The Experience Blog

A blog with focus on experiences with the Windows Client operating systems…
RSS icon Email icon Home icon

  • Intune/ConfigMgr email profiles are removed and not readded on iOS devices

    Posted on July 16th, 2014 By Andreas Stenhall + No comments

    If you are using System Center Configuration Manager 2012 R2 and Windows Intune to deploy email profiles to your iOS devices you should be aware of the fact that the email policy will vanish from your users’ iOS devices and then user then need to log in to the company portal for the email profile to get deployed once again to the iOS device. This is true in the following scenarios:

    • You make a change to the email policy, for instance changing the name of the email policy in the ConfigMgr console.
    • You install Cumulative Update 2 for System Center Configuration Manager 2012 R2.

    No status on a fix for this bug at the moment.

  • Remove client from collection in OSD task sequence using Orchestrator

    Posted on July 7th, 2014 By Andreas Stenhall + No comments

    A common setup when using System Center Configuration Manager to deploy is to have an OSD collection which has a required deployment. Moving clients to that Collection will let them be reinstalled or installed. After deployment is done you typically want the machine removed from that collection. There are a few ways of doing that but my favorite is using an Orchestrator runbook.

    Orchestrator Runbook Configuration

    Note: In this guide I assume that you have installed System Center Orchestrator 2012 SP1 or 2012 R2 in your environment.

    1. First you need to download and install the Orchestrator Integration for Configuration Manager which will add the items we are using to remove the machines from a Collection in Orchestrator Runbook Designer.

    2. Start Orchestrator Runbook Designer and setup the connection to the ConfigMgr primary site server by going to Options > SC 2012 Configuration Manager.

    3. Add a connection to your SCCM server and make sure to test the connection using the Test connection button before proceeding.

    ORC23

    4. Now Create a new Runbook and go to Activities > Runbook control and drag “Initialize data” to the Orchestration pane. Do the same by choosing SC12012 Configuration Manager under Activities, and then drag  “Delete Collection Rule” out on the Orchestration pane.

    5. Hover over the Initialize data icon and then drag the arrow to the Delete Collection Rule. It should look like the below image.

    ORC
    6.  Right click Initialize Data and choose Properties. Add two details and name them CollectionID and ClientName.

    ORC21

    7. Right click Delete Collection Rule and choose Properties. Start by choosing the connection you created in step 3. Note: Do not type in the text as below, instead right click the area right to Collection and choose Subscribe > Published Data. Choose CollectionID and click OK. Repeat for Membership Rule. Choose Finish when done.

    If you type in the text manually you will get this error when executing the runbook: The SMS Provider reported an error. Details: Generic failure

    ORC22

    8. Before proceeding I strongly recommend that you execute the runbook in test mode, supplying a client name and collection ID of a machine located in the collection you want the client removed from.

    Note: Do not forget to check in the runbook after testing and when you are done, or it will fail to execute during operating system deployment.

    Task Sequence Configuration

    Now that the runbook is running successfully you can use it in your Task Sequence. Note: This requires that you have integrated Microsoft Deployment Toolkit with Configuration Manager and that you are using an MDT Task Sequence.

    Modify a task sequence and create a New group. The recommended section to run the Runbook is in the State Restore phase of the Task Sequence. To be on the safe side first run a “Gather”, then you must add “Use Toolkit Package” and last but not least execute the actual runbook by adding the “Execute Runbook” step.

    ORC4

    Also note that runbooks are run with the SCCM network access account so you must add that account to the Orchestrator user group that you have assigned, check the permissions and which group name to add to the relevant Orchestrator group in  Runbook Designer by right clicking the name of the runbook tab and then choose Permissions.

    If you do not you will get this error in the  ZTIExecuteRunbook.log (where all events related to the runbooks are stored):

    Unexpected response from web service. 405 Method Not Allowed
    < ?xml version=”1.0″ encoding=”utf-8″ standalone=”yes”?>
    < error xmlns=”http://schemas.microsoft.com/ado/2007/08/dataservices/metadata“>
    <code></code>
    <message xml:lang=”sv-SE”>The requested operation requires Publish permissions on the
    Runbook</message>
    < /error> ZTIExecuteRunbook 2014-07-03 10:01:56 0 (0×0000)

    Happy orchestration and deploying!

