Category: Windows 10

When doing troubleshooting one of the best places where you will find clues about the problem is in the Event Viewer logs. And when doing research on what is going on in the background when performing certain actions in Windows, the Event Viewer will come in handy.

The challenge with Event Viewer is that there are hundreds of log files, and how do you know which one(s) to investigate?

In this blog post you will learn:

• How to use Process Monitor to figure out which the relevant event logs are, for instance when doing troubleshooting or figuring out what a specific action does in the background when researching solutions in Windows.

Method to find the relevant event logs

All event logs which are found in Event Viewer are basically files named <EventLog>.evtx and are located in C:\System32\Winevt\Logs. The key takeaway from this first part is the .evtx file ending.

The tool to use next is my favorite tool when it comes to troubleshooting and learning about stuff in Windows; and the tool is Process Monitor from Sysinternals (owned by Microsoft).

Process Monitor will gather thousands of rows of data within seconds, and this is where filtering comes in.

Crash course in Process Monitor

This is my standard procedure when using Process Monitor. Download Process Monitor if you do not already have it available.

1. Start Process Monitor.
2. Press Ctrl + E to pause recording events.
3. Press Ctrl + X to clear out all events.

Adding the filter for identifying the event Logs

Now, to be able to identify the Event logs files that are of relevance to troubleshooting or to a specific action that you perform, using filters is the key in Process Monitor:

1. In Process Monitor, press Ctrl + L to get to the filters.
2. In the first drop down menu choose Path followed by contains in the next drop down and last enter .evtx
3. Make sure Include is selected and click Add and OK.

Identify the relevant logs

Now you can prepare the troubleshooting step(s) or the action you want to perform and when you are ready for this:

1. In Process Monitor, press Ctrl + E to start recording.
2. As quickly as possible, now reproduce the problem or perform the action you want to know more about.
3. Go back to Process Monitor and hit Ctrl + E to stop recording. Voila, you now have the relevant event logs to further investigate.

After you have the list above, you know exactly what event logs are being written to and you can do further analysis of these. Fire up Event Viewer – and happy hunting! 😊

Examples

Some examples when I’m using this method performing troubleshooting or researching in Windows:

• Troubleshooting failed Store app installation.
• How can I find what event logs are used when plugging in a FIDO2 security key so that I can add a scheduled task to trigger on a certain event to lock the machine when unplugged?
• What log files are written to when doing a Sync with Intune?

Summary

Using Process Monitor to find the relevant event logs is a quick and efficient way to locate where to look next for more details. This applies to both troubleshooting and when researching the inner workings of Windows and figuring out what is going on in the background.

Microsoft are deprecating features in the Windows client at a quicker pace than ever, and some of these are more or less broadly used in organizations. Some of the most common ones that are now deprecated are WMIC, VBscript, TLS 1.0 and 1.1, PSR, Update Compliance and WebDAV. Some great although less used features that are deprecated lately are Defender Application Guard for Edge and Office and Windows Information Protection. Let’s have a look at what this means and what possible replacements there are!

No need to panic!

Before going into alternative solutions, keep in mind that the definition of deprecated means that the feature is no longer developed and might be removed from a future Windows version. Thus, there is absolutely no need to panic. My recommendation is to start planning for moving away from features that are deprecated, and with that communicating this information to all relevant stakeholders.

Common features in organizations that are now deprecated

This is a table of the more or less commonly used features within organizations, with potential alternative solutions.

