Microsoft Windows Intune 2.0: Quickstart Administration
Manage your PCs in the Enterprise through the Cloud with Microsoft Windows Intune
David Overton
BIRMINGHAM - MUMBAI
Microsoft Windows Intune 2.0: Quickstart Administration Copyright © 2012 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
First published: January 2012
Production Reference: 2230112
Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-84968-296-1 www.packtpub.com
Cover Image by Meir Jacob (
[email protected])
Credits Author David Overton Reviewers Richard Diver
Project Coordinator Jovita Pinto Proofreader Stephen Swaney
Robert Pearman Jason Wallace Andy Trish Acquisition Editor Kerry George
Indexer Monica Ajmera Mehta Graphics Valentina Joseph D'Silva Manu Joseph
Lead Technical Editor Susmita Panda
Production Coordinator Shantanu Zagade
Technical Editors Kedar Bhat Priyanka Shah Naheed Shaikh
Cover Work Shantanu Zagade
About the Author David Overton has been in the IT industry for over 25 years and has worked at
Microsoft, in the UK, for more than eleven years. David fell in love with Small and Medium Business when he was given responsibility for engaging with journalists, at the time of the launch of Small Business Server 2003, in the UK. He has also written Small Business Server 2008 Installation, Migration and Configuration. For the next four years, David was responsible for improving SBS deliveries by Microsoft partners. David has since moved on to other roles within Microsoft but still continues work with a number of small and medium businesses and Microsoft partners. David's role at Microsoft includes working with organizations that are moving towards cloud-based computing models. He personally became involved with the Windows Intune product, as a result. Working with both the UK and US teams, in his role there, has lead to the writing of this book.
Besides his day job, David is also a writer; he has written for consumer publications and Windows XP and Windows Vista magazines, and he blogs at http://davidoverton.com, where he helps readers find solutions to questions and problems. In 2009, David published his first book on SBS 2008, which was well received. When not working or writing, David likes to spend time with his family and also tries to fit in sailing, at any time of the year, in any weather.
Acknowledgement I would like to thank all those around me who have inspired me to undertake another book to help others. My wife and daughters are incredibly generous with what would be our time together, allowing me to borrow it to write. My father, who is always asking me why things do and don't work and what can be done to fix them. Friends and colleagues have provided feedback, honestly, that has helped shape the book with their insight and differing opinions, enabling it to answer more questions and provide more useful insight. Finally, I want to thank and remember my mum. She taught me to chase my dreams, no matter how difficult they may be. My mum got to see my first book published and to see this one start, but was not there, in the end, to see this book arrive in its finished form. I hope she looks down at me from wherever she is and is as proud of me as I am of her. I will miss you, mum, and your support for my projects, such as this book. For this reason, I dedicate this book to you, for all the love, knowledge, and strength you have given me.
About the Reviewers Richard Diver is a passionate technologist with over 10 years' experience in
Enterprise level IT systems. Having worked his way up from helpdesk to server team, and from consultant to architect, Richard has worked on many large-scale projects and gained a wide breadth of knowledge in technology, people, and process. During his time at Microsoft, Richard developed technical content and training courses in Windows Server Performance, Sysinternals Tools, and Personal Productivity, delivering this to internal audiences and customers. He is currently working as an Enterprise Architect for Methods Consulting, a London-based consultancy specializing in the Public Sector. Richard has recently completed the review of the latest book Windows Sysinternals Administrator's Reference by Mark Russinovich, and has completed the creation of an accompanying training course that is now being delivered by Microsoft Engineers to their Premier customers.
Andy Trish is an ex-military man with two war medals. He came into the IT
world in 1999 and has since gained over 60 Microsoft Certified Professional qualifications in a whole variety of subjects. He has recently written the questions and answers for some of the new Microsoft exams. He has held the title of Microsoft Most Valuable Professional (MVP) since 2008 and contributed to developing the Microsoft Partner Network. Andy has presented at five Microsoft Worldwide Partner Conferences and a variety of other events, globally.
He was the Founding Director of NCI Technologies, based in Cornwall, that won the Microsoft OEM Hardware Reseller of the Year, 2011 award and was finalist for Microsoft Midmarket Provider of the Year, 2011. He has grown the company to a staff of twenty-eight, in just seven years. Andy also co-authored Thinking of Maximising Your Investment as a Microsoft Partner? Ask the Smart Questions, with Julie Simpson.
www.PacktPub.com Support files, eBooks, discount offers, and more You might want to visit www.PacktPub.com for support files and downloads related to your book. Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at service@ packtpub.com for more details. At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.
http://PacktLib.PacktPub.com Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can access, read and search across Packt's entire library of books.
Why Subscribe?
Fully searchable across every book published by Packt
Copy and paste, print, and bookmark content
On demand and accessible via web browser
Free Access for Packt account holders If you have an account with Packt at www.PacktPub.com, you can use this to access PacktLib today and view nine entirely free books. Simply use your login credentials for immediate access.
Instant Updates on New Packt Books Get notified! Find out when new books are published by following @PacktEnterprise on Twitter, or the Packt Enterprise Facebook page.
Table of Contents Preface 1 Chapter 1: Overview of Cloud Computing 7 Centralized solution, management, and upgrades Elastic in scale and power Pricing based on utilization Delivered using Internet protocols Secure and private Service Level Agreement
9 10 11 11 12 12
Availability 12 Service hours 13 Recompense 13 Window Intune SLA 14
Multiple client device types Client Software Programmable interfaces Different levels of cloud computing Infrastructure as a Service Platform as a Service Software as a Service Challenges of cloud computing Network requirements Data accesses and synchronization Network bandwidth and latency
14 15 16 16 17 17 18 18 19
19 19
Security 20 Customization 20 Bringing all this together for Windows Intune 21 Summary 21
Table of Contents
Chapter 2: Introduction to PC Management Concepts Continuous cycle of PC Management Definition of IT management goals Using policies for configuration and deployment Policies that deliver against the business goals
Ensuring the security settings on the PC provide an adequate level of protection Tracking the hardware and software assets
Policies that help the IT team do their job Deploying Windows 7 for everyone Keeping the PC up-to-date with updates
23 24 24 25 26
26 28
29
29 29
Reactive response to problems Ongoing maintenance tasks Dealing with alerts Working with users' support requests Dealing with major problems
30 30 31 31 32
Reporting on IT management Summary
33 34
Hardware 32 Software 33
Chapter 3: Overview of Windows Intune Features Why use Windows Intune Situations when Intune makes sense
First management solution for small and medium enterprises Moving to a subscription management solution Managing part of an estate, such as computers that users bring in from home
Windows Intune solution architecture Windows Intune feature set Windows 7
Existing Windows 7 Software Assurance customers Microsoft Desktop Optimization Pack
35 35 36
36 37 37
37 38 39
40 40
Installation 42 Management console 43 Security management 44
Windows system updates 44 Anti-malware 45 Firewall control 46
Auditing 47 Reporting 47 Alerts and Support 49
Alerts 50 Remote Assistance 52
[ ii ]
Table of Contents
Software distribution Managing multiple organizations Summary
Chapter 4: Signing Up for Windows Intune and Installing the Client Software
Preparing for Windows Intune Licensing of Windows Intune Software and hardware requirements for Windows Intune Hardware requirements Software requirements Skills required to manage with Windows Intune
53 54 55
57 57 58 58
59 60 60
Signing up to Windows Intune Create a Windows Live ID Sign into MOCP and configure contacts Add Windows Intune to your basket and confirm the purchase Activate your purchase Adding MDOP to your purchase Installing Windows Intune onto a client PC Downloading the client software to the device Unzipping and installing
62 62 66 67 70 71 72 72 74
Waiting for the update process to complete Confirming installation Enabling others to manage your PC estate with Windows Intune Adding a partner to your subscription
76 76 78 79
Summary
82
Installing via alternative methods Image based deployment
Changes a partner sees when managing more than one client
Chapter 5: Configuring Windows Intune
Adding additional administrators to Windows Intune Adding an additional administrator Changing the Tenant Administrator Configuring computer groups Choosing a group structure Creating the group structure Assigning PCs to groups Configuring Windows Intune alerts Configuring alert activation Changing alert notification
[ iii ]
74 75
80
83 83 84 85 87 88 90 92 96 96 98
Table of Contents
License management Managing your Microsoft Volume License details Managing your other license details Summary
Chapter 6: Configuring Management Policy Policy management Windows Firewall Settings Windows Intune Center Settings Windows Intune Agent Settings General section Endpoint Protection section Updates section Network bandwidth Deploy Policy
104 104 107 109
111 111 114 119 121
122 122 128 129 130
Editing an existing policy Update management Selecting products and classification of updates to manage
131 131 132
Configuring automatic approval of updates Manually approving updates Summary
135 138 142
Update Classification
Chapter 7: Software Deployment
134
143
Preparing an application for uploading 144 Understand how the application is installed in silent or quiet mode 144 Create a folder for each installation package 144 Place all files needed for installation into one folder 145 Examples 145 Office 2010 Adobe Reader and Flash Intel chipset software
Using App-V packaging for deploying a package Uploading an application Adobe Flash – 64-bit MSI Adobe Flash – 32-bit EXE Adobe Reader – Windows 7 EXE Adobe Reader – XP SP3 EXE Intel drivers Office 2010 Deploying a package Managing Non-Microsoft Updates
[ iv ]
145 146 147
147 148 149 152 155 156 157 157 158 161
Table of Contents
Removing a package Uninstalling software from a client PC Removing a software package Summary
Chapter 8: Tracking and Reporting
Reporting basics Reporting basics in Reports workspace Selection customization Saving and loading customizations Sorting data in the columns Printing a report Exporting data
Reporting basics in Alerts workspace Update reports Tracking software usage Software installed on an individual computer Estate-wide software view Tracking hardware Computers workspace view Hardware Inventory Reports License management Purchase report Installation report Alerts reporting Custom reports Reporting on overall PC management achievements Summary
Chapter 9: Monitoring and Responding to Windows Intune Alerts General Windows Intune alerts Monitoring alerts Responding and closing alerts Malware alerts Testing malware checks are working Actions following malware instance Remote Assistance alerts Preparing to deliver support
Preparing the client computer for support Preparing the support agent's computer to offer support
[v]
167 167 168 169
171
172 173
173 174 175 175 177
178 179 180 181 182 185 186 188 189 189 189 190 192 193 193
195 196 196 199 201 202 203 204 206
206 207
Table of Contents
Providing Assistance
207
Receiving alert and responding Providing remote support
208 211
Summary
218
Chapter 10: Resolve Problems Using Microsoft DaRT
219
Chapter 11: Deploying Windows 7 Enterprise Edition
243
Chapter 12: Integration with Existing Microsoft Products
271
Downloading MDOP 219 Installing DaRT 222 Building a DaRT CD 226 Using DaRT to resolve issues 231 Locksmith 234 Crash Analyzer 235 Hotfix Uninstaller 239 Standalone System Sweeper 240 Summary 242 Downloading Windows 7 Enterprise Edition Checking pre-requisites for Windows 7 Backing up settings for migration Installing Windows 7 Enterprise Edition Restoring user settings and installing applications Updating Windows Intune Removing the computer from Windows Intune Installing the Windows Intune tools Considering tools for scale deployment of Windows 7 Microsoft Assessment and Planning (MAP) toolkit Microsoft Deployment toolkit Summary
Typical computing scenarios Desktop environment Management tools Services to enable productivity and collaboration Office 365 and on-premise SharePoint and Exchange System Center On-premise Windows Server Identity management with Active Directory Group Policy Update management with Windows Software Update Services
[ vi ]
244 247 249 253 260 265 265 267 268 268 269 269 272 272 273 273 274 274 275 276 276 277
Table of Contents
Windows Small Business Server Windows Home Server On-premise versus cloud solutions summary Mixing on-premise and cloud solutions Anti-malware products Summary
Index
[ vii ]
278 279 280 281 282 283
285
Preface Microsoft Windows Intune is a cloud service solution that simplifies how small and mid-sized businesses manage and secure PCs using Microsoft cloud services and Windows 7—so your computers and users can operate at peak performance all the time. This step-by-step guide will show you how to plan, set up, and maintain Windows Intune, showing you how to manage a group of PCs (either one business or several) from the base operating system, through to the patches, anti-malware solution and deployed software and policies from a central console, using the Windows Intune service. This book takes you through all the steps to plan, set up and maintain Windows Intune and how to manage a group of PCs. The book starts by providing an overview of cloud computing and PC management. The book then dives into topics such as Windows Intune features, signing up for Windows Intune and installing the client software, configuring Windows Intune, proactive management, and monitoring and dealing with alerts, including remote assistance among others. As Windows 7 is part of Windows Intune, the book will also cover the minimum steps required to move from Windows XP to Windows 7 while keeping user settings and preferences.
What this book covers
Chapter 1, Overview of Cloud Computing, explores the new cloud computing and cloud-based services world that we are moving rapidly towards and includes Windows Intune. Before we can embark on this journey it is important that we understand the benefits and pitfalls that cloud services bring with them and how they apply to us. One mechanism to help protect us against the uncertainties is the use of Service Level Agreements, which are explained for Windows Intune.
Preface
Chapter 2, Introduction to PC Management Concepts, introduces the important concepts behind PC management, with a focus on ensuring that the needs of the business are the fundamental driver of the IT policy we implement with Windows Intune. We then explore how the IT policy decisions are taken to reflect these needs and are then able to demonstrate that they are delivering on them. Chapter 3, Overview of Windows Intune Features, describes the features within Windows Intune, ensuring that we can take advantage of all of the benefits it has to offer, including anti-malware software, update management for both the Windows Operating System, and Windows applications, software distribution, system alerts and reporting. Chapter 4, Signing Up for Windows Intune and Installing the Client Software, walks through the Microsoft Online Services Portal, configuring the service administrators, and if desired, assigning a partner to assist us. We also download and install the Windows Intune client software and ensure it is up and running on each computer. Chapter 5, Configuring Windows Intune, runs through the configuration steps for Windows Intune. This starts by adding additional administrators to the system to allow multiple system’s managers. We then configure the computer groups for the management process. We enable the alerts that Windows Intune will raise and configure who they are sent to. Finally, we configure the Microsoft and non-Microsoft software license purchases so Windows Intune can report on compliance to this. Chapter 6, Configuring Management Policy, enables us to construct the policies that Windows Intune uses to configure each computer. This covers firewall, anti-malware, and operating system and software updates. The Windows updates section includes configuring which update categories are checked on each computer to see if they are required and the deployment policy options, either manual or automatic approval. Chapter 7, Software Deployment, using Windows Intune can be a complex process as all software must be installed silently and with all the files in one location. We explore the process, setting up the command switches and including the right files for a number of common applications as working examples. Chapter 8, Tracking and Reporting, is a key activity to demonstrate that we are delivering a useful service. We explore the activities required to track the hardware and software managed by Windows Intune and then the reporting options for software use, alerts, and hardware tracking. Since custom reports are often desired, we also look at how these could be delivered into a spreadsheet and then enable greater insight if desired.
[2]
Preface
Chapter 9, Monitoring and Responding to Windows Intune Alerts, requires different responses depending on the alert and the level. We will examine how to monitor the computers and deal with the special case of remote assistance alerts that a user can request and require an almost immediate response due to the fact that someone is waiting for us. Chapter 10, Resolve Problems Using Microsoft DaRT, is an optional purchase with Windows Intune that is delivered as part of the Microsoft Desktop Optimization Pack. It can be used to resolve deep technical issues that stop a computer booting or being accessed by a user. We will understand how we can repair a system, change passwords, and edit the devices configured on a computer. This is a critical for all IT desktop managers. Chapter 11, Deploying Windows 7 Enterprise Edition, is something many of us will have to do and is made easier as Windows Intune includes the license required to update to the latest version of Windows. We will cover the process of migrating from Windows XP to Windows 7 Enterprise Edition. This includes moving the user settings from one system to another and then updating Windows Intune. Chapter 12, Integration with Existing Microsoft Products, is an area we explore as many of us will use Windows Intune with other Microsoft technologies. We examine how Window Intune interacts with other Microsoft products and whether they are a natural fit for use with Windows Intune.
What you need for this book
The requirements for Windows Intune are very simple. We need a group of Windows-based computers that we want to manage, access to the Internet, and a web browser that supports Microsoft Silverlight.
Who this book is for
If you are an administrator or partner who wants to plan, set up, and maintain Windows Intune and manage a group of PCs, then this book is for you. You should have a basic understanding of Windows administration, however, knowledge of Windows Intune would not be required.
Conventions
In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning. [3]
Preface
Code words in text are shown as follows: "Type a group name, such as Office Licenses." Any command-line input or output is written as follows: # cp /usr/src/asterisk-addons/configs/cdr_mysql.conf.sample /etc/asterisk/cdr_mysql.conf
New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "If you want the user to have full permissions, select Full access, otherwise select Read-only access".
