Manny-Tech

Would you join a public facing web server to a domain? The web server will need to 'talk' to Active Directory for user authentication. I guess an LDAP bind would be sufficient without the need for a domain joined web server?

We have recently had our staff / student advantage applied to our tenancy. I can now apply the license to our users. Before I release this to users I'd like to check the functionality of it. I have managed to install the software from my O365 account onto a device (Win 7 Desktop), I have also signed into Office 2016 on said device. I was under the impression if a license was removed, or a user de-activated a device that the functionality of Office would be reduced on that advice; i.e. you can't save or edit documents, you can only do read only. I have de-activated my device on my O365 account, however I can still do what I like on my Win 7 desktop, there is no reduced functionality. Is this expected? Does it take a certain amount of time before you get the prompts to activate it before you can use it again? My biggest worry is I'm giving students access to five devices, they then leave but retain a free copy of Office.

I've briefly just read of something call passport npm which maybe something we're after https://github.com/bergie/passport-saml/blob/master/docs/adfs/README.md If we can apply passport npm to each express.js then we can query for specific group memberships such as 'staff' or 'student' or 'admin' etc..

My plan was to take name, email, group memberships for starters. As you mention in your steps, it's having a database to store these attributes but crucially whether this node application has the auth classes to check the attributes to give users access to the bits they should have access to. So essentially, I need to find a database for node that will hold the attributes we want from AD and hope the web developer can find something for his node application to check against it.

Are you in a similar position, i.e. web application to access and using ADFS as the gateway to providing authentication to your Active Directory? The position I'm in we have http://www.schooldomain.com for users to browse to. We'll have a /home for all users and a /staff for just staff access I'd imagine there will be a /SLT for the management team too. I'm just struggling to visualise how I can get this node.js application to give access based on attributes of the user. I suppose the biggest flaw is I don't know enough about Node.js. In my head I've got it similar to O365 SharePoint Online. User and relevant attributes such as groups are copied to a database on the web server which is assigned against particular parts of the website. User goes to authenticate, they bounce to the ADFS for validation and then come back to website with token and from there on the website is able to match up the two accounts based on a certain attribute and give them access.

Hi Sted, That's what I already have configured, it selects from HP and Compaq 8000 SFF. As it has two versions of the NIC in there I assumed it would base it on version but it doesn't seem to be doing. It's not a massive problem, because it can be updated after, but it'd be nice if it actually chose the up-to-date version.

MDT and WDS for me. Does the job perfectly and is great for granular customisations to an image.

I deploy my drivers based on manufacturer and model, one particular model a HP Compaq 8000 SFF had a problem with WOL and I needed an updated driver, I have imported this into MDT and updated the deployment share etc.. Yet when I do an install it still picks up the older driver. How does the driver selection work? Does it pick any that match PnP IDs or should it be selecting the latest version?

We have ADFS setup for other services, so potentially that is a route we can use. I guess I need to find from the developer what he has built his website and webapps on.

As a school we are moving away from our VLE environment (SharePoint 2013). We have an in-house web developer who has taken all the things we used in SharePoint and developed his own and plonked it onto our website. This side of things doesn't concern me, however, the user authentication and access does. In SharePoint we pulled users and groups from AD we could then manage permissions based on those attributes. We have no such facility currently when we move everything to our website. In the summer we will be moving our website from hosted onto our internal environment. The in-house developer has started work on this and I'm led to believe he has used Webstorm to interact with Node to develop this. Ideally, users would login with their AD credentials, how would we go about this? I appreciate I may not have all the information you require, but I'll do my best to answer any questions.

Just to confirm that @jaminben solution worked perfectly.

I do that for my drivers, which was the basis which got me thinking I could do it with applications. I'll give @jaminben option a go later on.

Is it possible to edit the MDT wizard to add another stage? What I'd like to do is configure a page with radio buttons for my techs to select which department this machine will be a member of. Once selected it uses a selection profile for all that departments software.

Over the past few weeks I have accumulated network card configurations such a Power Management and Wake on Magic Packet etc... for differing models of desktop. Currently I have an application within MDT for different models which is selectable during the MDT Install Wizard. What I'd like to achieve is possibly insert this into a task sequence but have a variable for only running if the machine is a certain make / model. Is this possible? Or are there other ways around this? Any help would be appreciated.

Not really, until it's possible for the users to get the same experience on all devices I don't want to be having to say 'it works fine internally unless you're BYOD, externally you may or may not get a Windows Security box etc..'. Like I said previously, I've tried the user agent string but it messed other apps up for us. ADFS isn't solely about SSO, it's about consolidating and combining one account to access numerous applications like Google Apps, O365, our VLE and our help desk system. I'd love full SSO internally but it's not achievable for us right now, however it is possible to make things that little bit easier for our users by allowing them to access four different systems with their one domain account.

I've attempted this before but I had other web applications expecting IE user agents which caused those applications to stop working. I also had the problem with your BYOD devices not supporting WIA therefore getting the Windows Security dialog box, it doesn't look good. In the end we chose Forms Authentication which suits all devices. It's a shame that Microsoft can't enable it to priortise; if SSO/WIA is unavailable then switch to Forms. One of my friends works in another local school and he went down the route of having his BYOD devices on a seperate VLAN therefore making use of a different DHCP scope which then redirected them to a DNS server pointing to the ADFS WAPs which then prompted for Forms Auth. Not ideal, but it's a work around. I think I'd rather do that than mess with custom user agent strings.

I'm unsure on TMG, I've never used it but I'm fairly sure it acts in the same way as the ADFS WAP which will still mean Forms Authentication.

By design you can only do Forms Auth externally. Internally you're already authenticated to the domain, externally you are not which is why you have to provide credentials. Standard format. Glad you have it working internally though.

If you're using site to zone assignment, I assume it's set to '1' and in the format https://FQDN. Also, could you run the below command from Powershell and display the output? Get-ADFSProperties | Select -ExpandProperty WIASupportedUserAgents

The first two images look as though you don't have your internal DNS name for your ADFS servers in the Intranet zone.

Can you send us a screenshot of your ADFS auth setup? Like @mrbios says, it sounds like you have the internal network to use Forms Authentication? Externally you're only ever going to get Forms.

It's only taken me 3 and a bit years to contribute something meaningful As a standard I have a folder on the server that I robocopy (mirror) to all machines at startup, the first copy can take a minute or so but after that it only does changes. I have folder redirection for all user groups in there, also I have the delprof2 tool so I can remove profiles remotely as and when I want.

Is it a standard image that wouldn't change? If so, can you not just drop it into a folder on the machines and run a command from Impero to launch it? Or an image on a network drive where everyone has access to?

I found the solution courtesy of Change Drive Letter - Script Center - Spiceworks Seems to do the job I'm after as we use H and I as mapped network drives.

Windows Firewall?