Deprecated feature	Organizational impact from my personal view	Alternative solutions
WMIC	Have you ever used or still use for instance “wmic csproduct get name” or “wmic bios get serialnumber“? Those classic commands are still very much used by some and will soon be removed from out of the box in Windows.	Use PowerShell is the alternative solution! More at WMI command line (WMIC) utility deprecation: Next steps | Windows IT Pro blog (microsoft.com).
Microsoft Defender Application Guard for Office	Only a few organizations have implemented App Guard for Office unfortunately. As it has also been a Microsoft 365 E5/E5 security add-on feature this has not had the best basis for broad use.	Microsoft recommends Attack Surface Reduction (ASR) and I agree with that. I would add to that to use Defender for Endpoints which means extra scanning of documents coming from emails or internet through web browsing. See Safe Documents for more info.
Microsoft Defender Application Guard for Edge	Although this s a super secure browsing experience, I do not know a single organization that used this. It adds significant administration and high end-user impact so the feature never made it out into organizations.	Use Edge security recommendations found in Microsoft Edge for Business security whitepaper.
Problem Steps Recorder (PSR.exe)	A few organizations use this and have instructed end-users to record problems and attach to service desk. Some organizations (have) use(d) PSR to create guides.	Snipping Tools which not only offers creating an image of the desktop now also offers video recording possibilities is a personal favorite and I strongly recommend everyone to use this. In the new release you can also add shapes to highlight your screen shots!
WebDAV Client	WebDAV is very much still used in many organizations. I last came in contact with this just before Xmas last year where users have the need to map on-premises SharePoint document libraries to Windows Explorer.	Possible alternative solutions: 1. Moving to SharePoint Online is obvious but currently many organizations cannot do that for confidential information. 2. Enable and use Map SharePoint on-premises using OneDrive for Business.
VBscript	I have not come across any organization that do not use VBscript at all, but to be honest on more recent years most VBscripts are replaced by other means. The popular MDT (Microsoft Deployment Toolkit) which has been used by thousands or organizations over the years is still much in use and contains thousands of lines of code in VBscript.	For those VBscript solutions that are still there, consider migrating them to other languages such as PowerShell. Also note that VBscript is still available as a Feature on Demand. If you are using MDT, see this eminent guide from my fellow MVP and former colleague Johan Arwidmark.
TLS 1.0 and 1.1	I think most know that TLS 1.0 and 1.1 are considered unsecure, and that anything using TLS 1.0 or 1.1 should have moved to using TLS 1.2 a long time ago. However, this is far from the case as TLS 1.0 and 1.1 are still requirements in several Line of business applications and other critical systems in organizations.	Windows clients and servers will have no problems with disabling TLS 1.0 and 1.1. Line of business applications are the problem area. Handle this with basic Application Lifecycle Management, and make sure application owners and vendors become aware of the problem and make a plan for moving to TLS 1.2 or later.
Troubleshooters	To be honest, the built-in troubleshooters in Windows that has been around since Windows 7 are not used that much in my experience. It is sad though because they offer some basic troubleshooting stuff.	What I will miss are the PowerShell scripts behind the troubleshooters, which have proven to be very valuable when doing “automated troubleshooting”. Retain whatever you can from C:\Windows\diagnostics\system before these are removed.
Windows Information Protection	Being able to protect your company data is essential and I think a lot of organizations use Intune App Protection for iOS and Android. Under that same section was Intune App Protection for Windows, which is essentially “Windows Information Protection”. However, although a good feature not many, to say no organizations, deployed this feature in production.	If you are looking to protect company data on your Windows devices, you should have a look at and implement Endpoint Data Loss Prevention as part of Purview.
Update Compliance	I have helped numerous customers over the years to implement Update Compliance to keep track of Windows quality and feature updates, even as a compliment if the customer is already using Configuration Manager or WSUS.	Anyone using Update Compliance or want more insights into patching as a compliment should enable Windows Update for Business Reports as this adds additional value!

Sources for deprecated features and more information:

• Deprecated features in the Windows client – What’s new in Windows | Microsoft Learn
• Resources for deprecated features in the Windows client – What’s new in Windows | Microsoft Learn

This blog post is an example of a problem I encountered the other day in a project I am in. An application that is used by a part of the business is installed properly but crashes. I thought I’d share some tips and tricks based on this troubleshooting, a troubleshooting which turned out to be a true sunshine story.

Problem

A ClickOnce application is installed in Windows 10 and 11 but when trying to start the application it never starts and instead silently crashes.

Investigation

As always when something crashes, more details can be found in the Event Viewer. The event ID 1000 lists some very general information:

Faulting application name: X.Y.Client.WpfClient.exe, version: 1.0.0.0, time stamp: 0x565f048b
Faulting module name: KERNELBASE.dll, version: 10.0.25357.1, time stamp: 0xc0dc8053
Exception code: 0xe0434352
Fault offset: 0x0014e0a4
Faulting process id: 0x0x473C
Faulting application start time: 0x0x1D9824B72D664C7
Faulting application path: C:\Users\andre\AppData\Local\Apps\2.0\KP6YOQBZ.QBT\10VX2RL2.D3R\X...tion_ae3633e36a16d69b_0004.0000_6d9d02277ead5c24\X.Y.Client.WpfClient.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll

This in turn gives me nothing more to go on so next thing to do to get more information is to enable crash dump file generation for application crashes (or any other crashes apart from Windows crashes which already have dump files generated each time Windows crashes).

Enable crash dumps

Go to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting

First Create a key named LocalDumps so that you end up with this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

Then in the LocalDumps registry key create these three registry values:

Name: DumpFolder
Type: REG_SZ
Value: C:\CrashTemp

Name: DumpCount
Type: REG_DWORD (32-bit)
Value: 10

Name: DumpType
Type: REG_DWORD (32-bit)
Value: 2

Restart the service named “Windows Error Reporting Service” and then start the application and note the DMP file created in the location that you specified above.

Analyze crash with WinDbg

Now we can analyze the DMP file with the classic tool Windows Debugging Tools. This is available in Windows ADK and SDK but the easiest way is to install WinDbg (Preview) via Store (or publish to Company portal). You can also use the winget command to install WinDbg by using “winget install 9PGJGD53TN86“.

Start WinDbg and then open the DMP file and choose:

!analyze -v

We can then clearly see some interesting exceptions:

Key  : CLR.Exception.System.ArgumentException._message
Value: Source property was not set before writing to the event log. 
Key  : CLR.Exception.System.Security.SecurityException._message
Value: The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security.

This, plus the below entries also found as a result of analyzing the DMP file, clearly points toward event logs and specifically the security event log.

STACK_TEXT:
00f8eedc 64b54041 System_ni!System.Diagnostics.EventLogInternal.WriteEntry+0x16bc4d
00f8ef0c 649e53f9 System_ni!System.Diagnostics.EventLog.WriteEntry+0x19
00f8ef18 0314223b X_Y_Client_Business!X.Y.Client.Business.Logger.WriteToLog+0x103
00f8f034 0314211d X_Y_Client_Business!X.Y.Client.Business.Logger.WriteToLog+0x25

Process Monitor for the win!

