Skip to main content

Neil Petersen - This is my Blog

Search This Blog

Modern Management - Part Six - Resetting Autopilot Devices

on July 31, 2019

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Following on from my last post Part Five - Windows Updates here's a quick post around Modern Management and how to reset Autopilot devices.

Modern Management - Part One - Autopilot Demo on Hyper-V

Modern Management - Part Two - Office 365 Deployment via Intune

Modern Management - Part Three - Packaging Win32 Application for Intune

Modern Management - Part Four - OneDrive Silent Configuration

Modern Management - Part Five - Windows Updates

Modern Management - Part Six - Resetting Autopilot Devices

Modern Management - Part Seven - Bitlocker

Modern Management - Part Eight - Windows Activation

Modern Management - Part Nine - BGinfo via Intune

Modern Management - Part Ten - Harvesting Autopilot Hardware IDs

Modern Management - Part Eleven - Migrate File Shares to Teams

Modern Management - Part Twelve - Synchronising AD Groups with Office 365 Groups

Modern Management - Part Thirteen - Skype for Business to Teams Migration

Modern Management - Part Fourteen – MCAS Blocking File Downloads

To do this we create a Device Configuration profile with the following settings:

This allows users to reset Autopilot devices (for insturctions on this take a look at https://docs.microsoft.com/en-us/education/windows/autopilot-reset)

We can also reset devices from within Intune:

10 AutoPilot device device configuraiton profiles devices Intune management Modern reset windows

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

Post a Comment

Popular Posts

AD - Weight and Priority of a Domain Controller

Changing the Weight and Priority of a Domain Controller Weight By default all Domain Controllers have a weight of 100, the heavier the weight the more often the Domain Controller is referred to. If there are two servers in a site and one has a weight of 100 and the other 200. The Domain Controller with twice the weight will receive twice the referrals. To modify the weight of a Domain Controller the registry key, use: HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LdapSrvWeight Priority By default all Domain Controllers have a priority of 0, the lower the priority the first in priority. The Domain Controller with the lowest priority in the site will receive ALL authentication requests unless it is unavailable. If the lowest priority Domain Controller is unavailable then the next lowest Domain Controller in the site will receive all requests. To modify the priority of a Domain Controller the registry key, use: HKLM\SYSTEM\CurrentControlSet\Ser

Troubleshooting Azure AD Hybrid Join and Intune AutoEnrollMDM

Working for a number of clients recently and we were deploying Self-Service Password Reset from a Windows 10 logon screen ( https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-sspr-windows ) and we came across was the machines would not Hybrid Join . using dsregcmd /status we could see the AzureAdJoined still had a value of No so w e went through the following checklist: Checked Hybrid Join was enabled using the Azure AD Connect wizard - https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains Checked the device control Group policies - https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-control Checked the device settings within the Azure Portal - https://docs.microsoft.com/en-us/azure/active-directory/devices/azureadjoin-plan#configure-your-device-settings Checked the SSO URLs had been added into local intranet zone (SSPR) - https://docs.microsoft.com/en-us/azure/ac

SCCM - PS - Detection Method for User APPDATA

I needed a detection method to confirm the presence of a file under the %APPDATALOCAL% directory and a HKCU registry key. Thanks to this post and this one I was able to achieve this. #Detects if C:\Users\%username%\Appdata\Roaming\folder_name\file_or_subfolder_name exists Function CurrentUser{ #CurrentUser function converts the username object string "@{username=domain\user}" # to the exact logon string "user" like the example below #@{username=DOMAIN\USER} #@{username DOMAIN\USER} #DOMAIN\USER} #DOMAIN\USER #DOMAIN USER #USER $loggedInUserName = get-wmiobject win32_computersystem | select username $loggedInUserName = [string]$loggedInUserName $loggedinUsername = $loggedInUserName.Split("=") $loggedInUserName = $loggedInUserName[1] $loggedInUserName = $loggedInUserName.Split("}") $loggedInUserName = $loggedInUserName[0] $loggedInUserName = $loggedInUserName.Split("\") $loggedInUserName = $loggedInUserName

Modern Management - Part Seven - Bitlocker

Sorry it's been a while but following on from my last post Modern Management - Part Six - Resetting Autopilot Devices , here is my lastest post around Modern Management and deploying Bitlocker Device Configuration Profiles as part of an Autopilot deployment. Modern Management - Part One - Autopilot Demo on Hyper-V Modern Management - Part Two - Office 365 Deployment via Intune Modern Management - Part Three - Packaging Win32 Application for Intune Modern Management - Part Four - OneDrive Silent Configuration Modern Management - Part Five - Windows Updates Modern Management - Part Six - Resetting Autopilot Devices Modern Management - Part Seven - Bitlocker Modern Management - Part Eight - Windows Activation Modern Management - Part Nine - BGinfo via Intune Modern Management - Part Ten - Harvesting Autopilot Hardware IDs Modern Management - Part Eleven - Migrate File Shares to Teams Modern Management - Part Twelve - Synchronising AD G