Reader feedback
Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of. To send us general feedback, simply send an e-mail to
[email protected], and mention the book title through the subject of your message. If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.
Customer support
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
Errata
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you would report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub. com/support, selecting your book, clicking on the errata submission form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website, or added to any list of existing errata, under the Errata section of that title.
[4]
Preface
Piracy
Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works, in any form, on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy. Please contact us at
[email protected] with a link to the suspected pirated material. We appreciate your help in protecting our authors, and our ability to bring you valuable content.
Questions
You can contact us at
[email protected] if you are having a problem with any aspect of the book, and we will do our best to address it.
[5]
Overview of Cloud Computing Welcome to the cloud computing revolution currently sweeping through the IT landscape. It might be slightly confusing as to why we are starting a book on PC management with an introduction to cloud computing, however, the management service you are signing up for is a cloud based solution, with benefits and challenges that need to be addressed and planned for. Through this chapter we will understand what cloud computing is and how it compares to the traditional on-premise computing models of today. We will then discuss what this means to us when relying on the Windows Intune Service and highlight other cloud computing services that we might want to use, or perhaps already be using from the cloud. The one word of warning that I will give here is that every IT company on the planet appears to have a definition of cloud computing that suits the products they sell. Here, we will define the key aspects that are required for something to be a cloud computing solution. In this chapter, we will cover the following topics: •
Facets of cloud computing
•
Different levels of cloud computing
•
Challenges of cloud computing
•
Bringing all this together for Windows Intune
Overview of Cloud Computing
We are going to cheat a little. I'm not going to provide one of those quotable definitions of cloud computing, but rather explain what I believe are the key facets of cloud computing and how these benefit us and provide us with caution in some areas. The reason I'm going to do this is because I recently saw a presentation by a UK government official that stated they had found twenty-two definitions of cloud computing and none of these definitions fitted their needs, so they defined number twenty-three. No doubt I will upset some in the IT world with my information, but that is one of the luxuries of being the author, although I think this aligns with most of the twenty-three definitions to date. The key facets of a cloud solution are as follows: •
Centralized solution, management, and upgrades
•
Elastic in scale and power
•
Pricing based on utilization
•
Delivered using Internet protocols
•
Secure and private
•
Service Level Agreement
There are other facets that are often part of a cloud solution, but not required and we shall also explore these: •
Multiple client device types
•
Client software
•
Programmable interfaces
What should not be ignored is that all of the these facets could be delivered on our premises, especially if the delivery is for a large organization. However, the economies of scale and shared fixed costs that trend to zero are limited by our own ability to scale. Some would call this on-premise solution a private cloud, while others would call it a well-managed data center with many aspects shared with a historic well-run mainframes estate. As a side note, my computing life started with mainframes and it makes me smile that a mainframe expert would see almost all of the key facets of a cloud solution as those by which mainframe based solutions were delivered from private data centers. This is one of the key things to understand here. While Internet scalability enables a lower cost model and the protocols are becoming more manageable even with our firewalls that protect our networks as they connect to the Internet, there is very little here that by itself is new. The uniqueness here is that organizations like Microsoft are investing billions of dollars to build the data centers and solutions that bring each facet together into a handful of locations at a game changing price point. [8]
Chapter 1
Centralized solution, management, and upgrades
Given that a cloud service is normally provided over the Internet, for scale, the solution will be located in a handful of data centers owned and managed by the service provider. They will provide everything we need to run the solution, from physical servers to networking and application software; however we are not be able to directly access this. We use the interfaces they provide for the services and the service provider manipulates hardware, software, and configures the network for us. The key thing is that it is a highly replicated solution that has a level of management that is taken care of for you. The different cloud computing models and what is managed for you, versus by you, will be discussed later in this chapter. The following diagram demonstrates the items that could move from a distributed to a centralized solution with cloud services. We can see that with a centralized solution, more resources are required in an IT function rather than repeated in each department. While the boxes are not drawn to scale, we should get economies of scale as things are centralized. Centralization can take place on our premises or using a cloud services provider where some of the IT functions in the diagram are, in effect, outsourced to the cloud service provider. Distributed
Centralized Servers
IT provided
Multi-Department Servers and applications
Production
IT provided
Production
Services Like e-mail and internet connection
PC’s
Storage Servers Locally managed Pc’s software, Anti-Malware and Updates
Central services,like e-mail and internet connection Software managed, AntiMalware and Updates
Sales team
Admin team
Storage provided and backed up Servers
Storage Servers
Sales team
PC’s
Admin team Locally managed Pc’s and software, Anti-Malware and Update
PC’s
[9]
Locally managed Pc’s and software, Anti-Malware and Updates
Storage
Overview of Cloud Computing
With Windows Intune, all the information about each Windows computer is centrally stored in multiple Microsoft data centers and can be managed by us, no matter whether a server, the network, or even the entire data center fails. The application that runs on this infrastructure is the Windows Intune management software and it is maintained and upgraded without needing to be involved in the process. We will also have client software that connects to this infrastructure that is provided by Windows Intune, but the installation onto each client computer still falls to us to manage. When we make a change using the management tools at the data center, this will automatically be distributed out to the client computers provided they are connected to the Internet, implementing our changes without having to visit or touch these machines. While Windows Intune centralizes the management function, storage and applications are still provided in the same way as previously delivered.
Elastic in scale and power
The Internet is a big place and the demands on services can be tiny or massive and this is expected to change over time, sometimes within minutes. A cloud solution should have that flexibility built into it. When we deliver computing resources in our own offices or data center, we have to buy the right number of servers and storage to enable us to meet the peak demand. Probably, because it is too complex to do anything else, most organizations simply leave these servers on all the time, consuming electricity, but adding no value to the business. In a cloud environment, servers are started and stopped as needed to deliver the solution, often by the service provider on our behalf. We can see all the opportunities that an elastic service can simply scale up or be turned off according to our business needs in the following diagram: Massive growth
Comouting Resources Required
Month / year end peak On Premise Resource level
Day / Night work load
On Premise Resource level
On Premise Resource level
Time
[ 10 ]
Chapter 1
In the case of Windows Intune, this is the application that Microsoft manages and they start up and stop the servers as required to deliver the information to the Windows Intune client software on the PCs and the management interfaces.
Pricing based on utilization
There are two elements to the pricing of cloud solutions that need to be discussed. The first is that by virtue of the elastic number of servers used, the cost of the service is lower than purchasing for peak capacity. The second is that rather than paying for servers, power, cooling, storage, and people, we now pay for utility. This may be a fee per user, compute hour, storage, and so on, but it is nothing like the traditional buy or lease models for IT where we paid for the hardware and software rather than usage. The low fee we pay for Windows Intune relates to the fact that the service is delivered at Internet scale with elastic scalability that means that the actual computing required is right sized for all the users of the service at any moment. Our usage would be a fraction of the IT required to deliver ourselves because we do not actively interact with the management system 100% of the time. Beyond the scalability, Microsoft is also able to deliver greater efficiencies in managing the whole solution. This enables Microsoft to charge a flat rate per user for the services that is lower than the cost of acquiring the software, hardware, and people to manage by a significant amount.
Delivered using Internet protocols
Protocols describe the way machines talk to each other. Some of these are defined by standards bodies and others are known as de-facto standards as they have been popularized by the organization or organizations that use them. Either way, they need to be Internet friendly so that they can be routed, inspected and secured by firewalls and received by different client device types where appropriate. Windows Intune uses a combination of standards based and de-facto standards, but all the protocols are published and known, enabling routing and securing via the Internet. Windows Intune uses a standard web browser to deliver the management interfaces and then a well-known set of protocols to deliver the rest of the information to the client PCs. The term Cloud is often used when describing solutions that are often hosted and certainly connected to over the Internet. What used to be an Internet service is now often referred to as a Cloud service, but the terms are often interchangeable.
[ 11 ]
Overview of Cloud Computing
Secure and private
The final technical facet that all cloud services should have relates to security and privacy. The service needs to be as trustworthy as if we were running it ourselves. This means that our data is not shared or leaked, and that the communication protocols are secure. This is often not something we can test, but we should look for a privacy statement from the service provider. Windows Intune's privacy statement can be found by following the link: http://davidoverton.com/r.ashx?20.
Service Level Agreement
All quality cloud services should have a Service Level Agreement or SLA for short. This will need some careful analysis as this is one of the areas that differs the most from running the technology and delivering the service ourselves, and having it provided as a cloud service. Service Level Agreements consist of two elements repeated for each different feature or function of the service being offered. These two elements are Availability level and Service hours of a time period and, as a customer, we get some form of Recompense if the level of service is not delivered. As we are managing multiple users, the number of users impacted, or the proportion of them that were impacted is often also included in the calculation.
Availability
Availability is often described as a number of nines, such as "three nines" meaning 99.9% availability or uptime. Don't be fooled by the number of nines by themselves as a service interruption (known as downtime) as it could still have a major impact if it was in the middle of our busiest day. The following table shows us what the downtime implications are:
99% uptime
1% downtime
99.9% uptime
0.1% downtime
Day
23h 45m 36s
14m 24s
23h 58m
1m 26s
Week
6 days 22:19:12
1h 40m
6 days 23h 49m
10m 5s
Month
30 days 16h 33m
7h 26m
30 days 23h 15m
44m
Year
361 days 8h 24m
3 days 15h 36m
364 days 15h 14m
8h 45m
[ 12 ]
Chapter 1
The first consideration is the time period of which the measure is taken. Consider the preceding table which shows the time period of which certain availability levels are considered acceptable. It may all look relatively rosy, but if the availability is over a year, then there can be over a working day without the service at 99.9% availability (that of Windows Intune) and over 3 days if a service is provided at the "two nines" level of 99%, that of many services. Depending on the service, this will either be acceptable or unacceptable. Some cloud services do not have availability levels at all and these can be offline for months without recompense. Finally, some services do not count downtime as soon as things go wrong, meaning that a large number of short failures are not considered to be breaking the availability agreements.
Service hours
The other consideration is serviceable hours. In the preceding table we have assumed that the service has no "planned" downtime or maintenance windows and that it is available and measured for 24 hours every day. Some services have large maintenance windows, as much as 16 hours per day, and during this time if the service is available, that is great, but if not then there is again no recompense. If we were running the technology on-premise, we could discuss improving the service availability and how we could impact the quality of service. With a cloud service we may be able to pay more to get a higher availability level, utilize more servers, or have no choice but to accept what it given. Windows Intune, at the time of writing, stated that 10 hours scheduled downtime per year was acceptable and personally I would agree with this as it amounts to 10 hours out of 8,760 per year which is a very high level of availability. While this may sound a little scary, since Windows Intune only delivers management functionality, in the event of a failure it is only this management functionality that stops working. The users can continue to use their computers during this issue.
Recompense
The balance to the expected Service Level Statement is the Recompense, should the service not meet this level. Again, here we need to ensure that this matches our business needs. Some services will provide usage or service credits, while others will provide us with cold hard cash as compensation. Service credits can be nice, but sometimes they materialize as an extension to our existing contract period, which is not necessarily useful or desirable. The alternatives include actual refunds or a reduction in our next bill.
[ 13 ]
Overview of Cloud Computing
Windows Intune, at the time of writing, delivers service credits in the following month and it is quite generous.
Window Intune SLA
We have covered the Windows Intune SLA several times in the preceding text and there is a snippet of this document below. To get the latest version of this, please go to the following URL: http://davidoverton.com/r.ashx?21. In this snippet, we can see how Microsoft calculates uptime at the time of writing. We can see that Microsoft considers the number of users impacted as well as the number of minutes that they were disrupted to be key to calculating the Availability or "Monthly Uptime Percentage".
We can see that if the service impacts all users for more than 44 minutes a month, we are entitled to a 25% service credit. In my opinion, this is one of the best value service credits available in the marketplace today.
Multiple client device types
We are now moving on to requirements that are not always present in all cloud computing scenarios, but it is important to understand how they might be useful. Not that many years ago, the de facto desirable device for all computing needs was a Windows based PC. While the benefits of Windows have increased, as has the use of Windows 7, people want to be able to access information and applications from other devices. We have seen the rise of netbooks, tablets and phones as information access devices. [ 14 ]
Chapter 1
These devices all have relatively small storage and processing capacity, so the natural thing is to store information and provide the computing power on the Internet where it can be delivered on mass as needed. The services that provide all of this are often delivered using cloud computing solutions as they need the facets discussed in the preceding text. Once the key information, data, and processing are deployed in the cloud, all these devices can utilize it from a browser or a small application that calls upon these cloud services. This means that rather than having to write complex software for all these devices, which has always been a barrier to deploying on anything but Windows in the past, now it is developed once for the cloud environment and delivered as a simple piece of consumption software for each device type. As the consumption software is lower in complexity because the complex solution is now being delivered by the cloud service, it becomes cost effective to write it multiple times, once for each device. Now we have a model that allows access from multiple devices from any location provided they have a possible connection to the network with the cloud service on it, normally the Internet. iPhones, iPads, Android, Windows Phone 7, netbooks, notebooks, Windows XP, Vista, and Windows 7 PCs are now all excellent consumers of cloud services. Each device has its own interface quirks, tools, and other management issues, but for a cloud service provider, they can now address more devices and users than ever before. Today, Windows Intune is only used to manage Windows PC devices and the management interface is only available through a web browser with Silverlight installed, however, I expect more interfaces to become available over time.
Client Software
Cloud computing requires a way for us, the user, to interact with it. This may be via a web browser, but if that is not the case, then we need to ensure the device we are planning on using has the software available to download in a marketplace, or application store for the specific device. This could be an application on a phone or computer. Familiar examples would include an e-mail client or music playing software. In the case of Windows Intune, we need client software on each Windows device that will be managed. The client software communicates to the cloud service and we manage the service via a web browser.
[ 15 ]
Overview of Cloud Computing
Programmable interfaces
With a cloud computing solution we have much of the data and clever computer processing being done in a data center across a network, which means this now has to be controlled remotely. There are two choices here as to how this is done, either by building the whole service and infrastructure and solution as the vendor, or by enabling third parties to have access to the control interfaces. For some solutions, having third parties access these control interfaces makes perfect sense as it enables additional benefits to users without having to spend the time building it ourselves as the vendor. For some solutions however, the data is considered too complex to manage or too important to let third parties change, so the interfaces are not accessible. Windows Intune today does not have publicly accessible programmable interfaces, so no enhancement of the software is possible If these interfaces are available then the vendor will also have some form of additional shop front or application store to enable us as the user to choose to augment the cloud computing solution we have.
Different levels of cloud computing
Having discussed all the different facets that make up cloud computing, we now need to understand that there are various models for delivering cloud computing, each with benefits and challenges. The three different types of cloud computing solutions in common use today are: •
Infrastructure as a Service (IaaS)
•
Platform as a Service (PaaS)
•
Software as a Service (SaaS) Your responsibility
Applications
Operating System
Storage
Software as a Service
Applications
Applications
Operating System
Operating System
Virtualization
Servers
Storage
[ 16 ]
Service provider responsibility
Servers
Service provider responsibility
Virtualization
Platform as a Service
Virtualization
Servers
Storage
Service provider responsibility
Your responsibility
Infrastructure as a Service
Chapter 1
As we can see from the preceding diagram, each option for cloud computing delivers the same components of a solution which historically would have been delivered from our own premises. However, as we move from infrastructure as a service to software as a service, our cloud solution provider becomes responsible for more of the solution.
Infrastructure as a Service
Probably the best known Infrastructure as a Service (IaaS) solution available today is from Amazon with their EC2. Solutions exist from other providers, including Microsoft with the Azure VM role. Each of these services provides us with a virtual machine running an operating system, often Windows Server, hosted in their data center. This means that we do not need to purchase hardware or the operating system, and only pay for the computing that we use. It is likely that we will not physically have a server in their data center, but it is more likely we will have a virtual machine or a slice of a physical server that delivers the power promised in the agreement. We are responsible for managing that server in the form of security, patches, and software that is loaded onto it in the same way as if we had it physically installed on our premises.
Platform as a Service
The most complete Platform as a Service (PaaS) available in my opinion is Microsoft Azure which provides a development environment for organizations to create solutions that they can then use themselves or sell to customers. Microsoft has all the facets of cloud computing here and my day-to-day role involves helping Microsoft business partners adopt Azure. There are other vendors who offer PaaS solutions that offer similar functionality, although my own personal experience is with Microsoft Azure. Wikipedia maintains links to some of them at http://en.wikipedia.org/wiki/Platform_as_a_service. The key thing is that there is a platform for developers to build upon to deliver a solution. The only thing these vendors have to worry about is writing their software as all aspects of running the platform they build upon is delivered for them, including the operating system and any database maintenance, system scalability, and hardware and network management.
[ 17 ]
Overview of Cloud Computing
The benefits here are that almost all of the start-up costs for infrastructure that a traditional services or software organizations would have are eliminated, as well as the ability to expand as rapidly as the solution is successful. Previously, a business had to predict their IT requirements for development and delivery of a solution and buy in advance, but not with PaaS.