To figure out what is going on I turn to my personal favorite tool named Process Monitor, a tool that has helped me troubleshoot and learn stuff about Windows for many years.

In Process Monitor, I did a simple recording and filtered on “Access denied”. The application process showed one access denied entry.

The application need read permissions on the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\security 

Said and done, I set users to “Read” on the registry key and started the application again. It crashed still.

I did another trace with Process Monitor and this time it showed that read/write permissions was required on the registry key above security. Strange, but I set Users to Full Control on the registry key referenced:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog

I once again tried to start the application and after that, the application started! Note: The good(?) thing is that after first start, one can revert the permissions to default permissions and the application still work. More investigation is needed in this area.

Summary

A few tools, tips and tricks were involved in this troubleshooting, and I hope to inspire others to use these tools and methods in their own troubleshooting in day-to-day work. My next step now is to contact the developers of the application and point out the rather strange problem, and hopefully get the problem fixed.

It is now exactly 3 years since I got my current device, the ARM based Surface Pro X SQ1 device. I’ve been using it as my primary work device since then, although much work has also been conducted on other devices for the customers I work with. Still, I’ve used my Surface Pro X almost every day.

This report is meant to help shed some light on the ARM platform, and aid in hopefully clearing out some questions marks for users or organizations looking to purchase for instance the Surface Pro 9 which comes both with an Intel processor as well as a Microsoft SQ3 (ARM) processor.

Windows 10 and ARM

When I got my Surface Pro X device Windows 11 was not available, so I started out with Windows 10 on ARM. Back then, there were to be honest quite a few things that did not work, which hindered me in performing my work.

The biggest problem was that x64 applications did not run at all! That included the 64-bit Microsoft 365 Apps for Enterprise as well as 64-bi compiled PowerShell modules which is used to manage Microsoft 365 and Azure resources. Thankfully, these obstacles are now a memory of the past!

Windows 11 bring ARM devices to a useable level

As soon as I upgraded to Windows 11 on my Surface Pro X it was a new world opening – and the obstacles I previously had was long gone. With Windows 11, there is x64 emulation meaning basically any application will run without problems, including the PowerShell modules I previously had problems running and also running Microsoft 365 Apps for Enterprise on 64-bit.

Since the release of Windows 11, more and more features have been enabled over time, bringing Windows 11 on ARM to an almost feature-complete Windows if you compare it to Windows 11 the 64-bit edition that is used on some 99%+ devices globally.

Limitations of Windows 11 on ARM

So, while there are no blockers for me to do my daily work, there are some limitations that you might want to be aware of.

Windows feature / component	Limitation / problem	Comments from the field
Drivers (hardware and software)	Drivers for both hardware as well as software needs to have a driver compiled for the ARM64 platform. This might include printers, VPN software, antimalware applications and such.	The only application I have encountered problems with is Camtasia screen recorder application. However, there used to be some manual work needed to get Adobe Photoshop installed, manually uninstalling Visual C++ runtimes, and then installing the ARM based Visual C++ runtimes. For hardware, the printers I have used have had ARM64 drivers. Update March 14, 2023: For some more information on compatibility with antimalware and VPN solutions, scroll down to “A growing Arm ecosystem…” in this blog post Available today: Windows Dev Kit 2023 aka Project Volterra – Windows Developer Blog
Microsoft Defender Application Guard	This virtualization based feature of Windows is not available on Windows on ARM.	This is too bad as I really like having the Application Guard feature protecting Office documents that come from the internet zone. Update March 14, 2023: Since the blog post was written, David Weston announced on Twitter that Application Guard for ARM is here (unclear though what build you need to be on).
Hyper-V VMs	You can create and run Hyper-V virtual machines on Windows on ARM. However, you cannot run the x64 versions of Windows as guest OS in the VMs and are limited to Windows on ARM.	This is a limitation for me – but although the Surface Pro X can run not only Hyper-V but also Android apps via Android Subsystem, the performance of the devices is just not fitted for running all these performance-demanding virtualization stuff.
Games, Windows Fax and Scan and more	Microsoft has an official list of what could pose problems on ARM, see Windows Arm-based PCs FAQ – Microsoft Support	Except the limitations I mention above, I have not seen any of the other problem that Microsoft describe in the article over the three years that I have used my ARM device.

ARM platform is expanding

Over the last year or so we have seen ARM compiled versions of Microsoft Teams and then also Company Portal app appearing. There are probably more examples, but these are what comes to mind.

Also, the number of devices based on ARM have increased over the years and most major computer manufacturers have ARM devices to choose from.

Management, ISO files, installation and recovery of the devices

One the biggest limitations is the lack of installation media (ISOs) for Windows on ARM. That means, every time I need to wipe my Surface Pro X I will have to download the 10GB recovery file, put in on a USB stick and recover.

After that I will be on Windows 10 1803 which means to get to Windows 11 22H2 I will have to run a number of Windows Update passes, with hours and hours to go until I am on the latest Windows release. This is the area where Microsoft can do a lot better! There are ISOs for Insider builds however.