  • Adding SYSTEM to Administrators group causes modern apps to fail in Windows 8.1

    Posted on July 4th, 2014 By Andreas Stenhall + No comments

    After extensive troubleshooting, hours after hours, I have finally located a certainly interesting problem with the install routine of modern apps, including the immersive control panel in Windows 8.1 (with Update).

    Problem description

    Whenever a user logs into a domain joined Windows 8.1 machine all modern apps included in the image have “x” / crosses on them and they cannot be started. Also the immersive control panel an all its settings are unavailable. A few of the error messages and codes:

    Trying to start a modern app:

    This app can’t open. There’s a problem with <app name>. Contact your system administrator about repairing or reinstalling it

    or

    This app does not support the contract specified or is not installed.

    and in Swedish:

    Den här appen stöder inte det angivna avtalet eller så har det inte installerats.

    Trying to install an app using Add-AppxPackage PowerShell cmdlet:

    Add-AppxPackage : Deployment failed with HRESULT: 0x80073CF6, Package could not be registered. error 0x8007064A: Cannot register the request because the following error was encountered while initializing the windows.repositoryExtension extension: The configuration data for this product is corrupt. Contact your support personnel.

     

    Cause

    After going through a bunch of GPOs and hundreds of settings and excluding the most likely settings I finally reached out to what turned out to be the cause. Simply the use of “restricted groups” in group policies to add NT AUTHORITY\SYSTEM to the local Administrators group on the Windows 8.1 machines is what is the cause. The problem can easily be reproduced by adding SYSTEM to the Administrators group on domain or non-domain joined machines.

    Solution

    The solution is to remove SYSTEM from the local Administrators group from being applied via restricted groups. Adding the group SYSTEM to the local Administrators group is not necessary as SYSTEM is a member of the Administrators group per default, although it is not visible in the GUI (Computer Management).

  • Solution to the UUID problem when deploying Windows 8.1 using ConfigMgr 2012 R2

    Posted on June 28th, 2014 By Andreas Stenhall + No comments

    When deploying Windows 8.1 Machines using System Center Configuration Manager 2012 R2, me and as good as everyone ever done a Windows 8.1 deployment using CM2012R2, has seen the issue. The issue is that the first time a user log in to the deployed machine, it gives an error:

    The Group Policy Client service failed the sign-in.
    The universal unique identifier (UUID) type is not supported.

    The problem has been seen from time to time but at last there is a solution to this elusive problem. The solution or workaround actually, is provided in KB2976660: First logon fails with “The universal unique identifier (UUID) type is not supported”.

  • UAC settings when remote controlling Windows clients to prevent screen freezing

    Posted on April 13th, 2014 By Andreas Stenhall + No comments

    One very common problem that I encounter every now and then with customers and when doing Windows training is the fact that remote controlling computers causes a freeze in the remote session when UAC kicks in. By default, UAC prompts for elevation on something called the secure desktop, and that effectively blocks any remote input.

    This problem can be fixed by changing the necessary UAC settings. Just as a note; Never ever turn off UAC!

    Configure UAC to allow for remote support by setting the following GPO settings under Computer Configuration / Policies / Administrative Templates / Windows settings / Security settings / Local policies / Security Options node:

    User Account Control: Switch to the secure desktop when prompting for elevation policy = Disabled
    User Account Control: Allow UIAccess application to prompt for elevation without using the secure desktop policy = Enabled

  • 80070002 and 80072ee2 error when deploying Windows using ConfigMgr 2012 R2

    Posted on March 27th, 2014 By Andreas Stenhall + No comments

    Encountered an interesting issue doing Windows 8.1 Deployment using ConfigMgr 2012 R2. A specific model was constantly failing at the very last step in the task sequence. The smsts.log revealed a few errors with the codes 80070002 and 80072ee2, failing at random files every time from the MDT Toolkit Package.

    A few examples:

    DownloadFiles() failed. 80072ee2.
    DownloadContentAndVerifyHash() failed. 80070002.