Software as a Service
The most complete cloud computing solution available today is called software as a service. These are finished goods that we can take advantage of in the same way as traditional software, except the whole service is managed by someone else. Examples that we are familiar with include Hotmail, Salesforce.com, Office 365, and of course, Windows Intune. All of these are highly functional application that are consumed and configured over the Internet. Some offer software that can be installed to further increase the application's functionality or enable offline access to the data when we are not connected to the Internet. As the consumer of the software, we do not need to worry about the scalability of the hardware, network, or application that is delivering the functionality as this is all managed for us, often as a service built on top of a PaaS solution which is often built on an IaaS platform, however this is not always the case.
Challenges of cloud computing
Having described the facets of cloud computing, it sounds like there are only benefits; however, with all new uses of technology, there are some challenges too. While these will continue to be worked on and removed or improved, we need to be aware of them to help decide if a cloud computing solution is right for you. Picking and deploying Windows Intune means we have to be comfortable with these areas, although clarity will be provided as to what this all means to us as a Windows Intune user at the end of the chapter.
[ 18 ]
Chapter 1
Network requirements
Any cloud service requires by its very nature a connection to the Internet via a network. While this might not sound like a challenge, many businesses can access and process their data today irrespective as to whether a connection to the Internet is present or not. This means that a well-managed Internet connection will become more important to all users of such a service, rather than just managing the corporate network. Mobile workers can be more commonly connected to the Internet rather than their corporate network, so delivering a cloud service can provider simpler access for these users without the hassle of VPN network settings or dedicated hardware.
Data accesses and synchronization
If today our is data stored on our computer's hard disk and tomorrow it is stored in a cloud service, we have just moved from a service which can work on an airplane or train without an Internet connection to one where we now require ubiquitous Internet access to work. Cloud service providers have realized this and offer many solutions to this failing. Many providers offer offline support where we can read and update our data when we are disconnected and then synchronize it to the service when we connect again. This functionality is normally delivered by client software that we have to load onto our devices and this software manages the offline data and synchronization. The only downside to this is that we may have to deal with synchronization errors should more than one person update the same information while we are offline.
Network bandwidth and latency
The second challenge with Internet based services relates to the amount of Internet network usage. For some services, functionality that would result in network usage within our corporate network gets moved to flowing over the Internet. This is likely to increase the bandwidth we require to enable this increased usage.
[ 19 ]
Overview of Cloud Computing
Added to this requirement is the speed at which we can get the data and services. When the data is local on a hard disk or on a network that we control, access to the data and service can be very quick. The further we move it away from our control and network, the slower access can be, decreasing a user's satisfaction with the service if they have to interact with it. Again, it is possible that the client software will change the way the service works to remove the issues or limit the bandwidth consumed, but large amounts of data being moved from a local connection to a remote one can still be problematic if ultimately a large amount of data needs to be moved in a small amount of time.
Security
If the cloud computing solution we are using or connecting to requires a connection over the Internet, then it is possible that some sensitive data will flow over the Internet. Most cloud solutions offer ways to secure this traffic. Some industries are governed by a number of legal regulations and this transport over the Internet may have to comply with these regulations, which is something to watch out for. The same goes for the storage of data, in terms of the physical protection it is given and the actual location. Some services are not based in the same country as us and this may give rise for concern. For this reason, military, financial, and some government situations are not easily compatible with a public, Internet hosted cloud solution. However, there is frequently a private cloud solution that can meet these requirements.
Customization
When using a cloud service, one of the reasons that it is possible for us to receive the service at scale and often with a beneficial price point is because it is a mass-production system. This means that the level of customization possible is frequently lower than a traditional on-premise application or service that we would otherwise use. When a solution is installed on premise, it can be customized heavily, however with a shared cloud solution, customization is often restricted to the configuration options provided in the solution.
[ 20 ]
Chapter 1
Bringing all this together for Windows Intune
Windows Intune is a SaaS solution, meaning that Microsoft is responsible for all layers shown in the diagram in the preceding Different levels of cloud computing section. This relieves us of the responsibility of installing, maintaining, and upgrading the server infrastructure required to deliver this solution, but it also removes a level of control. With Windows Intune, while the service is provided like electricity down the wire, we do need to configure and customize the service to make it deliver value as well as manage the installation on the client computers and respond to alerts and requests for assistance. This means that we get the benefits of being able to manage our Windows computers, by policy, but do not have to worry about how that management is implemented at all. To me, this is the beauty of Windows Intune. It is like the benefits of all the systems management capability of Microsoft Small Business Server 2011 and more, without the need to manage the server and software itself. Just like Small Business Server, we will still have to approve system updates, talk to people about alerts that are raised and sometimes visit their computers to diagnose problems, although the tools in Windows Intune with MDOP make this easier too. For all this to work, we as the administrators and the computers that we are managing must connect to a network that has access to the Internet with regularity. If this is unlikely then our ability to manage these computers and for them to get updates in policy, security settings, and system updates is significantly reduced, as is our ability to provide accurate reporting and timely assistance.
Summary
In this chapter, we have gone on a rapid tour of the world of cloud computing, but it is important to understand the concepts that we are signing up for with Windows Intune and the related services. The key item being that it is centrally provided by Microsoft, over the Internet on a massive shared service basis, removing a large set of infrastructure management headaches. While we can configure the options provided, we can't customize the service beyond those options. In this next chapter, we will explore what we should be looking at to manage our PC estate to make it more predictable and reliable. This will include defining polices and goals as well as reporting against these. We will also explore the activities we will need to carry out to hit our goals and have happy, more productive users. [ 21 ]
Introduction to PC Management Concepts Windows Intune is a cloud service, as discussed in the previous chapter, but it is not there to deliver e-mail or music, but to deliver the service to manage your PCs. Before we can embark on using Windows Intune, we need to explore the concepts of PC management that Windows Intune facilitates. PC management is not a "fire and forget", look at and configure once and then everything will be fine arrangement. It is like a house, when purchased everything is great, but both preventative and reactive maintenance is required to keep things optimal. There is a continuous cycle of evaluation for an IT administrator to understand what the business wants, what IT needs to do for the business and then trying to enable this while minimising the effort for the IT team and the user. We will briefly explore the continuous cycle and how it impacts us to enable us to gain an understanding of how policy management aligns to business requirements, such as "how secure does a PC need to be" and what software have we purchased and therefore can be installed. Once we understand these, defining the IT goals and policies, and reporting on them is the path to pro-active IT management. To explore the above process, we will cover the following topics in this chapter: •
Continuous cycle of PC management
•
Definition of IT management goals
•
Using policies for configuration and deployment
•
Reactive response to problems
•
Reporting on IT management
Introduction to PC Management Concepts
Continuous cycle of PC Management
PC management is a continuous cycle of evaluation, similar to 6-sigma or other management processes. It starts by evaluating the goals that the IT team have been given by the business. These may be vague or specific, but they have to be translated into policies and actions for us to manage against. It has five stages to it and it is a continuous process of evaluation to ensure that goals and deliverables are aligned. We can see the five stages below, starting with the definition of goals, then the implementation of those responding to problems that arise. By reporting on IT's performance and challenges, the business is able to reevaluate the goals and change the original goals if required. Defintion of IT management goals
Evaluation of goals versus changing business needs
Configuration and deployment
Reactive response to problems
Reporting on IT management
Windows Intune can help us with the implementation of your IT goals and reporting, however the setting and evaluation of goals is something we can explore in this book briefly, but it would be impossible for me to define here as every business's needs are different as are the goals they place on their IT team.
Definition of IT management goals
This is a broader discussion than implementing the features provided by Windows Intune. This is about setting the goals your organisation wants its IT to achieve. For the purposes of this book, this needs to be within the goals of managing PCs, but the broader aims still needs to be addressed. For most organisations, this will consist of having computers that are working to their maximum capability when a user wishes to use them. This will require planning to ensure the computers are ready, free of malware, with the right software loaded, kept up-to-date and correctly licensed. [ 24 ]
Chapter 2
To maintain this state of readiness, the computers will need to be secured and kept up-to-date with various tools from several manufacturers and even with this careful planning and maintenance, problems will still arise that require attention to fix. Finally, the computers will stop being able to deliver against the latest requirements as they grow over time or become too physically unreliable and they will need replacing, preserving as much of the goodness on that computer as is possible. These goals are different for each organisation. For some, the performance or availability requirements are low, while for others they are pushing the boundary of computing available today. We may decide that a computer out of action for 2 days is acceptable, while others will want someone to start working on a PC problem within minutes. However, once these goals are set, it is possible to define the policies that enable these to be realised. Do not think of this as a big long list of goals, but without them, we will struggle to know if the policies that we implement are delivering the business needs. It is possible to over-specify the policies such that we are exceeding the business requirements. While this will deliver against the business requirements, we may be spending more than we need to or wasting time that is not adding business value. It is also important when defining your goals to think not just about the business from the point of view of performing a task, but also what experience we want the user to have. If goals and policies do not allow a user to identify with their PC, their respect and interactions might not match those hoped for and they simply view the PC and IT or Management team as too restricting. This can generate a personnel issue, which I'm sure we have all experienced at some point, in the pull between freedom of control by an individual user and control by the business.
Using policies for configuration and deployment
IT Policies are a broad topic and there are several types of policy that will need to be defined. Some policies can be implemented using technology while others are better if they appear in a Human Resources handbook. For example, we may wish to state that work resources could not be used to create or access inappropriate materials. While we can implement some technical solutions to aim towards this, putting it in the conditions of work is very simple without having to technically define and implement what is a complex and ambiguous area.
[ 25 ]
Introduction to PC Management Concepts
The IT policies will ultimately define the configurations that are acceptable to IT and deploy technologies to assist with meeting the business requirements. The two types of policy that we will focus on here, especially since Windows Intune can help deliver on them are: •
Policies that deliver against the business goals
•
Policies that help the IT team do their job
My one word of warning is to keep the policies as light as possible as the more they impinge on users, making their use of the PC more stressful or complex, the more people will fight against it, ultimately undoing your attempts to manage their systems.
Policies that deliver against the business goals
Most organisations want to know that their information is safe and secure, the computer is legally licensed with the correct software and that their employees will remain productive while using their PCs. In the world of PC management, that normally comes down to the following areas: •
Ensuring the security settings on the PC provide an adequate level of protection
•
Tracking the hardware and software assets
•
Software distribution
With or without Windows Intune, we have the ability to do exactly this, however Windows Intune enables us to do this from one console that can be accessed anywhere with an Internet connection.
Ensuring the security settings on the PC provide an adequate level of protection Ensuring the right security settings on a PC is a basic requirement of PC management; many times this is ignored on the basis of cost, performance or ignorance. Anyone who believes that security slows things down just has to wait until information is stolen, lost, or a PC is put out of action to realise that this is a false economy. There are also various compliance and legal implications of not securing a computer that can also have serious ramifications for a business if not considered. The route to good security is through the following areas:
[ 26 ]
Chapter 2
•
Education
•
Stopping malicious theft of data
•
Blocking malware
Education
Education of the users is the key first step before we start on the right level of technical solutions. Users of a computer should understand that while most day-to-day actions will not damage their data or computer, it is possible if they ignore simple security measures. We need to educate a user not to install software without this being consented to do so, and to always read and question security warnings that the computer displays for them. Windows 7 and Windows Intune keep their on screen alerts to a minimum, so if it is asking us if we are sure, we need to be sure. If this is a key issue for the organisation then these requirements can be placed in a Human Resources handbook to enable the right level of weight behind them. Bear in mind that in doing so, you may overly restrict the users or everyone may simply ignore the policy if it is not necessary and enforced, making it a waste of everyone's time.
Stopping malicious theft of data
Stopping malicious theft of data often has many business ramifications. While we might not be subject to the scrutiny and threats of the corporate espionage, we still need to consider the business, legal, and regulatory requirements to keep the data on our computers secure. Protecting data on PC's can be simple and completely transparent and planning correctly may avoid our sensitive data from becoming public information. There are two aspects of security that we need to consider, in the form of hard disk encryption and enabling the firewall, to stop people browsing your computer without consent. Windows 7 Enterprise edition, which is available as part of your Windows Intune subscription, and Windows 7 Ultimate edition provides Bitlocker technology which can transparently encrypt the hard disk so only valid users can access data. Users can be required to enter a pin number on booting the computer, but this is the only visible sign that the disk is protected and everything else works as expected. Since a BitLocker secured hard disk is encrypted, from a support point of view, we can no longer take a disk and access it on another machine without the recovery key, but access without authority is the whole point here, so this requirement is expected.
[ 27 ]
Introduction to PC Management Concepts
The second area to be managed is the firewall which monitors and regulates the flow of data into and out of the PC over a network, and again, I have seen many organisations that run without this feature enabled as they consider it a burden to manage. Using Windows Intune, the management of the firewall can be controlled from the Windows Intune console by setting policy to enable this security feature without it interfering with the users' legitimate uses for the computer.
Blocking malware
Data can become corrupted or compromised by malware in the form of viruses or Trojan software being loaded onto a computer. Malware is often delivered via e-mail or through a web page, as well as via files downloaded from the Internet or programs that are installed by the user without IT's permission and support. When enabled, Windows Intune Endpoint Protect will detect any file that is malicious as it being written to the hard disk. It will intercept the file and provide a warning to the user. Windows Intune Endpoint Protection delivers this functionality as well as allowing it's configuration to be controlled by policy. We should always have anti-malware software installed and enabled to provide this level of protection at all times, but sometimes, people believe it is too much of an overhead for their computer and disable it. Windows Intune Endpoint Protection can inform us if it has been disabled and when any malware is detected on the computer.
Tracking the hardware and software assets
Tracking the organisation's hardware and software assets is vital to ensuring that we understand where our budget has been spent and ensuring that we are legally licensed for our software. I have seen situations where companies have had hardware go missing, such as memory removed from a PC, or where an install CD has been used repeatedly by different users without checking a license actually exists for the product being installed. The result is that the company loses assets, starts using pirated software, or is unaware of the software needs of their staff and fails to provide needed tools. Frequently, this is not a malicious act, but nevertheless, one that requires management. Defining the business policy is the first step to understanding what the business does or does not expect to be managed and monitored. At a high level, it could be as simple as to record the hardware and software in use and ensure that these lists match with those purchased on a regular basis. Once the business policy has been defined, we can use Windows Intune to automatically record the hardware and software configuration on each computer and monitor for changes.
[ 28 ]
Chapter 2
The user of a computer will need software. This needs to be licensed, installed, and configured as per the company's business requirements. Windows Intune provides an amazingly simply way to do this, ensuring the licenses are accounted for and that the right computers get the software installed without the computer having to come into contact with a corporate network. By distributing software this way, you can ensure the software cannot be inappropriately copied or installed without IT ensuring compliance to policy and purchased licenses.
Policies that help the IT team do their job
Policies are sometimes used to support the business goals, however they are there to make life easier for the IT team to deliver them. Clearly there is a fine line between those that help IT and those that help the business, but the items below are more about helping IT to help others. The areas we will examine are: •
Deploying Windows 7 for everyone
•
Keeping the PC up-to-date with updates
Deploying Windows 7 for everyone
Our Windows Intune subscription includes an upgrade to Windows 7 Enterprise edition if we do not already own it. Windows 7 is the most secure and manageable version of Windows from Microsoft, so deploying this for everyone makes sense for IT as it is often the easiest way to implement all the policy decisions and normally pleases users too. Windows Intune can be deployed on Windows XP and Windows Vista, but these operating systems are showing their age versus Windows 7. The Bitlocker feature discussed above can only be deployed on Windows 7 Enterprise and Ultimate editions. Windows 7 has many other features, but these are not relevant to the discussion at hand right now.
Keeping the PC up-to-date with updates
Even with all the protection enabled, there are still reliability and security related issues which can arise that will not be stopped with anti-malware software. The way to protect against these is with a combination of the firewall, as already discussed, and by managing the system updates from Microsoft that are deployed onto the PCs being managed.
[ 29 ]
Introduction to PC Management Concepts
Every second Tuesday of each month, Microsoft releases a range of updates for its products. We need to ensure that the required updates are deployed onto each PC and that we can tell when the user has rebooted, if required, so that they are in effect. Using Windows Intune, we are in control of this from the center. Occasionally Microsoft will not recommend an update in certain scenarios, or an update will interfere with another product, however as the administrator, it will become our role to manage this using Windows Intune. Windows Intune enables both the controlling of updates, and also reporting to see which computers are and are not compliant with the policies put in place.