Office 365 - Exchange Hybrid Relationship Reference

I have listed a working known good reference deployment so you can compare this against your deployment when troubleshooting free/busy sharing for example. In the following commands the mailbox locations are important Office 365 mailbox - Test.MBX1@devpetersenit.ltd On-Premise Mailbox - Neil@ devpetersenit.ltd Other articles that may help are Troubleshooting free/busy issues in Exchange hybrid environment https://support.microsoft.com/en-us/help/10092/troubleshooting-free-busy-issues-in-exchange-hybrid-environment https://support.microsoft.com/en-us/help/2752387/users-from-a-federated-organization-cannot-see-the-free-busy-informati - https://blogs.technet.microsoft.com/exovoice/2016/01/04/freebusy-troubleshooting/ Testing Autodiscover - https://testconnectivity.microsoft.com https://support.microsoft.com/en-us/help/2838688/-free-busy-information-couldn-t-be-retrieved-becau se-the-attendee-s-m From On-Premise Test-OAuthConnectivity -Service EWS -TargetUri https://o

SSPR 0029 We are unable to reset your password due to an error in your on-premises configuration.

This was one of those annoying ones that took hours (days) with Microsoft to resolve. We're sorry We cannot reset your password at this time because of a problem with your organisation’s password reset configuration. There is no further action you can take to resolve this situation. Please contact your admin and ask them to investigate. To learn more about the potential issue, read the article Troubleshoot password writeback. If you'd like, we can contact another administrator in your organisation to reset your password for you. Additional details: SSPR _0029: We are unable to reset your password due to an error in your on-premises configuration. Please contact your admin and ask them to investigate. EVENTID 6329 - An unexpected error has occurred during a password set operation. "ERR_: MMS(5624): E:\bt\863912\repo\src\dev\sync\ma\shared\inc\MAUtils.h(58): Failed getting registry value 'ADMADoNormalization', 0x2 BAIL: MMS(5624): E:\bt\8

Exchange Hybrid - Mailbox Permissions - ACLableSyncedObjectEnabled

The key here is to review the guidance at https://docs.microsoft.com/en-gb/exchange/hybrid-deployment/set-up-delegated-mailbox-permissions?redirectedfrom=MSDN#enable-aclable-object-synchronization It is important that the ACLableSyncedObjectEnabled $True before you migrate mailboxes or you will need to reconfigure these manually following the migraiton of mailboxes to Exchange Online. It is important that the ACLableSyncedObjectEnabled $True before you migrate mailboxes or you will need to reconfigure these manually following the migraiton of mailboxes to Exchange Online. To enable ACLable Synced Object run the following on the on-premise Exchnage Organisation: Set-OrganizationConfig -ACLableSyncedObjectEnabled $True If you have forgotten to enabel this then you change change this buy running: #To enable ACLs on a single mailbox, run the following command Get-AdUser "UserMailbox Identity" | Set-AdObject -Replace @{msExchRecipientDisplayType = -1073741818 } #To ena

Exchange HCW8078 - Migration Endpoint could not be created.

Recently during an implementation of the Hybrid Configuration Wizard I came across the HCW8078 error, this is now the 3rd time I've come across this so thought I'd make a note for everyone else. This happens with EOL cannot talk to the MRS Proxy service and created the following errros in the HCW log file: HCW8078 Migration Endpoint could not be created. Error details: The HTTP request was forbidden with client authentication scheme 'Negotiate'. --> The remote server returned an error: (403) Forbidden. Using the Test-MigrationServerAvailability command we can test access to the MRSProxy Test-MigrationServerAvailability -ExchangeRemoteMove -Autodiscover -EmailAddress user@domain.com -Credentials ( Get-Credential ) As we can see this failed: After checking that the: MRS Proxy is enabled Microsoft Remote Connectivity Analyzer https://testconnectivity.microsoft.com/ Authentication is configured correctlyOther checks - https

Modern Management - Part Nine - BGinfo via Intune

I've used BGinfo ( https://docs.microsoft.com/en-us/sysinternals/downloads/bginfo ) for years across numerous clients to present helpful support informaiton to clients on the desktop. Modern Management - Part One - Autopilot Demo on Hyper-V Modern Management - Part Two - Office 365 Deployment via Intune Modern Management - Part Three - Packaging Win32 Application for Intune Modern Management - Part Four - OneDrive Silent Configuration Modern Management - Part Five - Windows Updates Modern Management - Part Six - Resetting Autopilot Devices Modern Management - Part Seven - Bitlocker Modern Management - Part Eight - Windows Activation Modern Management - Part Nine - BGinfo via Intune Modern Management - Part Ten - Harvesting Autopilot Hardware IDs Modern Management - Part Eleven - Migrate File Shares to Teams Modern Management - Part Twelve - Synchronising AD Groups with Office 365 Groups Modern Management - Part Thirteen - Skype f

Azure AD SSO - Troubleshooting

If you have configured Azure Active Directory Connect to use Seamless Single Sign on and are having trouble with signing on ensure the following: You are logging onto a Domain Joined machine connected to the corporate network, the machine must have line of sight to a Domain Controller to request a Kerberos ticket. The following URLS are added to the Local Intranet zone via GPO (User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page by modifying the "Site to Zone Assignment List") https://autologon.microsoftazuread-sso.com https://aadg.windows.net.nsatc.net Enhanced Protected Mode is disabled (Computer Configuration\Computer Policy\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\Turn on Enhanced Protected Mode) You can use klist purge to purge the Kerberos tickets, then klist get AZUREADSSOACC to ensure that you can receiver a Kerberos ticket

Powered by Blogger