The idea for this blog post was born during the week of MVP Summit at Microsoft in Redmond (March 5-9). I realize that depending on who you talk to they have different point of views on things. The view on “co-management” is a great example.

The purpose of this blog post is to present the options that exist for organizations moving to modern management. “Co-management” is the door opener and path for moving to modern management.

Why modern management?

Modern management is what I would say moving away from on-premise dependencies, creating a more flexible and mobile workplace and more cost-efficient management of Windows devices. This means doing things in new smart ways rather than keep doing them as you’ve done them for the last “100 years” or so. Why would you stop doing what you are doing and start doing things in new ways? Well, one is to save time for IT as well as end users and as time is money, you will be able to reduce costs in your organization. It’s also about not reinventing the wheel, which is what basically every organization is doing today in some sense.

Some practical examples is doing a F12/PXE deployment of machines as soon as they come in to the organization. Think new, and stop doing reference image building and stop certifying hardware and use modern deployment tools such as AutoPilot and Intune to save time and modernize the deployment process.

Another example is that you can reduce complexity and remove infrastructure, say for instance patching. Dismantle old WSUS servers and do patching via Windows Update for Business, which means relying on existing Microsoft infrastructure rather than downloading everything from Microsoft, approving patches, distributing patches etc. Again, do not reinvent the wheel and repeat what Microsoft is already offering in terms of infrastructure.

There are many more examples but I think you get the idea of modern deployment and management, stop doing things the way you’ve always done them and think new.

Introduction and definition of “co-management”

At the Microsoft Ignite conference in September 2017, Microsoft announced what is called “co-management”. “Co-management” is the first and fundamental step on the way to modern management to be able to use existing Windows devices and configuration “as is” but at the same time add a modern management tool. After doing that you can start the switch to modern management, as the switch to the modern world will not be done overnight for most organizations.

Now, “co-management” means different things to different people. My view on “co-management”, regardless if the customer is using ConfigMgr or not, is to keep your Windows client “as is”. With that I mean Active Directory joined and configured via GPOs and then adding MDM-enrollment to that to be able to start doing new configuration via MDM. For the sake of making “co-management” clear I’ve chosen to divide the customers into two, the ones with ConfigMgr and the ones without it.

And as a note, the MDM tool to use for modern management is preferably Microsoft Intune (part of the Enterprise Mobility+Security suite).

Fundamental thoughts

My idea is that once you’ve decided to go down the path to modern management – no more and I mean no more work whatsoever should be put into adding new stuff to your legacy solutions. That includes not making scripts, configuration and applications deployed or configured via on-premise Active Directory or ConfigMgr. Instead, you do this in the modern management tool (if possible). Focus one hundred percent on moving the current resources to the modern management world instead!

Goals

The ultimate goal which is something to strive for, is fulfilled when configuration, patching and applications are managed by a modern management solution, and there are no dependencies to on-premise resources such as ConfigMgr, distributions points, GPOs etc.

Do I believe this goal can be achieved regardless of organization and size? Yes. However, there are many challenges on the way and it will for sure not be easy nor quick for many organizations. For many organizations, it’s going to take years but for smaller organizations I see great possibilities to reach the goal on a much shorter period of time.

Applications

One of the biggest challenges in the modern world lies with applications. In the best of worlds, applications are moving away from using Kerberos or other traditional authentication mechanisms, as well as legacy code or runtime requirements. Instead rely on modern authentication and preferably OAuth 2.0, providing means to further remove dependencies to on-premise Active Directory at the same time enabling possibilities to use conditional access for instance.

Application strategy moving forward is a separate chapter and I will not cover that more in this blog post. I will solely focus on the deployment of the applications, as this is very much relevant in the various “co-management” scenarios.

Current applications, that is traditional and legacy applications packaged as MSI or in EXE format, needs to be replaced, reworked or repackaged. Today, repackaging can be done by repackaging to the AppX format. Popular packaging software like AdminStudio has had this capability for several years but if you want a free option look at Advanced Installer which also has the capability to package apps in the AppX format.

Regardless of the option you choose below for “co-management”, moving to this new packaging format is the way to move forward. At least for the option which is customers with no ConfigMgr, moving to this new package format is a requirement because there is no good way of deploying the applications unless you move to this new package format.

Note: MSIX is a new packaging format to come, as published on GitHub: MSIX Packaging recently, but for the moment AppX is the way to proceed until Microsoft eventually publish more information on MSIX.

Deployment Options

Customers without ConfigMgr

Option 1 (the only option for customers without ConfigMgr): Hybrid joined machines

(on-premise Active Directory joined + Azure AD registered/joined + GPO to set MDM auto enrollment)

If you do not use ConfigMgr, to activate “co-management” all you have to do is to make sure that your Windows 10 clients (1709 and later) are configured with the GPO setting to enable automatic MDM enrollment.

After that, start to move the GPO configuration over and add new configuration to MDM instead of using GPOs. Dismantle local infrastructure such as WSUS and start relying on Windows Update for Business. Also, look into AutoPilot.