Reactive response to problems
Reacting to problems is a key requirement of a good IT administrator. Good planning will minimise the situations in which these occur, but having in place both proactive and reactive support plans is the key to success. Going back to the house analogy I used earlier, starting the right way will make management easier, but incidents will occur and these will need to be dealt with. Some areas of maintenance in a house are carried out to avoid things breaking, such as painting the exterior or fixing roof tiles. Others are reactionary, such as dealing with a burst pipe or perhaps something minor, such as replacing a light bulb. Managing a PC has similar features with a continuous low level of maintenance, kept as short as possible with the use of Windows Intune. Windows Intune will also send alerts to you, giving us the opportunity to focus time on areas that are showing stress as well as dealing with situations that your users bring to your attention that may be either minor or major. Problem management falls into four categories: •
Ongoing maintenance tasks
•
Dealing with alerts
•
Working with users' support requests
•
Dealing with major problems
Ongoing maintenance tasks
The ongoing maintenance tasks have already been discussed, in terms of setting out the policies and ensuring that PCs are secure, protected, and have the required updates applied. While Windows Intune can look after the Microsoft side of this, we will need to carry this out for the non-Microsoft software installed on the computers. [ 30 ]
Chapter 2
If we use the Microsoft Desktop Optimisation Pack (MDOP) as part of Windows Intune then we can use the Microsoft Application Virtualisation (App-V) technology to enable centralised packaging and updating. Moving users to Windows 7 over time may also be a key ongoing management task.
Dealing with alerts
Before a computer or application fails, we are likely to see alerts through Windows Intune that inform us that something is not performing or behaving in an expected way. Our role as administrators is to evaluate these alerts and work on a plan of action. The first part of this process is to evaluate the critical nature of the alert. If a disk failure alert arrives, this probably means that the user data is either at risk, or will be very soon. The right course of action would be to ensure that all critical files are backed up and let the user know what is happening, and then planning on how to replace the disk with the least disruption. On the other hand, if a performance alert arrives, we know that this suggests the user's computer is under-powered for the task they are carrying out. If this is an occasional issue then it can perhaps be ignored, or if this is a key task then it is time to consider an upgrade. Other alerts will tell us things such as the fact that a user's computer has had a virus which has been successfully removed, but we need to consider whether you speak to the user to find out how it happened and perhaps change our policies, or educate them on how to avoid such situations again.
Working with users' support requests
Not all problems will be brought to your attention via alerts and reports in Windows Intune. The users will also be contacting you. Sometimes this will be via the phone or e-mail and sometimes they will use automated features, such as Remote Support requests that are provided as part of Windows Intune. Just like other alerts, we need to prioritise these, but more importantly, we need to have an ability to respond if the expectation has been set with the users that this will happen. This is another aspect of the education, setting the expectation for how long this will take.
[ 31 ]
Introduction to PC Management Concepts
If a user has requested remote support where we can both see their screen, then this typically needs to be a very quick response. The advantage of remote support is that we can be almost anywhere and see what they want us to see and plan how to respond, should it be advice or starting work on resolving a problem that they are seeing. One challenge of having remote support is that users may expect a response and resolution immediately. We have to ensure that one of the first things we do when communicating with the user is set an expectation as to what the support will involve. Informing them how quickly we will be able to respond fully to them, how long the support might take, and the impact on them, such as not being able to use their computer, is important so they can make plans while the issue is unresolved.
Dealing with major problems
Major problems will still arise with all the planning and care given so far as above. The two most critical requirements when dealing with these situations is to prioritise them as they might not be conveniently spaced out, and to set a level of expectation with the user as to how long they are likely to be impacted. In PC management, major problems are going to fall into two categories – hardware and software.
Hardware
Hardware issues will happen. Either in the form of a major component failing, requiring the replacement of the whole device, or the disk . To deal with these incidents adequately, support contracts should be in place to enable timely replacements. If the main device fails then there is a good chance that we can recover the users data from their hard disk, enabling the most up-to-date user data to be restored. In the event that the user's hard disk fails, then we will need an adequate backup strategy to be in place to stop useful company information from being lost. Information stored in the cloud or on other servers will still be preserved, such as e-mail and files on file shares, but the rest will need another solution. There are a number of backup options available, from automatically mirroring the user data to a server elsewhere, or implementing a user backup strategy and providing each user with this ability. Personally, I prefer a centralised backup or mirroring strategy, as anything that reduces the workload of non-IT users is normally a good thing and ensures it actually gets done. Forensic recovery of data can be done by a number of tools and thrid-party companies, but the time is lengthy and the chance of success is low. I have used various Microsoft solutions in the past to deliver this. [ 32 ]
Chapter 2
No matter what your strategy, it is vitally important to check regularly that we can recover data from it. Finding out in that critical moment that something important is not recoverable is not a comfortable place to find ourselves.
Software
Software issues are much easier to resolve if we enable the facilities such as System Restore that have been in Windows for many years now. This enables us to roll the system back through various changes. It is very unlikely that we will hit a major software problem that cannot be addressed in this way to get a user back up and running while we then do further diagnosis. If an update is delivered to a system that stops it booting, there are a number of tools provided by Microsoft to help with this, including Safe Mode Boot and WinRE. Booting Windows 7 into Safe Mode will try to start the computer with a minimum number of device drivers to enable basic administrative access. Once this is done, we can then start to diagnose and repair a major software issue. If Safe Mode does not work then we can boot the system from a Windows 7 DVD and enter the Windows Recover Environment, known as WinRE. Again, from here we can backup data and perform a system restore, as well as automatically fix a number of minor disk issues that would stop a system booting. Windows Intune adds to this when purchased with MDOP with the addition of the Diagnostic and Recovery Tools (DaRT). These tools provide a number of features; the key ones are as follows: •
Editing of the system registry
•
Reset of local user passwords
•
Basic disk repairs
•
Uninstalling of hotfixes
•
System Sweeper to check for malware and root kits.
Reporting on IT management
Reporting is a vital part of the IT management process. Without reporting to the business and IT management, the actions and effectiveness of the work carried out, value for money, and continued investment is very difficult to justify. It is a bit like the saying "if a tree falls in a wood and no one is there to hear it, does it make a sound." If we are managing the IT well, but no-one knows about it, do they believe we are making a difference? [ 33 ]
Introduction to PC Management Concepts
Good reporting will show the areas of success and challenge against our goals and enable us to ensure that our efforts are focused on the right areas as we continue to administer the PCs. Reporting should show both the proactive efforts and the expected results, for example, low incidents, and the reactive efforts to respond to alerts and support requests. This can become a serious strain on time if the information required is too difficult to access, so results are best recorded as the activity is carried out or even better be automatically generated. Windows Intune enables the exporting of a number of the alerts, malware information, user updates, and other information, as well as the production of a number of reports. Personally, I place all this data into a pre-populated spreadsheet that then uses this information to make the results accessible to the readers of the report. Simplicity and readability are the keys to an easy life when delivering reporting to those who need to know.
Summary
In this chapter, we have explored the process of delivering a well-managed PC solution to your business. There is no rocket science involved, but working out what we need to do, how we are going to do it, and then telling everyone who needs to know what we have done is important. Almost all of the tools to deliver this are provided by Windows Intune, with the rest being things like educating our users on the expectations and being prepared for the unexpected. Ensuring that the unexpected arises less frequently through the use of a good process is key to minimising the workload and this means using all that Windows Intune has to offer. In the next chapter, we will explore exactly what the features of Windows Intune are before we get down to the nitty gritty of installing and using Windows Intune.
[ 34 ]
Overview of Windows Intune Features Windows Intune, as we have already discussed, is a Software as a Service cloud solution that enables us to manage PCs within our business. We will start this chapter with an overview as to why businesses should use Windows Intune to ensure that we are all expecting the same results from Windows Intune. We will investigate the architecture that it requires to enable Windows Intune's features and then finally we will define exactly what the features of Windows Intune are. Therefore, in this chapter, we will cover the following topics: •
Why use Windows Intune
•
Windows Intune solution architecture
•
Windows Intune feature set
Why use Windows Intune
Computer management today means dealing with an increasingly complex list of operating systems, software and licenses, locations and infrastructure. Keeping track of all of these, and in a way that delivers value to the business, requires investment in a number of technologies including Windows 7, systems management software, anti-malware software; as well as the server and network infrastructure to run and deploy all of this. Add to this the fact that users are becoming more mobile which makes traditional management techniques more complex as they require users to be connected to the private network.
Overview of Windows Intune Features
Windows Intune solves the network connectivity problem by delivering a reliable and secure service from the Internet, meaning that every user can access it no matter where they are physically located. This means that the ability to set policy, control the computers, and offer support is all possible no matter where the users are working providing they have Internet access. Providing support is also simpler as we can also do this from any location with an Internet connection enabling both users and administrators to be fully mobile. Windows Intune also provides all the software required to deliver this service. This is similar to functionality provided by Microsoft Forefront Protection Suite, Microsoft System Center Configuration Manager, and Microsoft System Center Essentials. Of course, Windows Intune provides us with access to Windows 7 Enterprise edition which includes many great features, especially if our existing computers are running Windows XP today. For most businesses, the key features of the Enterprise edition of Windows 7 include Bitlocker and BranchCache. Also, while we are a Windows Intune subscriber, we are able to get access to the latest version of Windows, so when the next version ships, we will be able to use that too. The final reason that Windows Intune makes sense is the fact that it is a subscription service with a low cost per user per month. We can start with a single user, then add and remove users as required by our business needs. We can also add MDOP to the subscription to provide additional support options.
Situations when Intune makes sense
There are three situations when installing Windows Intune makes sense: •
First management solution for small and medium enterprises
•
Moving to a subscription management solution
•
Managing part of an estate, such as computers that users bring in from home
First management solution for small and medium enterprises
If you do not have any systems management, then Windows Intune provides a fantastic first step towards a well-managed computer estate. It will make life more predictable to ensure secure, productive workers with software managed and deployed via Windows Intune.
[ 36 ]
Chapter 3
Moving to a subscription management solution
If you wish to move from an older solution to a subscription solution, then Windows Intune will enable you to scale your management solution without having to manage on-premise hardware and software to deliver the solution. This can make management easier and reduce the cost of the infrastructure required to deliver computer management.
Managing part of an estate, such as computers that users bring in from home
If there is already a management strategy in place and you wish to extend this to a group of machines that need to be managed in a different way, then Windows Intune can help solve this problem. Once the agent is installed, provided the computer connects to the Internet, you can deliver management capabilities, including software distribution, without the computers having to be part of the current office managed domain.
Windows Intune solution architecture
The architecture information closes off the introduction to cloud services and PC management that we have been discussing in the previous two chapters as we move away from how Windows Intune is delivered as a service towards how we use it without worrying about this information. As Windows Intune is a service, like the electricity and water that we use at home, it is good to know how it gets to us. The following diagram shows which pieces of the Windows Intune solution are hosted by Microsoft and those which are deployed and hosted by us as the PC administrator: Management Windows 7
Report generation
Intune Installation
Support
Windows Intune Cloud Service Reports engine 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890
Alerts repository
Users in the office
Policy Settings Internet
Sofware & Updates Mobile Users Malware Updates
[ 37 ]
Overview of Windows Intune Features
It can be seen that all the services are hosted by Microsoft, but the installation software, Windows 7, and support tools are more likely to be managed and deployed by us as the administrators, even if they are initially downloaded from the Windows Intune or other Microsoft website. Because of this split, once a user is set up they can work from the office or while out and about and can continue to access and be managed by the service, even if we do not have direct access to their computer. As the administrator, we connect to the Windows Intune service to configure the policies, manage the alerts and reporting, but not directly to the user's computers. Windows Intune, once installed on the users' computer, connects to the same Windows Intune service to receive and enforce the policies, apply updates, and report back any issues or alerts. There are several notable mentions required for this architecture. First, we have Windows 7 which we are entitled to once we have subscribed to Windows Intune. We download this via the Windows Intune site and then deploy it to the client PCs on an individual basis. There are several steps to this process and they will be covered in detail in Chapter 8, Tracking and reporting. Then we have the support tools, some of which are supplied within the standard subscription and others that are optional additions. These are again downloaded and then used or managed by us with the PC directly. Finally, we need to look at reporting. The reports that Windows Intune produces are unlikely to present the information we will want to present in an easily consumable form. This means that we will need to carry out the additional tasks of exporting the data and then presenting it in a relevant form back to the business.
Windows Intune feature set
There are two viewpoints that can be used to group the Windows Intune functionality. The first is by individual technical feature to ensure that all usable elements of Windows Intune are known. Later we will examine the administration tasks that we need to carry out in order to manage our PC deployments. We are exploring both viewpoints as my experience tells me that useful features can be missed if examined from only one perspective. I have seen a number of customers and partners waste money, time and effort by purchasing and implementing additional technologies when they are already provided with a product like Windows Intune.
[ 38 ]
Chapter 3
The Windows Intune technical feature set can be broken down into the following areas: •
Windows 7
•
Installation
•
Management console
•
Security management
•
Auditing
•
Reporting
•
Alerts and Support
•
Software distribution
•
Managing multiple organizations
Windows 7
As mentioned, many organizations are not running Windows 7, or do not have the Enterprise Edition, with the functionality that is provided by your Windows Intune subscription. One challenge most businesses have is computers across their PC estate running a number of different versions of Windows. Using Windows Intune, we can move all subscribed computers to a common version of Windows providing we are running a business targeted version of Windows already. This means Windows XP Professional, Windows Vista Business or Ultimate, or Windows 7 Professional or Ultimate edition. While we can standardize on a previous version of Windows, standardizing on Windows 7 makes sense to deliver the best Total Cost of Ownership (TCO). We are not going to turn this into an advert for Windows 7; however, the key differences are as follows: •
Bitlocker for hard disk encryption
•
AppLocker for application security
•
Faster start up and resuming
•
BranchCache
•
Direct Access
•
New user interface
[ 39 ]
Overview of Windows Intune Features
Obviously having hardware that meets Windows 7 requirements is vital, so we will need to check the specification of our PCs, but if we have Windows XP machines, it is advised that we have a plan to upgrade the operating system and possibly the hardware too. We will discuss how to move to Windows 7 later in this book. This can be achieved by either performing a clean install or upgrading from Windows Vista. Each option has both positive and negative impacts on us and the user. Microsoft provides a number of tools to assist in the process of getting to Windows 7 that we will explore later too.
Existing Windows 7 Software Assurance customers Some organizations will already have the rights to Windows 7 via Software Assurance (SA). If this is the case then we can request a discount on the Windows Intune account subscription in light of this.
Microsoft Desktop Optimization Pack
The Microsoft Desktop Optimization Pack (MDOP) is a Windows SA benefit that is available to Windows Intune customers for a small additional fee per month. One of the MDOP benefits is covered by Windows Intune already, the Asset Inventory Service. Of the six others, listed below, the Diagnostic and Recovery Toolset, and Enterprise Desktop Virtualization have easy-to-utilize benefits for an organisation with distributed employees using Windows Intune as the main management tool. The seven items in the pack are as follows: •
Diagnostic and Recovery Toolset
•
Advanced Group Policy Management
•
Asset Inventory Service
•
Enterprise Desktop Virtualization
•
Application Virtualization
•
System Center Desktop Error Monitoring
•
Bitlocker Administration and Management
Diagnostic and Recovery Toolset
The Diagnostic and Recovery Toolset (DaRT) provides 14 tools that are truly useful to a system administrator. These can be installed with a Windows 7 build or provided on a CD and will require a user to boot to the DaRT environment. The following tools are available when the DaRT tools are loaded: [ 40 ]
Chapter 3
The options we can see on this screen are as follows: ERD Registry Editor which allows us to edit the registry of the operating system being repaired
Explorer to view and modify the files on the computer
Locksmith to change the passwords for accounts local to the machine, including the Administrators password, without knowing what it is currently set to
Solution Wizard which will take the user through a series of questions and then attempt to diagnose the reason why a system is failing
Crash Analyzer will examine a system memory dump after a crash and highlight what it believes is the cause of a crash. The item causing problems can then be disabled or removed with the other tools
TCP/IP Config to configure the network of the DaRT booted environment so that further remote access can be delivered
File Restore to recover files that have been deleted on the disk
Hotfix Uninstall tools to remove a hotfix or other system update that might be preventing the booting of the computer
Disk commander to repair the master boot record, disk volumes, and partition tables as well as back up and restore the partition information
SFC Scan which performs a scan of key system files and enables the replacement of these files with good copies
Disk Wipe will cleanse a disk, making all data unrecoverable for security purposes, if necessary to levels acceptable to the U.S. Department of Defence
Search allows us to find files by name, date modified, or size to then copy them from the computer
Computer Management tools to access the core system information such as the event logs, drivers installed, and the programs set to automatically run when the computer starts
Standalone System Sweeper to identify malware and root kits that have otherwise not been detected and remove them
[ 41 ]
Overview of Windows Intune Features
We will explore some of these later in the book when discussing Windows 7, although these tools can be used on earlier versions of Windows too.