When it comes to management of ARM based devices, there are some things to take into consideration, for instance regarding application deployment. Apart from that management of ARM devices are more or less the same as any Windows device, at least if you are managing them using Intune. If you are using Configuration Manager, have a look at this article.

If you want to have a great summary of what management and deployment of ARM (Surface devices) mean, read Deploy, manage, and service ARM-based Surface devices.

Does not make a sound

One of the biggest advantages which I have not mentioned yet is that the device is completely silent, and it has not given away one slightest sound over these three years. Fan-less, yet still enough powerful to do information work and being very mobile with the built in support for 4G/LTE.

Although the “no noise” thing is true for my Surface Pro X (SQ1) I recommend you look this up for the particular model you potentially will be purchasing.

ARM based devices generally use little energy and thereby produce little heat and with that often do not need any fans that generate noise.

Summary and recommendation

As I see it, the ARM platform is mature enough to put in hands of end-users. The security features of Windows are there (except for Application Guard which very few use) and basically all applications work, especially if you are using the Microsoft 365 suite.

Would/will I choose an ARM based device when the Surface Pro X support come to an end? The answer to that question is “yes, absolutely!”. Do I recommend end-users or organizations to try or evaluate ARM based devices? Yes, you should start today! As always, you need to test and make sure everything the end-users needs is working, before you do any broader deployments of ARM based devices.

I think this is a really interesting case and although Hybrid Azure AD Join is something I am not recommending over Azure AD Join, sometimes there are circumstances that leads to no other choice but to adjust and make the best out of the situation and plan for a better solution more long-term.

Current situation and scenario goal

The mission is to enroll all Windows devices (shared and Hybrid Azure AD Joined) to Intune and the specifications are as below:

• Windows 10 and 11 Enterprise 21H2 (or 22H2) computers which are Hybrid Azure AD Joined.
• The devices are used as shared computers, so there are no primary users of these devices.
• Intune licenses are device based, not user based which is the typical and most common scenario.
• Microsoft Endpoint Manager Configuration Manager is NOT used.

The million-dollar question is how these shared computers can be enrolled into Intune automatically? The scenario must cover both enrolling newly deployed computers as well as existing computers. The solution must be fully automated i.e., no manual steps must exist in the process.

Note: The typical GPO to enable MDM automatic enrollment via user credential cannot be used as the users do not have Intune licenses.

Potential solutions

My thoughts on how to come to a solution came pretty much in this order, and turns out to be a real challenge

1. Use “Device Credential” in the GPO “Enable automatic MDM enrollment…”

The GPO “Enable automatic MDM enrollment using default Azure AD credentials” got a new option some years ago and can be set to “device credential” instead of the default “user credential”. Sounds like the perfect solution!

Problem: Error code 0x80180001 in the event logs “Device based token is not supported to enrollment type OnPremiseGroup PolicyCoManaged”. It turns out that this setting is only supported using MEMCM/SCCM or Azure Virtual Desktop, and obviously blocked or not meeting the technical requirements on other machines.

2. Autopilot self-deploying mode profile

That was a good idea although self-deploying profiles cannot be used as it supports only Azure AD Join and not Hybrid Azure AD Join.

3. Provisioning package – Only enrollment

Using a provisioning package (PPKG) you could potentially enroll into an MDM solution (such as Intune) using Workplace/Enrollment settings as noted in Bulk enrollment – Windows Client Management | Microsoft Docs. However, “username and password security type not supported”. However, this enrollment seems to primarily be targeted and intended for third party MDM solutions or the now long gong feature to enroll into on-premises MDM in Configuration Manager, not Intune. Or did anyone succeed in enrolling into Intune this way? If so, please ping me!

4. Provisioning package – Using bulk enrollment token

Although this way is typically used for performing Azure AD Join + automatic Intune enrollment using a Device Enrollment Manager (DEM) account, I thought I’d try it out to see what happens as I never tried this on a Hybrid Azure AD Joined computer.

Well after obtaining the bulk enrollment token through the simple wizard in Windows Imaging and Configuration Designer, I switched to advanced mode and got rid of everything from the provisioning package apart from the Azure/bulk enrollment token parts.

I then ran the provisioning package on my target test machine and the enrollment seem to have worked. Although, it resulted in another device object in Azure AD, and it successfully enrolled into Intune.

Hmm, not ideal but a big step in the right direction. Another question or thought is that even though this works technically, how far from being a supported is this scenario? Intune-device based licensing supports DEM accounts as enrollment type as per Licenses available for Microsoft Intune | Microsoft Docs, and the bulk enrollment is supported as well as per Enroll devices using a device enrollment manager account – Microsoft Intune | Microsoft Docs.

Next steps and summary

Well, automating the application of PPKG from step 4 above as part of the deployment process is easy, it needs some additional checks though as the provisioning package must only be run after the successful Hybrid Azure AD Join has taken place, otherwise I see this will fail. Not optimal and requires more testing, and even if this would work the scenario is a true corner-case!

Going back to Autopilot self-deploying mode seems a lot easier, so let’s evaluate what needs to be in place for this to become reality, overcoming the hurdles!

By connecting your Windows devices solely to Azure AD and Intune you will improve the work lives of for your users and make it easier for you in IT to manage the platform during the device lifecycle.