Note: For hybrid joined machines it seems that Microsoft has not yet made (as of March 2018) it possible to be able to run PowerShell scripts via the Intune Management Extension. This is a very sad limitation because that means you have no way of deploying scripts for filling in the gap on current limitations of MDM, as you move to modern management.

Customers with ConfigMgr

Option 2: Hybrid joined machines (with Co-management in ConfigMgr unconfigured)

(on-premise Active Directory joined + Azure AD registered/joined + GPO to set MDM auto enrollment + ConfigMgr-agent installed via ConfigMgr)

This option mean you just connect your Windows 10 clients to your MDM solution with the GPO setting to enable automatic MDM enrollment, then stop doing what you are doing with GPOs and ConfigMgr today and instead do that in the MDM solution. This is the least effort option where you try to touch the ConfigMgr solution as little as possible and instantly just start the move away from ConfigMgr. This option is more suitable for smaller and rather simple ConfigMgr environments.

Option 3: Hybrid joined machines (with Co-management in ConfigMgr activated)

(on-premise Active Directory joined + Azure AD registered/joined + co-management activated in ConfigMgr + ConfigMgr-agent installed via ConfigMgr)

I suppose you can say that this is the true “co-management” in terms of what Microsoft would describe it as. This is the recommended way for most organizations that want to start the journey to modern management.

Option 4: Cloud joined machines (with Co-management in ConfigMgr activated)

(Azure AD joined + MDM joined + ConfigMgr-agent deployed via Intune)

Well this option is a good one but as the devices are not connected to an on-premise Active Directory, it requires that you have moved all GPOs and have managed to provide access to all on-premise resources for users when they are outside the company network. This option is more for future use, although this option might be good for some customers already.

Note: Even though devices are not connected to the on-premise Active Directory, they are able to use single sign on to access recourses on the internal network such as printers, network shares and other resources in the Active Directory domain. This is true as long as the device is on an internal network and has contact with an on-premise domain controller, where a Kerberos TGT is issued for accessing on-premise resources.

How to activate “co-management”

Option 1 and 2

For options 1 and 2 you configure your Windows devices and set the GPO “Enable automatic MDM enrollment using default Azure AD credentials” to Enabled. The GPO setting is located in Computer Configuration > (Policies) > Administrative Templates > Windows Components > MDM.

Option 3 and 4

The Microsoft Docs is the place to go to activate “co-management” in ConfigMgr. This includes the optional agent deployment via Intune.

Verify MDM connectivity and that your Windows clients are being “co-managed”

1. Dsregcmd command line

Run the following command to see if your devices are connected to Azure AD:

dsregcmd /status

The value for AzureAdJoined should read YES and MdmUrl should be set to for instance https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

2. Modern control panel “Access work or school”

To check if the device has registered properly with the MDM tool you can also look in the modern control panel “Access work or school” (located in Accounts). Click any of the Windows logos or the briefcase and if you have the Info button you know that you have an active MDM enrollment for this device.

3. In the GUI of the MDM tool

Of course, the device should also pop up in your MDM solution and in Intune it will display as “MDM” is the device is Azure AD joined with MDM enrollment and it will show “MDM/ConfigMgr” if you are using ConfigMgr (or using option 1, that is not using ConfigMgr but still activating MDM enrollment for hybrid joined machines).

Troubleshooting

AzureAdJoined = NO

If AzureAdJoined is NO when you run “dsregcmd /status” then your devices have not registered with Azure AD which is required to be using “co-management”. Check the following:

1. Check Event Viewer and the log Applications and Services Logs > Microsoft > Windows > AAD > Operational. Optionally go to View and click Show Analytic and Debug Logs to get additional logs, and in AAD get the Analytic log which you must Enable before it will start logging.

No automatic MDM enrollment is made

If the MdmUrl is empty when you run “dsregcmd /status” and there is no “Info” button in Access work or school, then verify the following:

1. Make sure that you are using Windows 10 v1709 or later.
2. (Option 1 and 2) Verify that the GPO with MDM enrollment applies to the device.
3. (Option 3 and 4) Verify in the CoManagementHandler.log that CoManagementSettings_AutoEnroll equals True.
4. Verify that MDM automatic enrollment is configured in Azure AD, i.e. Azure Portal > Azure AD > Mobility (MDM and MAM). Also check that the user is covered by the MDM User Scope.
5. Verify that the user logging into the machine has an Azure AD Premium license assigned.
6. Check Event Viewer and the log Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Optionally go to View and click Show Analytic and Debug Logs to get additional logs, and in DeviceManagement-Enterprise-Diagnostics-Provider get the Debug log which you must Enable before it will start logging.

This problem is interesting as it is not easily discoverable if you do not stare at the screen during the entire upgrade process, and hey, who does that? However, this is a very interesting finding when it comes to Windows as a Service that I am certain will affect many more enterprise customers (see cause section below).

Problem

Initiate an upgrade of Windows 10 to another version of Windows 10 using an inplace-upgrade task sequence via System Center Configuration Manager. The upgrade runs smooth until it reaches 75% (of the Upgrade step) where setup reboots the machine and then continue the last step of the upgrade, which is the migration phase. However, at 76% the user is presented with the login screen and the user thinks “well, the upgrade is done, let’s login!” after which the user login only to see a reboot a few minutes later, and also a rollback to the previous version of Windows.