Microsoft Enterprise Desktop Virtualization
Microsoft Enterprise Desktop Virtualization (MED-V) enables a virtualized copy of Windows, such as Windows XP to run alongside the installed copy of Windows 7 for certain applications that will not run on Windows 7. These applications are installed into the MED-V environment and run on the virtualized copy of Windows XP, but are presented on the Windows 7 Start Menu and appear to the user as if they are running on Windows 7. Most applications today support Windows 7, so the requirement for this is reducing, but one key application that can still be a problem, is the requirement for Internet Explorer 6 (IE6). MED-V enables us to redirect URLs for applications that require IE6 to the MED-V IE6 install, while the rest are natively displayed by Internet Explorer in Windows 7.
Installation
We will run through the details of the installation process in the next chapter, but this is still a key requirement for Windows Intune. Each organisation will have a unique installation component that needs to be loaded onto each computer to be managed. This component contains a certificate that enables the linkage between the computer being managed and the subscription, so download and deploy carefully. To download the installation component, select the Client Software Download option in the Administration workspace:
[ 42 ]
Chapter 3
Under the download string, there are details on how to deploy this download. Once the Windows Intune client software is installed, the computer will take up to 30 minutes to register itself with Windows Intune.
Management console
The management console for Windows Intune is a Silverlight console accessed over the Internet. From here, we can control all aspects of the Windows Intune service with the exception of a Windows 7 installation and MDOP tools. The following console, with the three panels, is used to manage everything:
The left most panel provides access to the different workspaces relating to the Windows Intune features. By default we see the System Overview workspace is displayed, which highlights any areas that we may need to focus on. On the right is a context sensitive task panel.
[ 43 ]
Overview of Windows Intune Features
Looking in more detail at the System Overview workspace, we can see any notices that we need to take note of, such as creating rules or installing the client software. Below this, we can see the System Status section telling us if we need to examine Endpoint Protection (anti-malware), Windows updates, or Windows Intune Agent Health issues. Finally, below this we can also see a prioritized list of alerts that will require action by the administrator. The components that are installed through the installation process all have interfaces on the user's computer which can be examined when delivering remote assistance or physically sitting at the computer, but they are all configured from here. If a user changes the configuration, it will be overridden by the policies and settings in this console.
Security management
Security management is delivered by three mechanisms with Windows Intune that cover the requirements as defined by Microsoft and are all implemented by policies that are defined in the management console: •
Windows system updates
•
Anti-malware
•
Firewall control
Windows system updates
By default, a Windows computer can search for system updates on the Microsoft Windows Updates site and the end user can decide which updates are loaded or not. With Windows Intune, as the person who sets the policy for the computers we are managing, we have the ability to choose which Microsoft system updates are applied and which are not. While it happens very rarely, if an application has an incompatibility with an update we can disable the update, although I would always recommend this as a temporary fix rather than a permanent one. We can define policies that automatically approve certain types of updates, such as security updates, that are applied to some or all of the computers that we are managing. We can also approve individual updates for a group of computers that it may be required for, as shown in the following screenshot:
[ 44 ]
Chapter 3
As the organisation grows in complexity the more we need to consider implementing a full patch management lifecycle that includes evaluation, testing, deployment, and reporting to ensure this does not become a business inhibitor.
Anti-malware
Anti-malware protection provided by Windows Intune is an effective way to block both viruses and Trojan applications on a computer. Windows Intune enables us to set policies relating to malware management and give us alerts relating to this, either when the software is disabled, or any malware issues are stopped on the user's computer. Unlike some products on the market, it does not offer e-mail checking. However, as soon as a malware delivered via e-mail is executed, it will still protect the computer. Many e-mail services, such as those provided by Small Business Server or Microsoft Office 365, also have the ability to scan e-mail and clean it before it reaches your inbox. We can see an example of the malware protection status on the following console, showing all anti-malware issues closed and the computers in a healthy state:
[ 45 ]
Overview of Windows Intune Features
As many of us have experienced, some anti-malware products are constantly prompting a user about many trivialities that cause user frustration. The Windows Intune software does not do this, which means that most users do stop and react when it does alert them. It also has a low impact on the machine that it is running on, so the system performance is also not degraded, unlike some other products.
Firewall control
The final part of securing a system from malware is to use a firewall. From Windows XP SP2, Microsoft has shipped a very capable firewall service as part of Windows. Windows Intune enables us as the administrator to set the firewall policy; allowing if necessary different settings if the user is connected to the main organization's network, a known home network, or roaming on a guest network. In the following example, we can see that informing the user when the firewall blocks a program is turned off when connected to a public network. Underneath this, we can see the start of the pre-defined exceptions:
As an administrator, we will be alerted if the firewall is turned off and can investigate if there is a need for a further change in management policy, a personal exception, or a need to discuss the importance of the firewall with the user. [ 46 ]
Chapter 3
Auditing
Windows Intune collects information about each computer that is connected to the Windows Intune system and stores this information for reporting. This information includes the updates installed, software installed, and hardware inventory of each computer. Microsoft also states that it will not probe this information in any way other than to provide Windows Intune reporting and alerts only and will not be shared within Microsoft itself. The following example shows the computer hardware information that Windows Intune's audit functionality has gathered from one of the computers being managed:
Reporting
Windows Intune provides two types of reporting. Windows Intune provides four standardised reports that you can use, and the ability to create your own reports by exporting information from most workspaces into your own custom reporting spreadsheet. The four standard reports cover the following areas: •
Update Reports to enable quick identification of failed updates or updates requiring approval. This can also be used to demonstrate the successful deployment of a number of Windows Updates.
•
Detected Software Reports to show the applications that are installed across the organisation as discovered by the audit technology. [ 47 ]
Overview of Windows Intune Features
•
Hardware Inventory Reports enable us report on the hardware deployed. One very nice feature is the ability to report on hardware that is running an old operating system or with hardware that would not support an upgrade.
•
License Purchase and License Installation Reports that highlight the Microsoft licenses that are purchased through a volume license agreement and installed on client computers.
We can see an example of the software report produced by Windows Intune:
To enable the reports to be more useful to the business, building a spreadsheet that processes a number of exports can make it easier for to deliver a standardized report with less work. The following example shows data in such a report:
[ 48 ]
Chapter 3
Alerts and Support
The main stay of PC administration is dealing with the alerts that are raised, and supporting the users through their problems. Windows Intune has three mechanisms that deal with this if we sign up for MDOP, or two without. These are: •
Alerts
•
Remote Assistance
•
Diagnostic and Repair Toolset
Given that we have already discussed DaRT, let us look in a bit more detail at the Alerts and Remote Assistance features.
[ 49 ]
Overview of Windows Intune Features
Alerts
Alerts are used to bring something to your attention by Windows Intune. These range from notice and informational alerts through to Warnings and Critical alerts. These are delivered via e-mail to a select group of recipients as well as displayed on the Console. In the following screenshot, we can see the range of alerts in the Alerts workspace:
For each of the alert types we can configure who is notified via e-mail of the alert with a minimum set of details. The alerts fall into many categories that relate to policy settings or specific areas of monitoring: •
Endpoint Protection (malware protection)
•
Monitoring
•
Microsoft Desktop Applications
•
Microsoft Office XP / 2003 / 2007 / 2010
•
Microsoft Windows XP / Vista / Server 2003 / Server 2008 / 7
•
Notices
•
Policy
•
Remote Assistance
•
System
•
Updates
[ 50 ]
Chapter 3
The three alerts that require the fastest evaluation will normally fall into malware protection, Remote Assistance, and System as these always highlight areas where immediate support is required. We can configure what we do and don't get alerted for as there is a very long list of alerts. To enable or disable an alert, simply select the button along the workspace as shown:
[ 51 ]
Overview of Windows Intune Features
Remote Assistance
Remote Assistance is the final part of the support tools provided by Windows Intune. This is where a user requests direct assistance with a particular issue. While this is surfaced as an alert in Windows Intune, it is the only user generated one, and thus requires immediate action as we can't expect them to hang around for hours before we get back to them. The user initiates the request from the Windows Intune center from the Start Menu and then selects Microsoft Easy Assist which is the lowermost option as seen in the following screenshot:
We will then receive an e-mail that will invite us to connect to the user. Once we connect to the computer we have the ability to share the screen and even control the remote user's computer, chat or display the connection information, or bring other administrators into the support session to also view and participate. The last option is very strong as it allows a team to support a single user with the most appropriate person carrying out specific tasks. The administration application is shown as follows:
[ 52 ]
Chapter 3
The key benefit of the Microsoft solution is that it works not just on LANs as many solutions do, but across the Internet with both the user and administrator being in remote locations.
Software distribution
Windows Intune enables us to have a single repository of software that can be installed on the computers that we manage by changing the settings in the console.
In the preceding example, we can see a package ready to be deployed if desired by the administrator. This means that as we purchase software, it can be installed once to the cloud and distributed as required to client PCs without the administrator having to become involved in the actual process at the client computer. [ 53 ]
Overview of Windows Intune Features
There are limitations, such as the need to enable a silent, or non-interactive, installation, but this is incredibly useful. We can also use the App-V capabilities supplied with MDOP to create an application bubble and distribute it via Windows Intune.
Managing multiple organizations
Windows Intune can be used by either internal IT administrators or Microsoft partners who are managing a number of organizations' PCs. Windows Intune allows for this by allowing partners to be associated with a Windows Intune subscription by the customer. Once a partner is associated, the partner will then be presented with the following screen to enable them to see which customers have the most alerts and then select the organisation to manage.
When a partner is managing multiple customers, no data is shared between customers, however it is vital that the correct customer is chosen before downloading the client installation software as this is what links a customer to a subscription.
[ 54 ]
Chapter 3
Summary
In this chapter, we have examined the many features of Windows Intune that facilitate good PC management. The Windows Intune architecture enables management from any location with the computers being managed located anywhere providing they have access to the Internet. The Windows Intune subscription includes Windows 7 Enterprise edition, anti-malware software, management of Windows Updates, and a suite of audit and alerting technology to enable us to keep informed of the status of the environment. To assist with PC management, Remote Assistance is also provided to ensure that we can deliver an excellent quality of service. Reporting and the ability to export data for our own reports enables us to provide evidence that the excellent service is being delivered. Finally, Windows Intune enables us to have this support provided by a Microsoft partner so not only can the infrastructure costs be managed, but so can the actual administration. These features enable us to deliver the tasks that we will need to understand to make the deployment of Windows Intune successful. The tasks and implementation methods are examined in the chapters after this. In the next chapter, we will purchase our Windows Intune subscription and install the client software onto PCs so we can start delivering the PC management service we have been discussing with Windows Intune.
[ 55 ]
Signing Up for Windows Intune and Installing the Client Software As a subscription based product, you need to sign up for Windows Intune and deploy the software. In this chapter, we will ensure that we have the skills and technology required to deliver Windows Intune based management, and then go through the process to sign up for an account and purchase a subscription. Once this is completed, we will be able to add additional administrators and then download the software that needs to be deployed to the computers which we will be managing. Finally, we will add a Microsoft partner to the account to enable them to also manage your PCs if desired. For many businesses, having a partner assist in this way is both a useful and desired option. Therefore, in this chapter, we will cover the following topics: •
Preparing for Windows Intune
•
Signing up to Windows Intune
•
Installing Windows Intune onto a client PC
•
Enabling others to manage your PC estate with Windows Intune
Preparing for Windows Intune
Once you sign the Windows Intune subscription agreement you are committed to a minimum of one year's payment, so it is vital that we make sure all is well before you sign up. One way to do this is to sign up for a trial period of 30 days and see what works, but a better way is to ensure you meet and understand the licensing, hardware, software, and people requirements.
Signing Up for Windows Intune and Installing the Client Software
Licensing of Windows Intune
In some ways, the licensing of Windows Intune is very simple. You count the number of PCs (known as devices in the Windows Intune world) that you wish to manage with Windows Intune and then purchase the Window Intune subscription for that number of PCs. Windows Intune can be purchased via an Enterprise Agreement or via the online portal. Since many organizations purchasing Windows Intune will have less than 250 desktops in the service, the online portal is the best solution for these organizations and we will discuss how to do this here. Just to reiterate, our minimum subscription is for a twelve months period. While it is that simple, there are some things you need to be aware of. Firstly, your computers must be running a version of Windows that is a business version. This means the following versions: •
Windows XP Professional
•
Windows Vista Business, Enterprise or Ultimate
•
Windows 7 Professional, Enterprise or Ultimate
If the monthly bill is going to be less than $500 US dollars in the United States or $250 dollars elsewhere, then we have to purchase with a credit card and the payments will be taken monthly. Finally, the price we see will be discounted if you choose to manage 250 or more computers or if you already have Software Assurance on your Windows desktop computers. Therefore, knowing how many PCs we can manage as they fit the software and hardware requirements and what other agreements you have with Microsoft is the key to understanding the licensing as everything else falls out of this.
Software and hardware requirements for Windows Intune
Windows Intune's software and hardware requirements should cover most computers that are used in business today, and if the computers are of a lower specification, we should be thinking of replacing anyway. Since Windows Intune offers an upgrade to Windows 7 Enterprise Edition, aiming to use this should be something we are all aiming to do.
[ 58 ]
Chapter 4
The next version of Windows, codenamed "Windows 8", will be available to Windows Intune customers as part of the subscription and Microsoft has stated that computers capable of running Windows 7 will run this version. This means that we do not have to worry that an upgrade now will be short-lived for continuing our use of Windows in the future.
Hardware requirements
The hardware requirements are as follows: •
•
Windows Vista and Windows 7: °° 32-bit or 64-bit hardware °° Meets the minimum hardware specifications for the operating system currently installed if that operating system is Windows Vista or Windows 7 Windows XP: °° For Windows XP, the hardware requirements are higher than the requirements for the operating system. They are CPU of 500 MHz or higher and at least 256MB of RAM. °° If you plan to upgrade from Windows XP to Windows 7, then the Windows 7 hardware requirements will need to be met: i. 1GHz CPU ii. 1GB or RAM for 32-bit or 2GB for 64-bit systems iii. 16 GB hard disk space available for 32-bit or 20GB for 64-bit systems iv. DirectX 9 graphics device with at least a WDDM 1.0
If the Windows 7 requirements all sound a little difficult to comprehend, then go to http://davidoverton.com/r.ashx?22 to download the free upgrade advisor to get a more detailed assessment of the hardware and software. The preceding requirements are the minimum and we all know that a Windows system with a more current CPU, greater than 1GB RAM, and plenty of hard disk space will perform better.
[ 59 ]
Signing Up for Windows Intune and Installing the Client Software
Software requirements
The software requirements for Windows Intune have been summarized in the preceding text. However, for completeness they are as follows: •
•
Windows Operating system running on hardware that meets the listed requirements. One of the following: °°
Windows 7 Enterprise, Ultimate, and Professional
°°
Windows Vista Enterprise, Ultimate, and Business
°°
Windows XP Professional with Service Pack (SP) 2 or later (SP3 is strongly recommended and SP2 is no longer supported by Microsoft)
If you are running Windows XP SP2 then you will need to load the following updates: °°
Forefront Client Security Filter Manager QFE for Windows XP/SP2 (http://davidoverton.com/r.ashx?23)
°°
Microsoft Core XML Services (MSXML) 6.0 (http://davidoverton. com/r.ashx?24)
°°
Security update, MSXML 6.0 SP2 (http://davidoverton.com/r. ashx?25)
•
Administrator access, each computer
•
For the web based administrators console, you must have the following available: Web browser that supports Silverlight 3.0, such as Windows Internet Explorer 7.0 or higher.
You may notice that there is nothing here about the computers being a member of a Windows Active Directory domain, such as that provided by Windows Small Business Server or Windows Server. This is because it is not required. If the computer is, however, part of a domain, this is not a problem although some Windows Intune policy features do overlap with Active Directory Group Policy, the domain policy overrides the Windows Intune policy.
Skills required to manage with Windows Intune
The skills required to manage PCs using Windows Intune are slightly more complex to describe. There are two levels required here. The first skill level is the minimum required to enable sensible decisions about policy settings and reporting, which is hard to articulate via an exam or other credential. The second skill level describes those skills required to diagnose and resolve more complex issues directly on a computer. [ 60 ]
Chapter 4
Rather than offering a number of Microsoft exam numbers it might be useful to describe what you might look for on a CV for an individual or partner. the following list is what I would look for someone to have experience in. We will cover all of the simple management skills in this book and some of the complex diagnostic skills too, but there is only so much that can be passed on via a book for such a broad subject that is parallel, but not the purpose of this book.
Simple management skills •
Good communication skills with an ability to explain IT issues to non-IT users
•
Understanding of installing and configuring Windows XP, Windows Vista, and Windows 7
•
Ability to migrate Windows XP and Windows Vista users to Windows 7
•
Ability to understand when to apply or disable Microsoft updates
•
Ability to configure and use anti-malware software.