Windows devices in the future are no longer connected to a traditional Active Directory, and they are not managed by Configuration Manager or other on-premises management tools, and not with Group Policies. The Windows devices of the future are independent of your datacenter which means IT can focus on improving availability of the resources the end users are dependent on in their daily work, which are applications, tools, and information.

End user experience and challenges today

Are you and your end users sick and tired of the fact that starting and logging into Windows takes several minutes? One common cause for this is a legacy of many years of GPOs and scripts that are executed at start and logon.

Do your end users still need to come into the office network to get all updates, configuration or changing password? This is something that becomes a non-issue in the cloud-only world. Even though these types of needs have decreased because of the pandemic I still see and hear about this too often.

Improving end user experience and simplifying are the keywords

The reasons of going cloud-only on your Windows devices are very much about significantly improving your end user experience, and at the same time making it easier to manage for you in IT. To continue doing what many organizations are doing today, i.e., managing Windows with existing on-premises AD and GPOs, running devices in Hybrid Azure AD Join state plus adding co-management and Intune just makes your life in IT more complex and harder, and give your end-users very few benefits to be honest. Everyone would gain from letting go of on-prem AD and traditional managing software such as Configuration Manager.

Microsoft recommends going cloud-only and not staying in hybrid mode

The fact is that Microsoft is recommending the hybrid scenario only as an interim solution for existing devices. For new devices Microsoft are very clear that they recommend cloud-only devices.

Keep in mind that while Microsoft fully supports hybrid Azure AD join, we designed this capability as an interim solution for existing endpoints. We strongly encourage customers to begin their planning and implementation of full Azure AD-joined systems as soon as possible.

Source(s): Success with remote Windows Autopilot and hybrid Azure Active Directory join – Microsoft Tech Community and Planning for cloud-native Windows endpoints and modern management – Microsoft Tech Community

The most common myth killed once and for all – access to on-premises resources

The fact is that most organizations still have, and will have for many years to come, user resources in their datacenter on-premises. How do users get access to file share, printers, and applications on-premises when the Windows device is only in the cloud? With Windows Hello for Business Cloud Trust or FIDO2 security keys, this has never been easier to setup and enable!

Pros for cloud-only Windows devices

• Performance and user experience. Microsoft’s former corporate vice president for Microsoft 365, Brad Anderson, compared his iPhone to a cloud-only Windows device s few years ago. The Windows device started and became usable faster than an iPhone. That is a notable example that still is valid. Mobility, speed, and battery life is something the users really appreciate.
• Reduced complexity. What I see is that customers that are running in the hybrid scenario has a complex day-to-day life in IT, in terms of managing and troubleshooting. You have two environments to take into consideration all the time which makes things sometimes twice as hard or take more time than it should to achieve the goal at hand.
• More time for valuable work. How much time do IT spend on keeping the basic infrastructure working? By that I mean specially Configuration Manager which always have had problems with agents, driver packages becoming corrupt after working for years etc. I have through my years spent too much time on just keeping things at a working level, it is time to bury Configuration Manager and spend this time on more valuable work such as follow-up and proactiveness.
• Get rid of your legacy. Most organizations have over the years migrated to a number of Windows client platforms, from Windows 2000, XP, Windows 7, to Windows 10 and soon Windows 11. What most organizations have in common is that the same GPOs and scripts are still being applied although first configured 15 years ago, even though some policies have been cleaned out through all migrations. Switching to cloud-only is the perfect fresh start of getting rid of all your legacy stuff and start building on something new!

Cons for cloud-only Windows devices

• Not for everyone. Being able to utilize Microsoft cloud services is a pre-req of course. To be honest, there are more challenges that could block an organization from going cloud-only. Things such as 802.1x can be a challenge and specific requirements around security another. The point is, if you do not even try you will not know what to solve or what Microsoft will eventually deliver in their product and services to solve your blocker. Adding cloud-only Windows devices to your roadmap and work on dependencies is essential in making progress.

How to get started?

So how do you get started? In its simplest form, start with Autopiloting (Azure AD Join + Intune) the device and then perform all your day-to-day work on a cloud-only Windows PC. After that start solving the challenges that you face, creating a configuration baseline and deploying applications that you need. Some challenges will be harder to pass than others, and some might be blockers. The point is, without starting your journey toward a future cloud-only future Windows device you will not know what to fix and what to talk to for instance the network team about.

Microsoft has a good starting point at Get started with cloud native Windows endpoints – Microsoft Endpoint Manager | Microsoft Docs.

Summary

To summarize, the future is to have your Windows devices connected cloud-only Azure AD and Intune. That has great advantages for end-users as well as IT. The fact that Microsoft themselves are living by this already, and the fact that they point customers towards this direction and in combination with all benefits should make this decision easy.

This is a high-level summary of the specific needs, business impact and listing of current profile management options for your physical and virtual Windows 10 and 11 devices. The focus is how to get back to a state which can make you productive as soon as possible after a device reinstall or reset. This scenario of course also covers when you get a new device that replaces an older one.

Business impact

Most organizations have a policy that “we will troubleshoot a problem on a Windows device for X number of minutes, if we can’t solve it, let’s do a reinstall or reset”.