    It seems Microsoft is aware of the issue and the current workaround is to set the following variables first in the task sequence to address the problem until it hopefully will be fixed in a coming hotfix.

    SMSTSDownloadRetryCount = 5
    SMSTSDownloadRetryDelay = 15

    After settings these variables the deployment finish as expected.

  • Feature deploying email profiles to iOS using Intune/ConfigMgr

    Posted on March 18th, 2014 By Andreas Stenhall + 1 comment

    There is something fishy going on when deploying email profiles to iOS devices using Windows Intune and ConfigMgr 2012 R2. When you have deployed an email profile to an iOS (7.1) device you cannot choose to send pictures from that email account, as the account is then missing from the drop down menu when choosing “From”.

    If you go into the Mail app in iOS and then write a new mail then you can choose the deployed email account, the problem is just related to sharing pictures (possibly also other stuff) via the  “Share button” > Mail feature in iOS.

    Note: If you go to Settings > Mail, Contacts, Calendars you cannot see the email account listed in “Default account”.

    UPDATE: Turns out that this is indeed not a bug but a feature. You must activate “Allow email to be sent from third-party applications” in the email policy.

    Related article: Notes from the field – iOS device management using ConfigMgr 2012 and Windows Intune

  • Solution to Windows 8.1 stuck at “Getting ready” during deployment

    Posted on March 15th, 2014 By Andreas Stenhall + No comments

    I encountered a stuck deployment at the “Getting ready” stage when deploying Windows 8.1 at a customer site the other day. None of the logs produced by the task sequence gave any indications on the problem at that stage so to find the real problem I had to turn to the Windows setup log setupact.log which is found in C:\Windows\Panther\UnattendGC.

    In clear text it stated a few lines of this code. It kept on retrying to join the domain every ten seconds.

    2014-03-14 10:48:23, Warning                      [DJOIN.EXE] Unattended Join: DsGetDcName failed: 0x54b, last error is 0x0, will retry in 10 seconds...

    That particular problem was caused by the fact that the domain name to be joined was not entered as a FQDN in the task sequence. Note there are other causes of a failed domain join but remember that if your Windows 8.1 installation hang at “Getting ready”, examine the setupact.log and find the root cause and fix it.

    Interesting to say is that this behavior seems to be different in Windows 8.1 than in previous Windows versions (at least Windows 7), where a failed domain join would be skipped and the deployment would continue leaving the machine in a workgroup mode.

  • Notes from the field: iOS device management using ConfigMgr 2012 R2 and Windows Intune

    Posted on March 3rd, 2014 By Andreas Stenhall + 1 comment

    There are not that much real world info on managing iOS devices using Windows Intune and ConfigMgr. I am talking about managing iOS devices, not settings up iOS enrollment or the tons of guides on how to publish and deploy a web link to the App Store. This blog post was born to give some deeper level of insight into iOS management using Windows Intune together with System Center Configuration Manager 2012 R2.

    UPDATE March 18 2014: Bug deploying email profiles to iOS using ConfigMgr / Intune

    Troubleshoot MDM in Intune / ConfigMgr

    The biggest challenge as I have learnt is that troubleshooting mobile device management using ConfigMgr and Intune leaves a lot to wish for. There really are not that much you can see in terms of what is going on between ConfigMgr, Intune cloud service and the mobile device itself. There are no force buttons to push or pull stuff so you are pretty much left in the dark many times. Apparently there is only one action you can take to force all policies (compliance settings and email profiles for instance) to the iOS device and that is to install an app from the Company Portal iOS app or from the web interface at m.manage.microsoft.com. Apart from that you just have to wait, wait and wait for things to happen.

    Custom iOS app deployment options and important knowledge

    One of the most not so much talked about feature is the ability to sideload an in-house or custom developed iOS app (IPA file). It is easily done as any other application deployment by adding the IPA and the PLIST file, then distributing it to the cloud distribution point. Although the plist manifest file is required to add the application for deployment it seems to be of no use as the plist file is not distributed with the IPA file itself to the distribution point. I suppose it is more of a way of knowing that you are not deploying apps from the App Store (IPA files, not the web links).