•
Ability to understand and manage simple firewall configuration
•
Basics of license management to ensure compliance
Desired complex management and diagnostic skills •
Ability to resolve complex application and security issues that arise on a user's computer
•
Ability to resolve issues that stop a computer booting, using tools such as DaRT
•
Application packaging and deployment
•
Deploying Windows 7 using automated tools
•
Group Policy for Windows
The good news is that most issues are confined to the simple management skills section and the complex diagnostic skills can be obtained by a Microsoft Partner if they are not readily available. As has been stated before, it may make sense to also seek a Microsoft Partner if you do not have the ability to deliver the listed skills.
[ 61 ]
Signing Up for Windows Intune and Installing the Client Software
Signing up to Windows Intune
Signing up to Windows Intune requires you to create a Windows Live ID and complete a purchase through the Microsoft Online Customer Portal (MOCP). Even if you already have a Windows Live ID, it is recommended that we create a new one as this will be the primary, or Tenant Administrator, for Windows Intune by default and this Windows Live ID cannot be removed as an administrator of the service. The process to get signed up for Windows Intune is as follows: •
Create a Windows Live ID
•
Sign into MOCP and configure contacts
•
Add Windows Intune to your basket and confirm the purchase
•
Activate your purchase
•
Adding Microsoft Desktop Optimization Pack (MDOP) to your purchase
Create a Windows Live ID
If you have already subscribed to another service from Microsoft, then you can use the same ID and skip this section, providing you are happy that the person who administers your other subscription accounts will have administrative capability over this subscription and if you choose administrative rights for your computer management. In many cases this may not be desired, so I suggest creating a new account: 1. To start the purchase process, go to: https://mocp.microsoftonline.com. You should be presented with the default portal as below. If you are already signed in, it will say so in the top right of the screen and you will need to sign-out using the Sign Out link in the top right of the portal. To ensure the process takes place for the right location, click the Change my location link in the top right of the screen and confirm this is set to the right country, United Kingdom, for example:
[ 62 ]
Chapter 4
2. Select the link Sign in now under the Things I Need To Do section to create a new Live ID. Note that this is referred to in the ID creation process as both an MSN sign-in address and a Windows Live ID by the sites used in this process. 3. The first question asks us if we wish to use an existing e-mail address or create a new one. This is the e-mail address of the person who will administrate the Windows Intune subscription and the PCs. Select Yes to use an existing e-mail address and ensure that this address does exist and has not been used for other MOCP sign-ins. Then press Continue:
[ 63 ]
Signing Up for Windows Intune and Installing the Client Software
4. Now enter the e-mail address to use, along with a password that shows as green on the screen and has a Password strength of Strong. Fill in the additional credentials screen, remembering that this may need to be changed via MOCP should the current administrator leave the organization:
5. Press Continue to access the next page in the form and enter the Personal Information, Home Location and then press Continue again. We now need to review and sign the agreements. Once you are happy with the agreements, type the e-mail address that you used and press I Accept:
[ 64 ]
Chapter 4
6. You will get a confirmation screen stating that the account has been created. Now press Continue to move to the Verify your email address screen. You should have received an e-mail, such as the one in the following screenshot. If this is not in your inbox or junk-mail, press the Send email button to resend the e-mail:
7. Click the link in the e-mail and you should see the confirmation. Press Finish to complete the process. I've discovered that before you can continue, you need to give the Windows Live ID system a minute or two to complete the process:
[ 65 ]
Signing Up for Windows Intune and Installing the Client Software
Sign into MOCP and configure contacts
You should now be back at the MOCP portal; if not, use the link https://mocp. microsoftonline.com to get back there. Once there, follow the ensuing steps: 1. Press the Sign in link in the top right corner where you will be prompted to enter the Windows Live ID and password you have just created. You now have to enter contact, profile, and company information, which is all very standard information. 2. You are then required to enter the Service Usage Address. This is the person who is set up as the Tenant Administrator. While this user can be changed later, there is an option to copy the contact information used to manage the subscription. For smaller organizations where this will sit purely within an IT function, I would select Copy my contact information. For larger organizations, enter the appropriate person. The contact you enter here will also require a Windows Live ID. Press the Finish Button to complete the profile.
[ 66 ]
Chapter 4
3. We should now see confirmation that the profile has been completed with the Confirmation message as shown in the following screenshot. Press Close to close the profile screen:
Add Windows Intune to your basket and confirm the purchase
Now our profile is complete; we can purchase the Windows Intune item from the MOCP: 1. From the Services tab, select Buy Now under the Available Services. If you want to use the trial which does not provide a download of Windows 7 Enterprise Edition or MDOP, you can choose the trial.
[ 67 ]
Signing Up for Windows Intune and Installing the Client Software
2. In the Shopping Cart, you can see that the Qty is 1 for just one device. Change this to the number of devices you wish to manage within your organization and press the Update Total button. If you know that a partner will be managing your PCs then you can search for their information now by pressing the Find a Partner link or you can enter it later. We will learn how to add a partner later in this chapter:
3. Press Checkout. You will be asked to add a New credit card to MOCP and enter a purchase order number. Press Next to move on in this process:
4. We now have to enter the normal credit card information, such as card number, name and address, and security information. Once the credit card information has been accepted, we are presented with the full Online Subscription and Terms and Conditions. It is recommended that this is read through and then the Full Name and Title information is completed before pressing the I Accept button: [ 68 ]
Chapter 4
5. We are now presented with your last opportunity to review and confirm the order. If the total per month is as expected, press the Confirm Order button:
[ 69 ]
Signing Up for Windows Intune and Installing the Client Software
6. The order confirmation screen then presents an option to Proceed to activation. Press the button to enable the subscription you have just purchased:
Activate your purchase
You will not be able to utilize your subscription until you have activated it: 1. The first step is to create a Subscription Identifier. This is used on the bills you receive from Microsoft and can only contain letters, numbers, and hyphens. Enter this and then press Next:
2. We now have to confirm the Service Administrator before receiving confirmation that the activation has been successful. Go through the steps until you receive a confirmation similar to the one shown:
[ 70 ]
Chapter 4
3. The process itself may take a few moments as will be demonstrated by the Subscriptions tab showing a Status of Activation in Progress:
This will change to Service Active shortly.
Adding MDOP to your purchase
We can now add MDOP to our subscription too. This is achieved by selecting the action of Buy MDOP Add-On* and then pressing Go:
[ 71 ]
Signing Up for Windows Intune and Installing the Client Software
Once again we are presented with a familiar checkout process where you confirm the number of licenses required and then either select the credit card previously used or enter new credit card details. Complete this process and once again, close the Confirmation window.
Installing Windows Intune onto a client PC
Now that Windows Intune is available as a subscription, we need to load it onto each PC that will be managed and enable them to register and update themselves. This involves following the subsequent process on each computer: •
Downloading the client software to the device
•
Unzipping and installing
•
Waiting for the update process to complete
•
Confirming installation
It is vital that the machine has access to the Internet and can access https://manage.microsoft.com during the installation process.
Downloading the client software to the device
We now need to download the client software onto each device. This can be downloaded once from the Windows Intune console and then distributed on a USB flash drive or via a network share or other mechanism. Installing the software ties the computer to the Windows Intune subscription and we have to ensure that we have purchased enough computer subscriptions to cover the total number of devices that the software will be installed on. We need to go to the Windows Intune console by going to
https://manage.microsoft.com/WindowsIntune/App.aspx and signing
in with the Service Manager credentials you created or used earlier in this chapter. You will see the System Overview view when you do this. There is plenty to explore here which we will do later in this book:
[ 72 ]
Chapter 4
From here, we need to download the software. This can be done by clicking Administration and then Client Software Download. This brings us to the following screen:
Now click the Download Client Software link and save the ZIP file produced. [ 73 ]
Signing Up for Windows Intune and Installing the Client Software
Unzipping and installing
Assuming you are installing from a USB stick or have downloaded the ZIP file directly, unzip the file and you will see two files inside. They are Windows_Intune_Setup.exe and WindowsIntune.accountcert. These files are the same for all users within one organization:
Run the Windows_Intune_Setup program to start the installer. Press Continue through the installer until you have finished the installation and see the Finish button as shown:
The installer only runs for a short time and the Windows Intune components themselves are deployed via Windows Update.
Installing via alternative methods
For administrative purposes, you may wish to either facilitate a quiet install where the user is not involved in the deployment, or as part of an operating system sysprep image based deployment. Windows Intune now supports both of these. You may also want to deploy via a MSI file rather than setup.exe program as this is required by some application deployment tools and again, this is available with Windows Intune.
[ 74 ]
Chapter 4
Quiet installation
It is possible to run the executable file via script with the following command line: Windows_Intune_Setup.exe /quiet
This will install Windows Intune without prompting on the screen and will succeed or fail silently. If you are using an automated software distribution solution, then this may be desired or required. If you do chose this method, then success or diagnosing failure can be done by looking at the log files located here: %ProgramFiles%\microsoft\onlinemanagement\logs
Image based deployment
The latest version of Windows Intune brings with it image based deployment where you can place the Windows Intune files on a computer image that will then be loaded onto several computers. There are several steps to this process if you are using the Microsoft deployment tools. The process is as follows once you have installed Windows and customized the computer for rolling out to computers as a standard image: 1. Download and configure Windows Intune. 2. Prepare the image for multiple deployments. 3. Check the computer has connected to Windows Intune. Details of this process with the commands required are in Chapter 11, Deploying Windows 7 Enterprise Edition.
MSI file deployment
If you need to install using a Microsoft Installer Package (MSI), then you can extract the files using the following command line to then be installed by your specific tool: Windows_Intune_Setup.exe /extract <extract location>
This will place the files in the <extract location> folder for you to distribute via your chosen deployment tools. Once the files are extracted, you will see both a 32-bit and 64-bit installer. It important that you use the correct MSI file for the operating system and that the file windowsintune.accountcert is included with the MSI file. Once you have extracted the files, the following commands would install Windows Intune interactively or without user interaction: •
64-bit quiet installation: Msiexec /I Windows_Intune_X64.msi /quiet
[ 75 ]
Signing Up for Windows Intune and Installing the Client Software
•
Msiexec /I Windows_Intune_X64.msi /qf
•
32-bit (quiet or full user interface commands): Msiexec /I Windows_Intune_X86.msi /quiet
•
32-bit interactive installation: Msiexec /I Windows_Intune_X86.msi /qf
•
64-bit interactive installation:
For other MSI command options, use: MSIexec /?
Waiting for the update process to complete
Because the installation components are delivered silently, you will not see obvious signs that the various technologies are being installed and we need to wait for the update process to complete. The most obvious sign is that the Windows Intune EndPoint Protection gets installed. Shortly after this is installed, you will be asked to reboot the computer as shown in the following screenshot. This can take between five and thirty minutes depending on your Internet connection capability and the other tasks on the computer.
Confirming installation
As the installation is a behind-the-scenes process, it can be difficult to confirm that the Windows Intune installation has completed. The installation process is normally complete within thirty minutes while the computer is being used and will require a reboot once complete for the Microsoft Online Policy Agent There are several ways to see if the installation is progressing and has completed. First, the applications will install, so we will see Microsoft Forefront Client Protection on the taskbar and an icon for Windows Intune Center will appear on the desktop. [ 76 ]
Chapter 4
We can check the log files that are found by going to this location: %programfiles%\microsoft\onlinemanagement\logs
We can see a number of log files in that folder that should grow in size as the installation proceeds. The Enrolment.log file contains the information on the process of adding the computer to the Windows Intune environment. An example of the contents of the folder is shown in the following screenshot:
Finally, we can see progress in the Windows Intune console. In the following example, you can see that the computer has contacted the Windows Intune Service, but has not finished the registration. To access this screen, open the Windows Intune console and then select Computers, followed by Unassigned Computers in the All Computers section of the navigation tree. You should see a screen showing General information:
[ 77 ]
Signing Up for Windows Intune and Installing the Client Software
Now select Computers from the Unassigned Computers workspace and you will see all computers that have been enrolled into the Windows Intune service. If you click a computer, such as the Russell-PC example in following screenshot you will see how far we are through the process:
If the computer does not appear in the Windows Intune, console then you need to explore the log folders on the computer to diagnose the issue further. Details of the log files can be found at http://davidoverton.com/r.ashx?31.
Enabling others to manage your PC estate with Windows Intune
It is reasonable to assume that you may want more than one person to administer your computer estate. These additional people may work for your organization or may not. If you are working with a Microsoft partner, you need to enter the partner details into your subscription if you have not already done so while creating the subscription.
[ 78 ]
Chapter 4
Adding a partner to your subscription
By adding a partner to your subscription, you are telling Microsoft that this partner influenced the purchase or ongoing use of Windows Intune. It is important to both the partner and Microsoft for both recognition and auditing purposes. This should be completed within the first 30 days of signing up to Windows Intune for the initial partner. To do this, open the MOCP by going to https://mocp.microsoftonline.com: 1. Select the Subscriptions tab. From here, select the Add/edit partner item in the actions list and press Go.
2. Search for the partner by name, location, or their Partner ID if they have shared it. Enter this information and press Search. In the following example we are searching by name.
[ 79 ]
Signing Up for Windows Intune and Installing the Client Software
3. Select the partner you want from the list and then press Next.
4. We can see a summary of the partner added, and if this is correct, press Finish to see the following confirmation screen. Pressing Close here will finalize the process.
Both the customer and the partner will receive an e-mail confirming this change. The ability to remove or change the partner is provided through the same interface, should you change the partner assisting with PC management.
Changes a partner sees when managing more than one client When a Microsoft partner logs into the Windows Intune console, they manage PCs via an identical process that a customer would do. The only difference is that in the title bar of the console, the partner has the ability to pick which account to manage by pressing Switch to another account:
[ 80 ]
Chapter 4
Pressing this link prompts us to choose which customer to manage. This list is ordered by default so that those with the most alerts are at the top of the list. In the following example you can see that the top entry has two warnings while the organization below is healthy:
We can filter this using a variety of filters from the Filters drop down box. These enable us to focus on organizations with problems we wish to resolve: •
None (show all accounts)
•
Accounts with issues
•
Account with agent issues (normally installation problems)
•
Account with critical health issues
•
Account with endpoint protection issues (malware alerts)
•
Account with policy issues
•
Account with updates issues
•
Account with software issues
[ 81 ]
Signing Up for Windows Intune and Installing the Client Software
Summary
In this chapter, we have completed the process of signing up to the MOCP, purchasing a Windows Intune subscription, and any additional products such as MDOP. This included the creation of a Windows Live ID and setting the Tenant Administrator who always has access to the Windows Intune console. We have also run through the Windows Intune client PC installation process which relies on Internet access and discussed how to check the progress of the installation. Finally, we have added a partner to the subscription for audit and recognition purposes and also to enable the partner to administer the client computers. In the next chapter, we will configure Windows Intune, adding administrators, configuring the management policies, and ensuring that the PC is protected against malware and other attacks from the Internet. We will also examine the remote assistance and license management tools available to us in Windows Intune.
[ 82 ]
Configuring Windows Intune In this chapter, we are going to go through the steps required to configure the Windows Intune management tools. We will add an additional Windows Intune administrator, which provides both safety should someone lose access to their account, and also allows a Microsoft partner to manage the solution if desired. We will learn how to group computers so they can be effectively managed. We will enable the alert communication system so the right person is made aware when an alert is raised by Windows Intune. Finally, since Microsoft licensing can be a challenging task, we will enable access to any Microsoft volume license agreements through the Windows Intune console and see how that makes this easier. This chapter will have the following sections: •
Adding additional administrators to Windows Intune
•
Configuring computer groups
•
Configuring Windows Intune alerts
•
License management
Adding additional administrators to Windows Intune
Before we start doing any configuration for Windows Intune, we need to add additional administrators. It is always good practice to have at least two people who can access the administration console in case one person locks themselves out of the system, goes sick, or leaves the business. We may also want to enable a Microsoft partner with good desktop management skills to administer Windows Intune, so again, adding them now makes sense.
Configuring Windows Intune
Adding an additional administrator To add additional administrators, follow the ensuing steps: 1. Start the Windows Intune console by going to https://manage.microsoft.com/. 2. Select the Administration workspace followed by Administrator Management. There will always be a Tenant Administrator who is the user who signed up to the Windows Intune service. This user has full administrative access to Windows Intune and while they can be displayed within the console, they are not changed here. 3. Now select Service Administrators. We will notice that there is either one or no administrators showing depending on the steps you took when signing up to Windows Intune. In the following screenshot, there are no administrators shown:
4. Press the Add Administrator button and enter the e-mail address for the additional administrator into the entry box. If you want the user to have full permissions, select Full access, otherwise select Read-only access. Press OK to complete the process:
[ 84 ]
Chapter 5
5. You will now see the Service Administrator shown in the Windows Intune console:
We can add additional administrators by following the same process or we can delete Service Administrators by selecting the administrator on the same screen and selecting Delete instead.
