_SYSTEM_EXT.SKU in (1,4,27,28,70,71) and SMS_G_System_TPM.SpecVersion >= "1.2" or not SMS_G_System_OPERATING_SYSTEM.Version like "6.1.%" or SMS_G_System_OPERATING_SYSTEM.Version like "6.0.%" or SMS_G_System_OPERATING_SYSTEM.Version like "5.%") and SMS_G_System_COMPUTER_SYSTEM.DomainRole = 1 and SMS_G_System_COMPUTER_SYSTEM.Model not in ("Virtual Machine","VMware Virtual Platform","VirtualBox") and SMS_G_System_COMPUTER_SYSTEM.Manufacturer not in ("Xen") and SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ("8", "9", "10", "11", "12", "14", "18", "21") The query for non-supported MBAM devices is: [code]select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_OPERATING_SYSTEM_EXT on SMS_G_System_OPERATING_SYSTEM_EXT.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId left join SMS_G_System_TPM on SMS_G_System_TPM.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceId = SMS_R_System.ResourceId where (SMS_G_System_OPERATING_SYSTEM.Version like "6.1.%" and SMS_G_System_OPERATING_SYSTEM_EXT.SKU in (1,4,27,28,70,71) and SMS_G_System_TPM.SpecVersion < "1.2" or not SMS_G_System_OPERATING_SYSTEM.Version like "6.1.%" or SMS_G_System_OPERATING_SYSTEM.Version like "6.0.%" or SMS_G_System_OPERATING_SYSTEM.Version like "5.%") and SMS_G_System_COMPUTER_SYSTEM.DomainRole = 1 and SMS_G_System_COMPUTER_SYSTEM.Model not in ("Virtual Machine","VMware Virtual Platform","VirtualBox") and SMS_G_System_COMPUTER_SYSTEM.Manufacturer not in ("Xen") and SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ("8", "9", "10", "11", "12", "14", "18", "21")[/code] Anyone have any ideas?

Thanks for the quick replies. I have just checked, and there is only one snapshot, which is the 'VEEAM BACKUP TEMPORARY SNAPSHOT'. All the other servers are the same. Cheers, I understand that now. I have noticed that there are multiple .vmdk files per server when browsing the datastore, so I'm thinking that they are taking up the space. How do I remove these old/zombie /.vmdk files?

I've come across an issue where our VMs appear to be over allocated in terms of storage space. The OS disks for our VM servers are located on 15K SAS drives spread across our HP MSA. The data/storage drives are located on 7.2K SAS drives over the same two MSAs. The 15K SAS drives have limited space - and we have very nearly reached that limit (warnings have appeared within vSphere regarding storage limitations). Upon inspecting the VMs, I've noticed that our servers drives/partitions are thick provisioned to a certain size, however the 'Maximum size' value is much higher. I thought thick provisioned pre-allocated the space as could not get any larger. Thus meaning that the 'provisioned space' appears much larger than what we've actually allocated. Maybe my understanding is a bit off, but could someone explain this situation and what I can do to free up unused (if any) space? I've attached a screenshot of an example of one of the over-allocated servers. [ATTACH=CONFIG]47956[/ATTACH] Thanks.

A number of our iPads weren't purchased using DEP at the time. If I remember (this is vague), if an iPad is able to receive iOS 10.x.x (can't remember exactly which version) then you can enrol the devices yourself into DEP. If not, then you'll have to contact the supplier you purchased them from and they can enrol them into DEP using the serial numbers, or provide you with the information for you to do it yourself.