    When deploying an IPA you have three options:

    1. Deploy it as Available to Users
    This will make the app published and available for install, but only in the web interface, i.e. “m.manage.microsoft.com”. For some reason which I do not know you will not see this app if you are using the Company Portal app. Once again I do not know the background for this but it is really inconsistent behavior and makes the iOS Company Portal app more or less unusable. I have filed a Design Request Change for this at Microsoft Connect.

    UPDATE: This is an Apple “feature” and a limitation in what they allow the MDM vendors to do.

    2. Deploy it as Required to Users
    This will install the app automatically for targeted users. A note will pop up on the screen of the iOS device asking if “m.manage05sub.microsoft.com want to install the following app, is that OK”? After clicking OK/yes the app is installed (or should we say sideloaded to be correct).

    3. Deploy it as Required to Devices
    This will install the app automatically for targeted devices. A note will pop up on the screen of the iOS device asking if “m.manage05sub.microsoft.com want to install the following app, is that OK”? After clicking OK/yes the app is installed (or should we say sideloaded to be correct).

    Log files – shake it baby!

    Well, there are a few log files on the CM side but I have not found any relevant information in them, all you can see is that there is some kind of communication with Intune but that’s about it. So basically there are no logs to turn to when troubleshooting. There is however one log file and that can be accessed from an iOS device by logging into the Company Portal app. After login, shake the phone. Yes, you heard me, shake the phone and you will see options to send the log file via email for further analysis. However, although I have read many log files over the years this log file is among the more hard to interpret. They will however likely be more useful to Intune technical support technicians (more on that later). I have filed a DCR for more insight into Intune or the communication via ConfigMgr at Microsoft Connect.

    iPad and iPhone collections

    Divide iOS devices into collections for iPads and iPhones which is good if you for instance want to target different compliance settings to iPads and iPhones. Create a collection based on “Mobile Device Computer System” where the “Device Model” is like %ipad% and %iphone%.

    The query to list all iPhones in a collection:

    select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,
    SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,
    SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_DEVICE_COMPUTERSYSTEM on SMS_G_System_DEVICE_COMPUTERSYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_DEVICE_COMPUTERSYSTEM.DeviceModel like "%iphone%"

    The query to list all iPads in a collection:

    select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,
    SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,
    SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_DEVICE_COMPUTERSYSTEM on SMS_G_System_DEVICE_COMPUTERSYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_DEVICE_COMPUTERSYSTEM.DeviceModel like "%ipad%"

    Email profiles be aware

    Do not let the official ConfigMgr blog screenshots fool you. When creating an email profile the Exchange ActiveSync Host should be entered without http:// or https:// as mistakenly demonstrated in the screenshot.

    UserLicenseTypeInvalid error message

    The error UserLicenseTypeInvalid when trying to enroll an iOS device. Most likely this is due to users not being synced to the Intune service because they are missing from the “Intune users” collection or that there is a problem with actually syncing from CM to Intune. More about that in this blog post.

    The Intune Support

    Do not hesitate to contact the Intune technical support whenever you encounter a problem. As you have no insight into Intune contacting support is many times the only way to figure it what is or what is not going on with your mobile device management.  Support phone numbers for Intune specifically are listed at the Microsoft Support web site.

  • Taming the user interface in Windows 8.1 for enterprise users

    Posted on February 16th, 2014 By Andreas Stenhall + No comments

    It is no secret that there are challenges related to the user interface in Windows 8.1. It is no secret that it has raised a lot of feelings – both good and bad. It is no secret that Microsoft is aware of the issues and they are bit by bit working on addressing them.

    Windows 8.1 is without doubt the greatest and best operating system from Microsoft to date in terms of features and when it comes to security, performance, stability and responsiveness. Add to that an active development and continious distribution of fixes makes which Windows 8.1 the most dynamic Windows release to date.

    However, not many enterprises use modern apps on their desktop/laptop machines and will not do so for quite some time. This blog post is intended to show you how you can make Windows 8.1 behave well in enterprises if you want your users to recognize themselves in the new user interface in Windows 8.1.