Changing the Tenant Administrator
There can be up to two tenant administrators for Windows Intune and these are set by the person who owns the subscription to Windows Intune. One is the administrator who manages the subscription and the other is the service administrator as set in the MOCP. By default, these are the same person. These are not changed in Windows Intune and will change as the subscription administrators change rather than Windows Intune administrators. [ 85 ]
Configuring Windows Intune
Should we wish to change these administrators, we will be changing your Microsoft Online subscription information rather than Windows Intune and this needs to be understood and considered before making changes. Since the tenant administrator is tied to the subscription, adding the service administrator as a different account gives greater separation between managing the subscription and managing Windows Intune. Changing the service administrator is done via the MOCP rather than the Windows Intune console. Once you change the service administrator, you will end up with two tenant administrators reflecting the two Windows Live IDs logged with MOCP. Follow the ensuing steps to change the tenant administrator in Windows Intune: 1. Start the Windows Intune console and by navigate to Tenant Administrators in the Administration workspace. We can see the current single tenant administrator shown. Click the Go to Microsoft Online Services link to edit your subscription information:
2. Locate your Windows Intune subscription and select Edit Service Details and press the Go button:
[ 86 ]
Chapter 5
3. Confirm the Service Details by pressing Next and then modify the service account for the subscription as shown in the following screenshot:
4. Press Next to see the summary and then press Next again. Select Close to save the changes.
Configuring computer groups
All computers belong to groups that assist with managing them. Policy settings, reporting, and alerts can be viewed or changed by groups, so it is important to consider the groupings and configure them appropriately for these tasks. One very nice feature of Windows Intune is that a PC can belong to multiple groups and therefore, you can have multiple group hierarchies, one for reporting, one for policies, and so on.
[ 87 ]
Configuring Windows Intune
By default, PCs are assigned to two groups: the All Computers and the Unassigned Computers groups. To manage the computer’s membership to groups, we need to do the following: •
Choose a group structure
•
Create the group structure
•
Assign PCs to groups
Choosing a group structure
For smaller organizations, I would recommend creating a singular group infrastructure. However, for larger organizations where reporting becomes more critical, we should consider PC management and reporting separately. This structure has no bearing on any other Microsoft tools you may be using, such as Active Directory (AD). This is an administrative feature of Windows Intune only. For management purposes, grouping computers by type or configuration makes sense. Consider the following groups to be created: •
•
•
Location °°
Home
°°
Office
°°
Mobile
Type of computer °°
Laptop
°°
Netbook
°°
Desktop
°°
Virtual machine
Ownership °°
Company
°°
Personal
[ 88 ]
Chapter 5
In the preceding example, a computer would belong to three groups and these would provide all the management separations you might want for the policies. Just because a computer belongs to a group, this does not mean that additional policies have to be set as this also helps with reporting. These structures enable us to understand the primary location of a computer, what type of computer it is, and who owns it. For larger organizations where we may have to report by organizational division, we can also create additional groups structures such as: •
•
•
Organizational groups °°
Human Resources
°°
Administration
°°
Sales
°°
Support
Role in company °°
Executive
°°
Managerial
°°
Revenue generating
°°
Others
Geographical Location °°
United Kingdom °°
North
°°
South
I could continue on in many ways, but I hope you get the idea. We will now walk through how to create the basic structure we just described.
[ 89 ]
Configuring Windows Intune
Creating the group structure
To reproduce the group structure described earlier, complete the following steps. You can customize them to fit your own needs as required: 1. Start the Windows Intune Console by navigating to http://manage.microsoft.com and then click on the Computers to display the computers workspace. 2. Click Create Computer Group listed under Tasks in the right action pane:
3. Type the group Name and a Description of the group into the Details section of the screen:
[ 90 ]
Chapter 5
4. Select the parent group from the drop down, which in this case is All Computers. It will default to the group you are in when you create the group 5. Press the Save button to finish adding the group:
6. This needs to be done for each group—Location, Type of Computer and Ownership, giving us the structure shown in the following image. Be sure to create each group with Parent Group of All Computers. 7. We now need to create the groups under these top level groups. Click in the first group you want to create groups under, such as Location in the following screenshot:
8. Repeat steps 3 and 4 from to start to create the new group. When we come to selecting the Parent Group, ensure the correct parent is chosen, such as Location in the following screenshot. If we start in the right parent group then this should be automatically set correctly.
[ 91 ]
Configuring Windows Intune
Assigning PCs to groups
Now that we have created the groups, we need to assign the computers to the groups. As we install new computers in our business, they will appear in the Unassigned Computers group and will need adding to the appropriate groups for management. There are several ways to assign a computer to groups, the first involves starting in the group and assigning the computers to it. To do this, follow the ensuing steps: Start the Windows Intune console by navigating to http://manage.microsoft.com and then click on the Computers to display the computers workspace. At this stage you may also wish to add a computer to the group. Ensure you are in the group you want to add computers to, and then press Add Computers in the Tasks section:
Select the Group Name where the computers already exist. This is likely to be under the All Computers group:
[ 92 ]
Chapter 5
Now select the computers you want to add by clicking the computers, or selecting multiple computers by holding the Control key down while you click the computers. Press Add to add them to the list to add, giving you a finished selection as shown:
Press OK to finish the process of adding computers to that group and check that the Computers section is showing the computers added.
This needs to be done for each group under the already existing groups of Location, Type of Computer, and Ownership, giving us the final structure with each computer belonging to multiple groups. While we do not have to use this hierarchy, it gives us the flexibility to manage by policy, and deliver reporting with several slices of data. Note that a computer is automatically removed from the Unassigned Computers group when it is assigned membership of at least one other group.
[ 93 ]
Configuring Windows Intune
The second method involves moving computers to a specific group or groups. To do this, simply drag and drop the chosen computers from within the unassigned or All Computers group. In the following screenshot we are dragging david-win7x64 to the Office group. It is worth noting that multiple computers can be dragged at once:
The final way is to assign a single computer to multiple groups. This is done as follows: 1. Under All Computers, navigate to the All Computers group or the Unassigned Computers group and then the Computers tab in the workspace:
Click the computer name shown in the list of Computers list; for example, the computer called derek-pc in the preceding screenshot.
[ 94 ]
Chapter 5
2. Click the Edit Group Membership task under Tasks in the action pane on the right of the screen. 3. Select the groups that the PC needs to belong to. You may have to scroll down to see all the groups the computer needs to belong to:
4. Press OK to finish the process.
[ 95 ]
Configuring Windows Intune
Configuring Windows Intune alerts
Windows Intune will raise an alert in a number of situations where we, as the administrators, will either need to be aware of an event or respond to it directly. The alerts will appear in a number of the screens and reports within Windows Intune and they can also be sent via e-mail to selected e-mail addresses. The recipients of the alert e-mails do not have to be administrators. The reporting of alerts from the client computer to Windows Intune requires an Internet connection, so we are unlikely to see an alert saying that the user’s PC is having network trouble. However, if a user is having connectivity trouble we are still alerted, not because the client computer sends an alert, but because Windows Intune will raise an alert because the computer has not checked in for a period of time. In this section we will examine how to configure Windows Intune alerts so the right people are notified for each different alert type. Windows Intune provides two configuration options for alert management: •
Which alerts are enabled
•
Who is notified about an alert
With the preceding two settings, we can control the circumstance where an alert will be raised and who the users are that get an e-mail notification. This is configured in two stages: •
Configuring alert activation
•
Changing alert notification
We will run through both of these in the following text. Note that the alert notification will, by default, always go to the service administrator.
Configuring alert activation
There are several hundred alerts that can be enabled or disabled and the only way to ensure that the ones we want are enabled is to scroll through the list and check. A number are enabled by default; but not all of the Windows and Office ones I would want. I normally match the additional product alerts, such as Windows 7 and Office to align with the updates we selected. So, if I enabled updates for Office, I turn on the Office related alerts. To check and change the alerts, follow the ensuing steps: 1. Navigate to the Windows Intune console by going to http://manage. microsoft.com and then go to the Administration workspace, and click on Alerts and Notifications: [ 96 ]
Chapter 5
2. Click Configure Alert Type Settings 3. Scroll through the list of alerts to enable and disable those we wish to change by clicking Enable Alert Type or Disable Alert Type:
4. We can search for key words using the Search alert types box in the top right, however be aware that this only searches the Name. This means that we cannot find all the Windows alerts by searching for Windows.
[ 97 ]
Configuring Windows Intune
5. In the following example, I have searched for all items with office in the name and selected them. Pressing Enable will enable alerting on all these items:
6. To select multiple alerts to update by pressing the Control key and clicking each alert type.
Changing alert notification Alert notification consists of two different stages: •
Adding recipients to the console
•
Choosing which recipients align to the notification rules.
These two steps consist of entering the details of each person who will receive an alert and then selecting them against the pre-defined notification rules. These users do not have to be administrators in Windows Intune, and may be support staff or others who require visibility of some alerts. The five default notification rules are: •
All Alerts
•
All Critical Alerts
•
All Information Alerts
•
All Warning Alerts
•
Remote Assistance Requests [ 98 ]
Chapter 5
To change the notifications, follow the ensuing steps: 1. Navigate to the Windows Intune console by going to http://manage.microsoft.com and then go to the Administration workspace and click on Alerts and Notifications. 2. Expand the items under Alerts and Notifications and select Recipients:
3. Press Add… to add a new contact or the Edit… button to change an existing contact. 4. Complete all the details, paying note to the Language selection which will enable most, but not all messages to be displayed in the chosen preferred language. Press OK when completed:
[ 99 ]
Configuring Windows Intune
5. Continue adding contacts for each person or e-mail alias that should be notified about an alert type. 6. In the Administration workspace, press Notification Rules so we can assign the recipients to the five notification rules. 7. To modify the recipient, select a rule and then press Select Recipients… on the toolbar or right-click on the alert and select Select Recipients… from the menu:
8. Click in the boxes to select the recipients and then press OK:
[ 100 ]
Chapter 5
9. Complete this for each rule. You will notice that while the top four rules relate to the criticality of the alert, the fifth rule is specific to Remote Assistance requests. These always need to be carefully monitored and should be sent to a monitored alias or a person or group of people who are able to respond in a very timely manner.
Creating a customer alert rule
We can also add our own custom rules. Once again, we need to ensure the individuals are already added to our recipient list. Once this is done, follow the ensuing steps to create a custom notification rule: 1. Select Create New Rule... from the toolbar:
[ 101 ]
Configuring Windows Intune
2. We need to name our rule. As an example, we will create a rule to flag policy errors, so name it Policy Errors:
3. Select the categories of alert that will be sent to the selected recipients. In this case, select Policy and since we only want the errors, not information notifications, select Warning and Critical and then press Next. 4. We can choose to have rules send notifications to different people depending on the groups the computers belong to. Since we should only see policy errors for company owned computers as these are likely driven by group policy issues, select the Company as the group under Ownership. Press Next to continue:
[ 102 ]
Chapter 5
5. We can now choose who should be notified in the event of these alerts. Select the people we want to notify and then press Save.
[ 103 ]
Configuring Windows Intune
6. We can now see our custom rule in the Notification Rules section:
These custom rules can be deleted, while the default rules cannot. This is shown with the padlock next to the rule. All rules can be Enabled or Disabled from this same screen in Windows Intune.
License management
If you have a Microsoft Volume License Agreement, such as Open Value, Open Subscription, Select plus, or other agreement, you can see what licenses are available to you here and report on what has been purchased and installed. If you have purchased Microsoft or any other product licenses, Windows Intune can also store information about the licenses you have and align them to the software detected by Windows Intune on each client computer.
Managing your Microsoft Volume License details
Volume Licensing is an efficient way to purchase Microsoft software licenses. It is important that we tally the licenses purchased to those deployed to avoid unlicensed software distribution. Windows Intune can help with this process. To add Volume License information, follow these steps: [ 104 ]
Chapter 5
1. To access the Licenses workspace, open the Windows Intune console and select Licenses:
2. Now select Add Volume Licensing Agreements from the Tasks list. 3. Ensure the Agreement Type is Volume License agreement.
[ 105 ]
Configuring Windows Intune
4. We can now either upload a CSV file that contains the agreement information or we can manually add the details. For this example, we will add the details manually:
5. Type in a friendly Agreement name for the agreement and then the paired numbers. 6. We can now add the agreement details to either to Unassigned Agreements group or we can start to group the agreements together for easier management. If there are no groups, then we must create one. Type a Group name, such as Office Licenses or Open Agreements so that the group makes sense to us when we report on usage:
You will now be able to report against usage to ensure you are correctly licensed.
[ 106 ]
Chapter 5
Managing your other license details
We can now add the non-Volume License agreement information into Windows Intune. To do this, follow the ensuing steps: 1. To access the Licenses workspace, open the Windows Intune console and select Licenses as before. 2. Now select Add Other Software Agreement from the Tasks list. 3. Ensure the Agreement Type is Other software Licensing agreement:
4. Provide a friendly agreement name, such as Retail Office 2010:
5. Start typing the Publisher of the software you are selecting. As you type a drop down list of publishers will appear. Select the one from the list that matches your software, in this case, Microsoft:
6. Now start to type the product title. You do not have to type in the entire product name as keywords are searched. In the example above when Office is typed, we are able to pick Microsoft Office 2010 Pro from the list shown.
[ 107 ]
Configuring Windows Intune
7. We can now enter the license count so Windows Intune can tally the number of licenses purchased against the number installed:
8. If the license is a subscription or is time limited we can enter the License start date and the License end date so compliance is provided only during the correct period.
9. In the Agreement details box, enter a description of the licenses and if appropriate any reference number that may help associate the licenses in the future:
10. We now need to assign the agreement to a group. In this case, I want all my retail licenses to be in one group so we can create a Retail Purchases group to keep them together.
11. Finally, press Save to complete the license information. [ 108 ]
Chapter 5
Summary
In this chapter, we have managed the people who can administer our Windows computers which are managed by the Windows Intune service, and understood that the subscription owner and service administrator are part of this group of people. We have prepared Windows Intune for a simpler management experience by creating a computer group structure that we can use for policy and update administration. Finally, we have entered the license information for Microsoft Volume License agreements as well as details of other license agreements to enable this to be checked and reported against. In the next chapter, we will look at how we proactively manage the PCs through Windows Intune to keep things running smoothly by approving system updates, and managing policy.
[ 109 ]
Configuring Management Policy In this chapter, we are going to go through the steps required to configure the Windows Intune management policies. There are two key areas of policy that we need to consider: •
Policy management
•
Update management
Policy management will generally be set infrequently, with only occasional updates to IT policy, or small changes to items such as firewall configuration. The updates will require both policy management as well as at least a monthly review of any additional updates that fall outside the scope of the previously defined policies.
Policy management
Policy management is the creation of policies and then the application of those policies onto one or more computer groups. The three areas are: •
Windows Firewall Settings
•
Windows Intune Center Settings
•
Windows Intune Agent Settings
The groups are those we created earlier and policies can be applied to multiple groups. If we also have Active Directory Group Policy, this will override policy settings in Windows Intune.
Configuring Management Policy
Policies are updated on client computers with the check for system updates, so until a computer connects to the Internet and checks for updates, policies will not be distributed. If we have multiple policies that apply to a computer and there are conflicts, there are two rules that govern the final policy settings. These rules are as follows: •
Policies closest to the computer (that is,. inherited through the groups tree) win over those above them
•
When two policy settings are both as "close", the newest policy wins
In the following example, all computers have Policy A applied to them. If a computer is in the Home or Office Location group, it will also have Policy B applied to it. Finally, if a computer is in the Mobile group then Policy C is also applied. Each policy is applied in order, so anything that conflicts between policies is overwritten by each subsequent policy. There is a potential, and likely, situation in the example below where both Policy C and Policy D would be applied to the same computer. Going by the first rule just mentioned, it would not be possible to determine which policy would win. In this case, the second is applied, which ever policy is newer "wins" in the case of a conflict:
[ 112 ]
Chapter 6
Remember that the preceding rules only cover conflicts in the individual policy settings and that a policy may have items set as not configured, which in effect means "no policy setting", thus enabling two policies to be applied without any conflict in the actual settings applied to a particular computer. This is a good point to remind ourselves to keep our policy rules manageable and to only have additional policy setting where required and to use disabled settings for all additional policies except for the specific setting we want to change. We will now look at each of the three policy templates. To get into the policy settings, open the Windows Intune console and navigate to the Policy workspace. From here, click Create New Policy to create a policy. Remember that once the policy has been configured, we will still need to configure which group or groups it applies to before it is applied:
We will then be asked to choose the template we wish to edit. Pick the template and press Create Policy:
[ 113 ]
Configuring Management Policy
In each section, each policy item can be enabled or disabled. When disabled, the policy does not change any setting on the computer. Click the switch to change from green, which represents enabled, to grey for disabled:
After the General section in each policy, there is the ability to enable or disable all items in the policy. This is particularly useful if we have configured a policy at a high level and then are creating a policy to make a small change to the policy settings for a specific group to override it, such as a special exception to the firewall settings for a group of users. In this case, we will want almost all items in the policy disabled. To start with all items in the policy disabled, click on the switch to disable all policy items and we only need to enable and configure the few items we wish to override. The following screenshot shows the setting when all are enabled:
Windows Firewall Settings
The Windows Firewall Settings is a key policy, but one with several versions, depending on the location and ownership of the computers. While in a controlled business LAN environment the firewall policy may be consistent, when we have to cater for users at home or with a computer they also use for personal tasks, we may be required to provide different settings for these scenarios. It will possibly be easier to do this with multiple policies for the private firewall policy settings. We will walk through the creation of a policy, and discuss the options in this section. To create the policy, as mentioned in the preceding text, select Create New Policy from the Policy workspace task list. When prompted to select a template, choose the Windows Firewall Settings and then press Create Policy. Create a unique policy name and add a description in the General section.