We've only been using InTune for about a week and so far so good. Once everything is set up that is. We had been using Apple Configurator and Profile Manager for a couple of years, but it was a little borked. Before Christmas we used the trial versions of both Jamf and ZuluDesk. Honestly, despite the great recommendations about Jamf I came across online, including on this forum, it seemed overly complicated to use, but they had great support, pretty much instant telephone and email support, along with their community forums. Comparing that to ZuluDesk, ZuluDesk was vey easy to use, a great interface and pretty straight forward when using it. However, the support for ZuluDesk was pretty poor. The website had loads of references to support pages that didn't exist any more and contacting them took at least 24 hours for a reply, not great when you're up the creek and the iPads are needed asap! Pricing: I think both Jamf and ZuluDesk resellers were quoting around to £6/7 per device mark, which with out 80 iPads would be around £480/£560 per year. InTune is on our OV-ES agreement, though looking at it, not sure how they've calculated our licensing. We have 74 FTEs, a further ~50 non FTE staff and ~600 students. We've been priced at 888 licences, which totals £372 per year, so about 41p per user. What this means, is that we can increase/decrease the amount of devices we have without incurring any changes to our licensing. One of the great benefits of InTune is that we can add as many Windows and Android devices to it at no extra cost. We are planning on migrating our staff laptops away from our on-premis SCCM to in-cloud InTune management. In terms of setting it up, there were a few issues that we needed assistance with, namely corrupt device groups and figuring out why some settings weren't syncing and restricting/hiding apps. We used Microsoft's support (who have a severity scale to choose from, like Office 365 support) and they'll get back to you within 2, 6 or 8 hours, depending on your severity level. They were able to sort out our issues and provide guidance as needed.Now it is all set up, it's fairly straight forward. Things to note: You cannot set the iPad background using InTune. This is annoying, given that it can be done on other MDMs. Hiding/Restricting apps have to be done using very specific App information. You need to know the following: App name, Bundle ID, URL and Publisher. - App name is how it appears in your list of purchased apps (not how it appears on the iOS device) - Bundle ID is the specific ID for the app - URL is the iTunes store app URL - Publisher is self explanitory For example, to hide 'Find iPhone' from the iPads, I had to enter the following information: - App name: Find iPhone - Bundle ID: com.apple.mobileme.fmip1 - URL: https://itunes.apple.com/gb/app/find-my-iphone/id376101648?mt=8 - Publisher: Apple - Repeat the process for each app you with to hide To configure the home screen layout, you also need to do this using the App Name, Bundle ID, URL and Publisher. Annoyingly, the Bundle ID can only be viewed on store purchased app. Apps purchased using VPP will not show the Bundle ID. Therefore you will need to add the store app version of the app you want. Once the store app is added in, you can copy the Bundle ID and use that to configure the home screen for the VPP version of the app. Helpful site to find the default/built in Apple apps with bundle IDs: https://emm.how/t/ios-11-list-of-default-apps-and-bundle-id-s/465

Turns out that we missed a trick when configuring these iPads from Factory Reset. We had all the setup options skipped, except for Location Services, which we need to enable during the initial iPad setup. Turns out we also need to not skip the iCloud signin stage. So once the iCloud account details are filled in, it will register the device to the account and then appear in Find iPhone. As our devices are already provisioned, I'll have to allow Account Modification, then go through our iPads one by one, entering the iCloud account details. Once done, disabling Account Modification.

We have recently switched to Azure InTune for managing our iPads and got them pretty much configured how we want them. Previously, we were using Apple's Profile Manager and we were able to locate each iPad using Find iPhone on iCloud, as each device was signed into the AppleID. However with InTune, we have set the option named 'Account modification (supervised only)' to 'Block', so that the AppleID section appears grayed out and cannot be modified. We are using VPP and Apple School Manager, which I think is why the Apple ID is not signed in on the iPads. We have also tried leaving the 'Find iPhone' app unhidden and signing into it using the AppleID, then hiding the app again. However it is still not appearing on iCloud. Anyone know how I can get this working?

Well I certainly don't plan on working between 9pm and 6am! I can confirm that the application deployment is set as 'Required', rather than 'Available'. 'Software Installation' is checked and 'System restart' is unchecked. I have definately also used /norestart in the deployment.

No, only via SCCM. Though this is happening with both Application Deployments and Software Updates.

I've tried doing that before, however I've had issues with pending reboots in the past, specifically with the /norestart switch. So with the 'Software Installation' checked, but 'System Restart' unchecked for a deployment with /norestart...the software would install and the user would receive a notification that a restart was pending. Then the user would be asked to either restart now or postpone for up to four hours. If postponed, the user would then receive a message saying 'this computer will restart in 90 minutes'. This restart cannot be prevented and it will restart (which is extremely annoying). I don't know if changing the user notifications to 'Hide in Software Centre and all notifications' would prevent this, but I'm assuming not.

I have created an application to deploy out to the whole site via SCCM, and would like it to be deployed as soon as possible and have a deadline as to when all machines should have it. However, I have created the application deployment with what I thought was the correct settings, however the clients are showing 'scheduled to install after 1/22/2018'. In the scheduling tab of the deployment, I have configured the following: Time based on: UTC Schedule the application to available at: 22/12/2017 13:01 (I originally used the make available from now option, which sets the available from time to the time when the deployment was created) Installation deadline: Scheduled at 22/01/2018 21:00 I have deployed this application to a collection called 'Application Deployment | All Windows 10 | 64-bit'. (Which as it sounds, contains all Windows 10 64-bit clients) I have a maintenance Window enabled for 'All Deployments' on another collection called 'Software Updates - Windows 10' (Which as it sounds, is for Windows Updates and contains all Windows 10 clients) Do maintenance windows cover application deployments? If so, I am assuming that the maintenance Window will still take effect and prevent the application installation outside of the window, even if it application deployment and maintenance windows are configured on different collections? As the machine is a member of both groups.

Good to know it's not just me then! I've made some progress: I used 'Auto Apply Drivers' but selected 'Install only the best mateched compatible drivers' instead of 'Install all compatible drivers'. Though it was still limited to my specific driver package for this machine. Now the TS/ODS has installed all the missing drivers, except one from the chipset. The rest of the missing chipset drivers, the graphics and MEI installed correctly. The 'PCI Memory Controller' (which is actually 'Intel PMC - A2A1' after manual installation) still failed to install, but at least it's progress. How installing best matched is better than installing all, I don't know.