This might seem like a great policy that saves time for the service desk. But the numbers the management do not see is how much time have service desk have to spend on helping the user get back on track after the reinstall or reset? The same goes when user needs help transferring from one device to another as part of regular renewal of device. The potential time-saver here is enormous. If the user can get to a state that has everything the user needs available instantly, the user can become productive much quicker.

A consequence of having everything brought back quickly is that not only can the user be productive quicker, but the user will much more likely agree to a reinstall or reset when knowing the user can start working without hazzle again. It might also mean that you can reduce troubleshooting time from say 60 minutes down to 15 before you do a reinstall or reset. Overall a real time-saver and money-saver!

Needs and goals

High-level goals:

• Getting back to a state where a user can start working as soon as possible after re-install or reset of the device, or even when switching device as part of hardware renewal.
• “Everything back as it was” (more details on this below). I.e., the time the user needs to spend on getting back to a state that just works as before needs to be minimized.

Expanded description of goals:

• All files and documents back as they were and accessible by user.
• All required applications back as they were. (This is out of scope for this blog post as most organizations use ConfigMgr, Intune or a third-party software to deploy applications).
• All relevant settings back:
  • Specific settings for line of business applications.
  • Outlook signatures and calendar settings etc.
  • Printers and printer settings.
  • Browser related settings, favorites, and history, including saved passwords.
  • Mapped SharePoint sites (Teams files) in File Explorer.
  • Settings for apps.

Solutions

Let’s have a look at what Microsoft technologies are available to solve the needs.

Personal files and documents

• OneDrive for Business with Known Folder Move.
  If you have the possibility to use OneDrive for Business this is the best solution out there. Make sure to set the GPO or MDM setting to silently configure OneDrive to automatically have your OneDrive folder available after re-install or reset. Also set the policy setting “Enable Known Folder Move” to make sure that Desktop, Documents and Pictures folders are redirected to your OneDrive Folder. Reality check, do you know anyone who do NOT save stuff they need on the desktop? :)
• Work Folders (which I typically call the internal OneDrive).
  Setting up Work Folders is easy, the role has existed in Windows Server since 2012 R2, thus requires a Windows File Server to setup and enable. Once you’ve setup Work Folders, use good old redirection of Documents and Desktop folders (and maybe Pictures as well) pointing to the local Work Folders directory just like it is done with Known Folder Move for OneDrive for Business.
• Folder Redirection + offline files.
  Only two words: Stay away! (And migrate as soon as possible to OneDrive for Business or Work Folders if you are already using it). For some organizations I have worked with I have made it opt-in to use offline files, clearly stating the potential risks when opting in. Offline files cause user problems and have very high risk of user data loss.

Common or shared files and documents

• SharePoint Sites (Teams files directories).
  Many users prefer to work with SharePoint sites and Teams files by syncing them to work with the files in File Explorer. There is no official way of having these remapped automatically after a reinstall or reset of a Windows device.

Settings

• User Experience Virtualization (UE-V).
  I have many times referred to UE-V as the best thing since sliced bread. It is a technology that was released for about 10 years ago, with the intent to provide roaming of settings for Windows and applications (both Microsoft and any third party), using on-premises file shares. It also roams printers if you are not deploying those through other means.
  
  Since Windows 10 version 1607 UE-V is integrated in the operating system. I’ve used UE-V quite a lot and this is a really good technology to get many settings back after a reinstall. In one case I could do a F12 reinstall of a Windows 10 device before going to lunch and after lunch I logged in and started working instantly, with all settings back. Those were the days!
  
  Over time as applications are moving to the app’s world, UE-V has basically become less effective in its job. Also, after adding UE-V to Windows version 1607, UE-V has not gotten much love from Microsoft and as no development has been made for almost six years this is still something that most will benefit from, but sad to see that Microsoft do not care for this.
• Enterprise State Roaming.
  About the same time that UE-V was integrated into Windows 10 we also saw the introduction of Enterprise State Roaming. This is a technology that use the cloud (a private protected and untouchable area) in Azure to store profile settings that roams with the user. For instance, background image, Windows theme settings and some other stuff is being roamed when enabling this through Azure AD. Sad to say, this feature is facing the same destiny as UE-V, with no new features or changes for the last six years or so.
  
  Actually with Windows 11 the number of settings that roam using Enterprise State Roaming have decreased, now only roaming passwords, some Windows settings, and language preferences.
• FSLogix profiles.
  Microsoft bought FSLogix and with that obtained their profile technology. This is a container-based profile solution used primarily in remote Windows solutions, such as Azure Virtual Desktop. Although the technology should be possible to use on physical machines as well, I haven’t many details regarding this and haven’t tried it our myself. One reason for this is that FSLogix profiles requires an Active Directory and is not yet (per January 2022) supported for Azure Active Directory, although this is announced in the future.
• Edge profile sync.
  The new and lovely Edge has profile sync with roaming built-in which is very much appreciated. Sign in with your school or work account and off you go! You’ll also find some additional information on Configure Microsoft Edge enterprise sync | Microsoft Docs.
• Outlook settings roaming.
  Finally you can roam your email signature and a bunch of other settings to the cloud – without doing anything other than making sure this option is enabled. Take a look at Outlook roaming options to get more information about this one.