The upgrade process is still running although the logon screen is presented, and when the user login, the migration engine of Windows setup shows a bunch of MIG errors due to files becoming locked. At the same time a rollback to the previous version of Windows 10 is initiated. The rollback by the way works very well! 

Cause

The cause of this issue is the software Net iD, which is a very common smart card application/credential provider for governments and others, providing smart card logon capabilities for all types of smart cards. When that piece of software is installed it somehow (still not determined exactly what is going on) interfere with the upgrade and the consequence is that the login screen is displayed although the upgrade continue in the background.

Workaround

Uninstall the Net iD client before doing inplace-upgrade to another Windows 10 version, and then install it as one of the last steps during the upgrade.

I’ve encountered quite an interesting issue when deploying a custom iOS (IPA) app using System Center Configuration Manager and Intune. The problem is that the deployment status for the app never reports as “Success” and is hung at “In progress”. As it turns out there is a mismatch in the version info that exist within the IPA file and the plist file that is included when deploying the IPA.

The CFBundleVersion listed within the IPA in the file info.plist

<key>CFBundleVersion</key>
<string>1.2.3</string>

must match the bundle-version found in the plist file that is used when creating the app deployment in Configuration Manager.

<key>bundle-version</key>
<string>1.2.3</string>

If these values do not match the status will never be reported as successful in the ConfigMgr console. After the September 2014 maintenance window for Intune I also suspect that this version mismatch is causing the app to be re-deployed over and over again, however this has yet to be confirmed.

Note: You can easily check the content of info.plist within the IPA by renaming the IPA to ZIP and extract its contents. Use a plist viewer of your choice (there are several free for trial) to check the CFBundleVersion.

When adding the Monitoring and Administration Feature of MBAM 2.5 and checking the System Center Configuration Manager Integraton features in the setup wizard you typically enter the URL to the Reporting Server, for instance http://configmgrsrv/ReportServer. If you get the error

The SQL Reporting Services URL that point to the MBAM reports is not valid

it actually means that you before installing the Monitoring and Administration features must install the MBAM Reports feature. That is even though you are integrating MBAM into System Center Configuration Manager. Why is that? Because when integrating MBAM with ConfigMgr, the only reports that are managed in ConfigMgr are the compliance reports.

If you are using System Center Configuration Manager 2012 R2 and Windows Intune to deploy email profiles to your iOS devices you should be aware of the fact that the email policy will vanish from your users’ iOS devices and then user then need to log in to the company portal for the email profile to get deployed once again to the iOS device. This is true in the following scenarios:

• You make a change to the email policy, for instance changing the name of the email policy in the ConfigMgr console.
• You install Cumulative Update 2 for System Center Configuration Manager 2012 R2.

No status on a fix for this bug at the moment.

Encountered an interesting issue doing Windows 8.1 Deployment using ConfigMgr 2012 R2. A specific model was constantly failing at the very last step in the task sequence. The smsts.log revealed a few errors with the codes 80070002 and 80072ee2, failing at random files every time from the MDT Toolkit Package.

A few examples:

DownloadFiles() failed. 80072ee2.
DownloadContentAndVerifyHash() failed. 80070002.

It seems Microsoft is aware of the issue and the current workaround is to set the following variables first in the task sequence to address the problem until it hopefully will be fixed in a coming hotfix.

SMSTSDownloadRetryCount = 5
SMSTSDownloadRetryDelay = 15

After settings these variables the deployment finish as expected.

When setting up and connecting Windows Intune to System Center Configuration Manager 2012 R2 and you are trying to enroll a mobile device (iOS device), you may receive the error “UserLicenseTypeInvalid”.

Checking the cloudusersync.log on the ConfigMgr server listed the following two lines which seemed to be relevant:

ERROR: SetLicensedUsers exception System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'msub05.manage.microsoft.com'

Solution: Simply restart the SMS_EXECUTIVE service and everything is back on track and you can enroll the user on the mobile device. I have seen this a few times now and thought I’d share some information on it, not sure why it fails quite often though.

UPDATE: I have also seen this (without the error message above) when the user has not been added yet to the User Collection and synced to Intune. Solution is to make sure that the user is added to the Intune user Collection and make sure via cloudusersync.log that the user is added correctly to the Intune service.

Two events are coming up; Deployment Roadshow vNext featuring System Center Configuration Manager 2012 and Microsoft Deployment Toolkit 2012 and a Windows 8 loadfest.

Deployment Roadshow vNext will take place in Sweden’s four largest cities and it will be presented by myself and colleague Johan Arwidmark from Knowledge Factory, Wally Mead the SCCM guru from Microsoft Corp and Mikael Nyström from Truesec. More info about the event at http://www.deploymentevents.se.

The Windows 8 loadfest will take place in early December in Stockholm and it hosted by me, Johan Arwidmark, Lars Gustavsson and Tim Nilamaa. More info about the event at http://www.deploywindows8.se.