I'm having a mare with drivers for a new varient of desktop that we've purchased. It's a HP ProDesk 400 G3, compared to the previous HP ProDsk 400 G1 machines. This new machine requires different drivers and we are using Windows 10 Education 1709 x64. So I have downloaded all the drivers from HP's site and also found that on a bare install of Windows 10, only the Intel chipset drivers, graphics drivers and Intel MEI drivers are missing. So with that in mind, I have imported those drivers into SCCM and created a new category and driver package for them, and distributed the package. I have then created a test TS (we have MDT integrated) to deploy Windows 10 and included 'Auto Apply Drivers' and selected the new driver package. When the TS/OSD completes, I notice that the machine is using a basic resolution and when I check Device Manager, there are drivers missing for the chipset, graphics and MEI. I tried the TS/OSD again with 'Apply Driver Package', which yields the same results. To check the drivers, I have manually selected the missing drivers and updated them, pointing them to the driver location on SCCM's sources$ share. The drivers install find without issue. I have checked smsts.log on the imaged machine and cannot seem to find anything relating to drivers. I also do not have any filtering on, such as using WMI filters based on model. Anyone got any ideas?

That would be fine - except we have a (tempremental) GPO that prevents users from logging on with domain credentials when the domain is not present. So I could log the laptop on with their account before handing them the laptop - however it wouldn't work for other accounts on that laptop.

Can you clarify that? I don't know what you mean by provisioned it. We deploy the TS which installs/configures Windows and software, which is what I understand of provisioning.

That's why I'm stuck - how do I get the laptop to connect to our VPN from home, using Always-On VPN?

It is Always-On VPN that I am testing. I configured it all, following Microsoft's documentation and now it's a case of pushing those settings to the clients. This can be done using SCCM's compliance settings according to Microsoft, which is what prompted me to create this thread.

They are domain-joined machines, just with local accounts created on them for use off-site. They are also SCCM managed.

Windows 10 Education 1709 x64.

I have created a VPN profile within SCCM's compliance, which is fine. I can deploy it to user collections and the test user will see the VPN. However, when deploying to the machine collection, the test machine doesn't receive it. Ideally I'd like it so that all staff laptops receive the VPN connection, so when they take their laptops off-site, then can connect to the VPN from the login screen and then they can log in with their domain credentials, instead of a local account on the laptop (if that is actually possible). Otherwise, if I have the VPN connection pushed to a collection containing DomainUser1...and they are off site using the account LocalUser1...how are they going to connect to the VPN from home? I'm assuming that the user would need to log on as DomainUser1, but they cannot as they aren't on the domain?

Cheers for that. We did a clean install. I'll find the latest Intel driver and see how that works.

Hello. Since we have upgraded from Windows 10 1607 to 1709, we have noticed that Wake-on-Lan has stopped working. WOL was working correctly when using 1607 and Windows 8.1. I think it has something to do with the way that Windows 10 shuts down the computer, as the Ethernet link lights are off. On 1607/Windows 8.1...they would still be flashing, even with the PC off. I have performed the following: 1) Checked that 'Allow the computer to turn off this device' is unchecked on the Ethernet connection. 2) Ensured that Wake-on-LAN is enabled in BIOS. What I have found, is that if I manually shut down the computer or use Impero to shut down, the link lights are off. If I power on the PC and go into BIOS...and THEN press the power button to shut down the PC...the link lights are on. That to me points this to being a Windows 10 1709 issue. After some quick Googling, others have had issues with 1703 Creators Update, but I can't seem to find a solution. I'm wondering has anyone else encountered this or got it sorted?

I've been looking into Always-On VPN from Microsoft and started to implement it for testing. I'm looking at networking section and it recommends having a DHCP scope set up for VPN clients. I have created the scope, set the pool and set the default gateway address. Now...I have no network config set up for this traffic and I've gotten a bit stuck. So I have the following: VPN server with 2x NIC; 1x 10.22.0.x on our DMZ and 1x 10.22.11.0 on our server VLAN. Route created between the NICs. Certificate server configured as per Microsoft's documentation. NPS server configured as per Microsoft's documentation. Firewall rules created to our DMZ IP Internet DNS created to our Internet facing VPN URL DHCP range set up for; 10.22.220.x/24 with 10.22.220.1 as the default gateway and 10.22.220.2-254 as client addresses. We have a HP ProCurve 5406Rzl2. 1) How do I create a default gateway, so that our authenticated clients on the VPN DHCP scope can talk to the rest of our site and access their home folder, shared drives, etc? 2) Do I need to VLAN this traffic off? If so, what commands are needed for this? Thanks!

Thought of that, but we are doing mock exams, in exam conditions. Our exam invigilator would like the computers ready, rather than wasting time waiting for them to log in.