Note 1: Roaming profiles take care of both files and settings but like with folder redirection and offline files: Stay away from roaming profiles to make your life happier.

Note 2: As apps in Windows always store their configuration and user specific data in a standardized location. That is C:\Users\%username%\AppData\Local\Packages\%AppName%\ which means Microsoft should be able to provide a supported way of roaming these settings.

What settings can you use?

Depending on how your Windows devices are managed you can use some or all these technologies. This is applicable for Windows 10, Windows 11, Windows 365 as well as Azure Virtual Desktop. Note: All technologies below are not necessarily supported for all physical and virtual use cases.

	Active Directory Joined	Hybrid Azure AD Joined	Azure AD Joined
User Experience Virtualization (UE-V)	Yes, pointing to file share	Yes, pointing to file share	Yes, pointing to OneDrive for Business local folder*
Enterprise State Roaming	No	Yes	Yes
FSLogix profiles	Yes	Yes	No (not supported yet)
Edge profile sync	Yes	Yes	Yes
Outlook settings roaming	Yes	Yes	Yes

* For configuration, this is a great start: Manage User Experience Virtualization on the Modern Desktop | Aaron Parker (stealthpuppy.com)

Support matrix

	Windows 10/11 – Physical	Windows 10/11 – VDI	Windows 365	Azure Virtual Desktop
User Experience Virtualization (UE-V)	Yes	Yes	*	*
Enterprise State Roaming	Yes	Yes	Yes	Not supported**
FSLogix profiles	Not supported	Yes	Not supported	Yes***
Edge profile sync	Yes	Yes	Yes	Yes
Outlook settings roaming	Yes	Yes	Yes	Yes

* Technically it will work, but likely not supported by Microsoft for Windows 365 nor Azure Virtual Desktop.
** Supported only for personal pools – not multi-session Windows 10 or 11, nor Windows Server.
*** For Azure Virtual Desktop, currently there is no support for Azure AD Joined devices.

Summary

With the existing Microsoft tools and technologies, you can reach a state where most of the stuff you want back actually is configured and brought back automatically. Getting the files and documents back is easy. Edge profile sync and Outlook settings roaming are a no-brainer and should be used by everyone.

UE-V and Enterprise State Roaming are not developed anymore but they still fill a purpose and can be very useful to save time, starting today, as they are very easy to get started with and has a very low implementation cost. FSLogix profiles are primarily intended for datacenter hosted solutions.

With those facts, there is a strong need for Microsoft to strengthen profile management to make it the true time-saver it can be. IT management would very much appreciate it I can assure. But the ones that would appreciate this the most are the end users!

In a statement a few weeks ago Microsoft announced significant changes to how long Windows 10 LTSC (Long Term Servicing Channel) is supported.

I have been working with about 30 customers around Windows 10 since the launch of Windows 10 almost six years ago. I am the strongest of cloud advocates and for Windows as a service, but I must as a professional adjust and look at customer needs and conditions as well as cost efficiency. Among all deployment projects and customers I have worked with, only in two of those cases did we have to go with LTSC edition of Windows 10, after very careful and thorough evaluation of cloud and Windows as a Service being the natural top choices.

The reason for choosing LTSC with these two customers are simple and has been the same in both cases; they are ideal for devices that typically do not have any dedicated users and serve one purpose only, and that is to display information or let users interact with it through a single application as a kiosk. Often the hardware is not easily accessible. These devices must in many cases also be up and running 24/7 with no interruptions.

Another aspect to take into consideration is that the business does not care if it is Windows 10 version X or whatever version of anything if the monitor is displaying the information or performing what the business needs are.

Currently with 10 years support – Fire and forget

Windows 10 LTSC version 2019: Deploy to a computer purchased and it can run theoretically to January 2029. Typically, with 10 years support, if you deploy new hardware with the latest Windows 10 LTSC version you are good for up to 7-9 years. You will not have to touch the device until it is time to replace the computer after X number of years.

After Microsoft changing to 5 years support – Additional work and costs with no business value

Windows 10 LTSC 2022 (I guess 2022 will be the name as that applies to Windows Server 2022 which is based on the same bits and bytes) it will be supported to say fall 2025. If a new computer is installed in 2023 with Windows 10 LTSC 2022, it will have support for an additional 2 years, and at some point, before reaching the of support, it will have to be upgraded to a new version to remain supported for additionally five years.

The problem

The huge problem here is that this bring not only doubled license cost (or even more), but also mean that more work by IT will be required to upgrade the machines. This requires development of upgrade process and a lot of testing. The manhours required are at least three figures and will also involve and impact the business, with once again, no added business value whatsoever.

As this is often special hardware it is often placed in physical locations where the computers are not easily accessible, and the lifetime will likely exceed the typical lifetime of a device. And the fact that the hardware is placed in physical tight areas are also driving additional costs to exchange as there often needs to be special glass or metal work included.

Action!

Microsoft must reconsider to keep the support lifecycle for Windows 10 Enterprise LTSC at 10 years. Switching to Windows 10 IoT is not an option as that it not doable in terms of licensing as IoT is not available on enterprise agreements or through volume licensing, limited number of OEMs and re-imaging!