    Boot to Desktop

    The option for the user to instantly get to the desktop is imperative when matching the user experience to what they are used to. This means that instead of landing on the start panel after login, the user is taken straight to the desktop. Another issue with the user interface in Windows 8.1 is that if the user for instance open a PDF file from a desktop application, the PDF file will open in the Reader app (that is if Adobe Reader or another PDF reader has been installed). However, after closing the modern app the user is not brought back to the desktop application, instead lands on the Start panel. The below group policy setting solves these two “issues”.

    In the Group policy Editor, locate the setting “Go to the desktop instead of Start when signing in or when or when all the apps on a screen are closed” located in User Configuration > (Policies) > Administrative Templates > Start Menu and Taskbar and set it to Enabled.

    Desktop background on start panel

    A small but never the less important setting that will make your users recognize the desktop is the setting to make the desktop background image being present in the start panel.

    Activate this setting by creating a User Group Policy Preference registry item with the following information:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent
    Value name: MotionAccentId_v1.00
    Value type: REG_DWORD (32-bit)
    Value data:  000000DB (Hexadecimal)

    File extensions for modern apps

    In Windows 8.1 images there are a bunch of modern apps included, which are installed the first time a user log in to a Windows 8.1 machine. You can when building your Windows 8.1 image remove all provisioned modern apps which will not only speed up the first login to a machine but also prevent users from opening for instance pictures in the modern app picture viewer and instead open them in “Windows Photo Viewer” on the desktop.

    Solution 1: Remove all provisioned apps by using Ben Hunter’s excellent script for this, see http://blogs.technet.com/b/deploymentguys/archive/2013/10/21/removing-windows-8-1-built-in-applications.aspx. In the scripts you see the relevant commands which can also be run manually, removing one modern app at a time. See the PowerShell cmdlets Get-AppxProvisionedPackage and Remove-AppxProvisionedPackage.

    Solution 2: If you do not want to remove the provisioned apps, you can use Michael Niehaus’s great guide to remove the file associations from the modern apps. Michael also show how to deal with this dynamically at deployment time as you probably want to have this configuration dynamic if you are using Windows 8.1 on touch enabled devices. The blog post is located at http://blogs.technet.com/b/mniehaus/archive/2014/01/10/configuring-file-associations-in-windows-8-1.aspx

    Customizing the start panel

    Well, there are PowerShell scripts which you can use to export a start panel layout and then send it out to multiple users using group policy settings. However, your users will not be able to actually modify it which kind of make this feature useless to say the least. What you can do to customize the start panel, awaiting better and more dynamic means to centrally manage the layout, is image customizing the layout of the start panel in your Windows 8.1 image, and then use the CopyProfile=true method to make that start panel layout the default for all new user profiles. This will present a default layout of your choice which the end users will be able to modify to their liking.

    Remove the (annoying) help guidance arrows

    The help arrows that appear the first time a user sign in to a Windows 8.1 machine are important for the users to learn how to reach the charms menu and navigate in the new user interface, when they actively or mistakenly end up there. However these little helper arrows tend to become rather annoying after time and you will be glad to see that there are ways to turn them off.

    Create a User Group Policy Preference that adds the following registry:

    HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\EdgeUI
    Value name: DisableHelpSticker
    Value type: REG_DWORD (32-bit)
    Value data: 1

    The power of search

    I have been involved in many deployment projects with Windows 7 and my simple conclusion is that users tend to love not to use the built in search box in the start menu in Windows 7. Moving to Windows 8.1 is not going to change that and especially not as the users have no idea that they can just type anything while on the start panel and a search will be performed. I’m still waiting for a group policy setting that will make users use search instead of clicking and clicking and clicking but until that arrives instruct your Windows 7 and Windows 8.1 to use the built in search feature.

    Summary

    Well, by taming how the user interface behaves and my modifying or totally removing the modern apps the start panel goes back to just being the search feature and the new user interface is acting pretty much as it always have traditionally in Windows. And at the time of this writing we know that there will be an update in April 2014 that will present even further improvements to the UI. Things are improving but rest assured, the good old start menu as we know it since Windows 95 will not be back.