This is one of the most mysterious problems I’ve encountered! Anyone who can provide input is more than welcome to ping me on Twitter or Teams, or help by entering some basic information in this form.

UPDATE September 6, 2022: Update the problem description as the Web sign-in setting is also causing problems using Cloud PC (Windows 365): “Another user is signed in. If you continue, they’ll be disconnected. Do you want to sign in anyway?”. See more below under “Problem #2”.

UPDATE July 6, 2022: A response from Microsoft leads to the root cause being Web sign-in being enabled, which is in preview (and has been for quite a few years) and is also unsupported. Still does not explain the extreme intermittent occurrence of the problem but at least a great indicator and something to validate.

UPDATE July 5, 2022: Added this form to gather and hopefully be able to get to the root cause. Also, I’ve gotten indications on a potential causes leading to the New user state, more below.

Problem #1

You restart your Windows 10 or Windows 11 device (Azure AD Joined + MEM/Intune enrolled) and after the restart, instead of displaying the last logged on user, the only account on the sign-in screen is an account named “New User”.

This happens extremely rarely, but I’ve seen it a few times. The “New User” comes from nowhere and if you click Switch user it just returns to the same view as below.

I have seen the problem a few times for multiple Windows 10 versions back to at least Windows 10 v1909, and on multiple devices from multiple vendors. Unfortunately I’ve seen it once on a Windows 11 device as well. The other day this problem hit a colleague of mine as well so it’s not just me :) .

Problem #2

Cloud PCs established as part of Windows 365, in Azure AD Joined mode, experience the sign-in message that Other user is already logged in, every time when logging in (and even after restart):

Another user is signed in. If you continue, they’ll be disconnected. Do you want to sign in anyway?

Cause

I’ve gotten reports (thanks to the community) with a response from Microsoft leads to the root cause being Web sign-in being enabled, which is in preview (and has been for quite a few years) and is also unsupported.

This is also true for the environments where I have seen this problem occur so this is the most likely cause of the “New user” phenomena causing Problem #1!

For Problem #2 this setting is confirmed to be the problem – as that problem was very easy to reproduce!

Solution

Disable Web sign-in!

Summary

The Web sign-in setting is really treacherous, causing a lof of head ache. I suppose this is the reason Microsoft is not recommending this setting.

I’ve seen this problem with a couple of customers now that is using Windows Update for Business, when some machines were not offered Windows 10 20H1 (May 2020 update a.k.a. version 2004) nor Windows 10 20H2 although no policies should block it. Note: This also applies to Windows 11 feature upgrades.

Problem description

The new Windows 10 feature update is not offered via Windows Update (for Business) even if you do a manual scan for update. And, no feature update deferrals are configured, nor any specific Windows 10 version set using the “set feature update” to use. Still the new Windows 10 version is not offered which is sort of mysterious!

Investigation

Good old WindowsUpdate.log comes to the rescue! Get-WindowsUpdateLogs generated the log and then the fun began. To be honest it’s been some time since I last went into this log file, and after browsing some hundred lines of logs something interesting popped up:

ProtocolTalker DeviceAttributes[URI]

which is followed by the data:

E:DchuIntelGrfxExists=1&IsContainerMgrInstalled=1&FlightRing=Retail&TelemetryLevel=1& HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5 Chidbthle.inf_amd64_fd8e0a54b983f85c%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll& AppVer=10.0.18362.836&IsAutopilotRegistered=1&ProcessorIdentifier=Intel64%20Family%206 %20Model%20142%20Stepping%2012&DchuIntelGrfxVen=32902&OEMModel=Latitude%207200%202-in-1&UpdateOfferedDays=0&ProcessorManufacturer=GenuineIntel&InstallDate=1588155159& OEMModelBaseBoard=0PCKGK&BranchReadinessLevel=CB&DataExpDateEpoch_20H1=1611187200& IsCloudDomainJoined=1&Bios=2020&DeferFeatureUpdatePeriodInDays=0& IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-GB&DeviceFamily=Windows.Desktop&QUDeadline=2& UpgEx_20H1=Green&WuClientVer=10.0.18362.836&IsFlightingEnabled=0&OSSkuId=4& GStatus_20H1=0&App=WU_OS&CurrentBranch=19h1_release&InstallLanguage=en-GB&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=Dell%20Inc.& InstallationType=Clien

The interesting parts is in DataExpDateEpoch_20H1=1611187200 and if looking up that UNIX timestamp, it appears as though the installation would be performed on January 21, 2021 at midnight.

Explanation

The variable for DataExpDateEpoch_20H1 or DataExpDateEpoch_20H2 is indicating that the feature update will not be offered until the date is reached.

The evidence is true for a specific model as all of the specific model are blocked with the same timestamp. The problem is seen with multiple vendors, Dell, and Lenovo at least.

The explanation for this behavior is that Microsoft are blocking upgrades due to model, driver of firmware issues. Instead of downloading the entire package, starting the setup, and then finding out of a compatibility issue is not optimal. What is better is to block the feature update from being offered at all and that is (likely) what is going on here.

This is described and can be followed up in detail by using Update Compliance which now holds the SafeGuard information!

As it turns out, it also seems that if whatever underlying problem is fixed on Microsoft’s end, the feature update can be offered before the expiration date occurs.