[ 114 ]
Chapter 6
The next item allows us to enable or disable all settings in the policy before we continue to modify the specific settings that we want. We can see that this button has three settings, all configured, some configured, and none configured. Moving the switch to the middle position selects the option for some settings in this policy are not configured. The switch is shown in this way in the following screenshot. If this setting is moved from the middle position, we cannot move it back into this position as it can only enable or disable all policies. The middle position defines the starting configuration of the policy when it is first created, with some items enabled and some disabled:
The firewall policy is the only one where this setting defaults to this middle position. The Profile Settings enable us to configure when the firewall is enabled or disabled, whether it should block all incoming connections, and whether it should inform the user when it blocks a new program.
[ 115 ]
Configuring Management Policy
For maximum protection, we should ensure the firewall is enabled at all times and if configured correctly, we should not need to block all incoming connections. If your users are aware of what a firewall is, we should also inform them when a new application is blocked so they can enable an exception if desired. These settings would look like the following:
By default, all the Predefined Exceptions are disabled. If you we have an office environment where a number of computers are connected to a LAN behind a corporate firewall, we should consider enabling Branch Cache features of Windows 7 as this can improve the performance of web content downloads. This should only be enabled on Domain networks if you have a Windows domain and likewise on Private networks if you do not have a domain, but do have a workgroup network for a small office. A private network is frequently a user's home network, so we need to make the decision according to the network design, possibly even using two policies—one for home based machines and another for office based machines if required. The settings in the following screenshot can either be enabled in a unique profile deployed to the office group or in a common policy for all, depending on your choice.
[ 116 ]
Chapter 6
Depending on your business requirements, we may use Network Projectors and if so, this should be enabled as per the following screenshot. We should also enable Core Networking as this is utilized in Windows Vista and Windows 7 to provide networking connectivity using IPv4 and IPv6.
For home users, consider enabling the File and Printer Sharing option and the HomeGroup as this enables users to share information with family members as well as Media Center Extenders if the home user might also use the machine as a Media Center for their Xboxes. In the following screenshot, these are only enabled in the home network or Private network setting.
[ 117 ]
Configuring Management Policy
Finally, consider enabling the Network Discovery option as this is a really useful feature of Windows 7 and Windows Vista to examine the devices on a network:
The last two options we should enable relate to Remote Assistance in the operating system and Remote Desktop. While these do not relate to the Windows Intune feature to enable remote assistance, they can be extremely useful administrative tools and it is a real pain should we need to use them and discover that they are blocked by policy in the firewall:
Once we have completed the information, press Save Policy, after which we will get the choice of deploying the policy. Pressing Yes will enable us to choose the group this is deployed in. Given that this information is likely to be common across the whole organization, we can deploy this to all groups by selecting the All Computers group by clicking in the box and then OK.
[ 118 ]
Chapter 6
If you want to learn more about the impact of these firewall settings on Windows 7 firewall settings, have a look at my blog article on this at http://davidoverton. com/r.ashx?32.
Windows Intune Center Settings
The Windows Intune Center Settings configure the Windows Intune Center that is installed on each computer. The functionality is not changed by these settings, however, we can configure the information that is provided to the user at the bottom of the screen under the section Your computer is managed by:
[ 119 ]
Configuring Management Policy
To configure the Windows Intune Center to provide the information above, we need to edit or create a Windows Intune Center Settings policy. You can do this as per the previous section, or if you are in the All Policies section, press New at the top of the screen.
Select Windows Intune Center Settings and press Create Policy:
Once again, create a unique name for the policy in the General section:
In the Windows Intune Center section, complete the details as desired. The Name can either be an organization or personal name, as is true for the E-mail address, which might be
[email protected] if we want a generic support alias. [ 120 ]
Chapter 6
We can also share additional information via the notes field as seen in the following screenshot:
Once you we have configured all the settings to meet the business needs, press Save Policy and deploy it to the All Computers group, or if working to a subset of users, the appropriate group.
Windows Intune Agent Settings
The Windows Intune Agent Settings configures the anti-malware settings for Windows Intune Endpoint Protection and the Windows System Update. The policy creation or update is split into four steps: 1. General 2. Endpoint Protection 3. Updates 4. Network bandwidth Start the policy creation process in the same way again, and this time, select Windows Intune Agent Settings. [ 121 ]
Configuring Management Policy
General section
In the General section, we put in a name for the policy that is unique across all policy names and a description to help describe what the settings are when we are looking at the policy summaries.
Endpoint Protection section
The Endpoint Protection section configures all of the anti-malware settings provided by Windows Intune. This contains several sections: •
Endpoint Protection Service
•
Real-time Protection
•
Scan Schedule
•
Scan Options
•
Default Actions
•
Excluded Files and Folders
•
Excluded Processes
•
Excluded FileTypes
•
Microsoft SpyNet
We will now look at each section.
Endpoint Protection Service
The Endpoint Protection Service is the heart of the anti-malware engine. It can be enabled on all computers, none or only those without anti-malware installed. We will only be able to receive malware alerts and control computers where Windows Intune Endpoint Protection is installed. The following screenshot shows the settings available in the form and the settings we should use:
[ 122 ]
Chapter 6
We should consider changing this to Enable Endpoint Protection: Yes for all computers that are company owned at a minimum if Windows Intune is to be used as the company wide malware protection product. If we want to respect local antimalware settings of non-business owned machines, consider an additional policy to only protect computers that are unprotected when Endpoint Protection is installed. The other default setting to consider changing is the Track resolved malware (days) setting, which defaults to 7 days. We should consider changing this to the maximum setting of 30 days to provide the greatest visibility of users who got themselves into a situation where malware was or attempted to install on their computer. This is a good flag to watch for when reporting to enable the education of the users or a pattern of attempted infection.
Real-time Protection
The Real-time Protection area of the settings enables or disables the anti-malware engine and controls what it monitors. These settings should be left as per the default and are shown in the following screenshot:
[ 123 ]
Configuring Management Policy
The Enable behavior monitoring setting configures Windows Intune Endpoint Protection to check for and monitor the patterns of behavior of the computer and react if these are seen to change significantly, pointing to possible malware. The script scanning works with web based scripts that execute through Internet Explorer. It only works with and should be used along with Internet Explorer as the browser. Internet Explorer on the client PC provides the most secure web browsing experience possible on Windows today as it integrates the protection that the operating system can bring as well as that of the browser. The Network Inspection System works to ensure that network born malware is also blocked before it can impact the client computer. The Network Inspection System uses signatures of known vulnerabilities to detect and block malicious network traffic. The information is provided by the Microsoft Malware Protection Center. This means that when vulnerability is discovered or information about it is released that our computers have greater protection, even if a patch does not exist or there is no known malware.
Scan Schedule
Windows Intune Endpoint Protection can perform a quick scan each day to ensure the integrity of the system along with a full scan weekly. The defaults for these are in the middle of the night and unless computers are likely to be on, we should change the settings to times when the computer is likely to be on, but have less of an impact. Scheduled scans normally only run when the computer is idle and these are configured in the next part of the form.
If we want to schedule a computer to wake up and perform a scan, it is not possible to do this from within Windows Intune, however, I have blogged on a mechanism to enable this at http://davidoverton.com/r.ashx?33. [ 124 ]
Chapter 6
Scan Options
When a scan runs, there are various options that control what files are scanned and the settings for when scans occur:
Since the status of a computer is unknown when Endpoint Protection is installed, I would advise that a full scan is configured to run once the software is installed and if required, after malware detection. We can also control if a scan requires a computer to be idle or not for a scan to take place. If the computer does not have to be idle, consider lowering the Limit CPU usage to ensure it does not significantly impact a user. By default, network locations are not scanned, but consider changing this if the network storage does not have its own anti-malware solution installed. There are two settings here to consider.
[ 125 ]
Configuring Management Policy
The Scan files opened from network shared folders setting will scan files as they are opened from the network. If you use mapped drives, you can also have the client scan these by setting the Scan mapped network drives to Yes. This option needs to be carefully considered as every full scan by each computer would result in a full scan of the mapped network drives. While having one computer doing this is not a problem, if you have a large number of computers using the same mapped drives from the network storage, they will all be trying to scan the same network storage device as roughly the same time, having a negative impact on your network and your network storage as well as having multiple unnecessary malware scans. For either of these network scan options, the user will require write access to the files should malware be detected and for it to be removed, quarantined, or repaired.
Default Actions
If malware is detected we need to configure the default action for the user. While the default for all actions is to Quarantine the file, which removes it from harm's way, but it is recoverable through Windows Intune Endpoint Protection. We should consider changing the Severe and High classifications to Remove as per the settings in the following screenshot to completely remove known dangerous malware:
Excluding files and processes
Some files or processes can be known to provide what are known as false positives and trigger the anti-malware engine. These should be reported to Microsoft, however, we can work around this in the short term by putting in place special exclusions. If a specific process is known to cause false positives or has problems running with Windows Endpoint Protection, then we can provide details of the process name to be ignored. While we can simply use the process name, doing so provides greater opportunity for malware writers to exploit these settings and therefore avoid detection by any anti-malware product. To help resolve this issue it is better to user full paths. Since applications are not installed in the same place depending on the location of specific system or user folders, with the use of environment variables it is possible to ensure we can use a full path and handle these variations. [ 126 ]
Chapter 6
Common environment variables that you we can use are listed as follows: Environment Variable
Typical Settings
%CommonProgramFiles%
C:\Program Files\Common Files
%HOMEPATH%
\Users\David
%ProgramFiles%
C:\Program Files
%Public%
C:\Users\Public
%SystemDrive%
C:
%SystemRoot%
C:\Windows
%USERPROFILE%
C:\Users\David
To add a specific file or folder, enter the path into the Excluded Files and Folders section and press Add. We will then see the settings configured as follows:
Some applications themselves have specific issues and we can exclude all their activity from monitoring. To add an application, list it in the Excluded Processes section. This is the path that would be seen in Task Manager. Again, the more specific we can be while using environment variables, the better:
[ 127 ]
Configuring Management Policy
The final exclusion option for us is to exclude certain file extensions. To exclude a file extension, type the extension only into the Excluded File Types box and press Add. Note that we do not have to put the full stop before the extension.
Microsoft SpyNet
Microsoft SpyNet is a service that collects information on malware and sends it to Microsoft for analysis. While this should collect only malware, if a file with personal data is infected, this may also be collected. Microsoft does not examine or share the personal data or use it for any purpose other than improving the Endpoint Protection engine, but this may be something of concern in certain industries. Unless there is a specific concern we should consider Joining Microsoft SpyNet and setting changing the Membership level to Advanced from Basic. More information is shared when Advanced is selected. The settings in the form can be seen in the following screenshot:
Updates section
The next section for this policy is the Updates section. We can configure the actions of the update process, including how frequently these are checked and when updates should be installed. As with scheduling for anti-malware scans, we should also consider changing the schedule to a time when the computer is more likely to be turned on so the update schedule is better managed. This section can be seen in the following screenshot: [ 128 ]
Chapter 6
Network bandwidth
The last section of the form enables us to limit the network usage of the Background Intelligent Transfer Service (BITS). This is the service that downloads the policies and updates from Windows Intune. If there are no network bandwidth issues then this can be left disabled. However, if there is a desire to ensure that a single computer does not hog the network, this can be throttled accordingly, potentially only during certain times of day. In the following screenshot, we have limited BITS to 200 kbps between 9:00 AM and 5:00PM to ensure it does not interfere with other users:
[ 129 ]
Configuring Management Policy
Deploy Policy
Once we have configured the policy, press the Save Policy button at the bottom of the form. We will then be prompted as to whether we want to deploy the policy now:
Pressing No will save the policy without assigning it to any groups. Pressing Yes will allow us to select the groups this applies to. If we intend on creating multiple policies then we could save this to a group lower down the group tree, such as the Company group shown in the next screenshot, to enable an additional policy for personally owned computers. If we intend on only having one policy or for this to be the master policy, select the All Computers group. In the following screenshot we are deploying the policy to just the Mobile and Office computers that are Company owned:
[ 130 ]
Chapter 6
Editing an existing policy
To get into the policy settings to edit an existing policy, open the Windows Intune console and navigate to the Policy workspace. From here, click All Policies and then click the policy Name that we wish to edit:
We will see the exact same forms as we saw when creating the policy with the same options. If we wish to change the groups that a policy is applied to, select the policy line without clicking on the Name and then select Manage Deployment.
Update management
It is time to manage the system updates to ensure all computers are kept up-to-date with security and bug fixes for the Microsoft software and operating systems. We can approve updates on an individual basis, as well as enabling automatic approval of certain types, such as security and critical updates. We need to break this down into three stages: •
Selecting products and classification of updates to manage
•
Configuring automatic approval of updates
•
Manually approving updates
There is a fourth step to update management which is the deployment of non-Microsoft updates. This uses the software distribution mechanism that is discussed in the next chapter and will be covered there rather than here.
[ 131 ]
Configuring Management Policy
Selecting products and classification of updates to manage
The first stage with Windows Intune is to choose the products to manage and then the classifications of updates against those products. Since we are managing updates for the computers rather than the users checking themselves with Windows Updates, missing out products could lead to a product remaining insecure or buggy even though a fix has been released, and the user would not be aware of their situation! As we go through the steps we need to consider the configuration that we will make for Product Category and Update Classifications. To start the process, follow these steps: 1. Go to https://manage.microsoft.com and sign in to the Windows Intune console. 2. Select the Updates workspace from the menu. 3. In the Updates Overview, we will see the Tasks in the actions pane on the right. Click the Select Classification and Product task:
4. This takes us to the Service Settings: Updates screen as shown in the following screenshot. This is split into three sections, the first of which is the Product Category:
[ 132 ]
Chapter 6
The product categories are delivered as a tree, dividing as we go lower in detail, starting with All Categories and Microsoft. While there is the ability to manage to this level of detail, I think in most cases it makes sense to stick to the high level of which products and not the details as this can be refined in automatic and manual update approval. The default product categories selected are listed as follows: •
Office
•
Silverlight
•
Windows
•
Windows Live
•
Works
Given the tools found on most computers and the software delivered as part of Windows Intune, we should consider adding the following products to the list that is managed as they frequently occur on users computers: •
Developer Tools, Runtimes and Redistributables
•
Microsoft Application Virtualization
•
SQL Server
•
System Center Online
[ 133 ]
Configuring Management Policy
If we are using other Microsoft-based cloud products, we should also consider the following items as well: • • •
Bing Microsoft Dynamics CRM Microsoft Lync Server and Microsoft Lync
Remember, this does not install the product, but simply means that Windows Intune checks the client computer to see if the update is required. Simply click in the check boxes to add the products we want to have Windows Intune check for updates for.
Update Classification
The next section covers the types of updates that are checked to see if they are needed by Windows Intune. The Update Classification section we need to configure looks like the following screenshot when we start. By default, all items except Feature Packs, Tools, and Updates are selected:
The default selected classifications are as follows, and we can see that we would want to manage all of these and install them onto our computers that we are managing: • • • • •
Critical Update—A fix for a critical, non-security related product failure Security Updates—A fix for a product's security vulnerability Definition Updates—Updates for things like anti-malware Service Packs—A collection of updates, often covering both security and minor feature updates Update Rollups—Similar to a service pack, but often targets a subset of a product rather than a complete platform update [ 134 ]
Chapter 6
Of the remaining items, we should carefully consider the following items: •
Feature Packs—New product functionality that is released before the next full version of a product
•
Updates—A fix for a specific problem addressing a non-critical, non-security related bug
Again, these are both areas we may consider managing for rolling out updates. That leaves the final option of Tools which is described as a utility or feature that aids in accomplishing a task or set of tasks if we hover over the Tools text in the console. This is the one area we could consider not putting a check in the box for. For simplicity, if we want Windows Intune to manage as much as possible, we should simply tick All Classifications.
Configuring automatic approval of updates
We are now ready to let Windows Intune take the hard work out of updates for us by configuring the automatic approval of update. We need to choose which updates are approved without us having to do it ourselves. We could approve all updates, however, this could be considered a little rash if we wish to manage the update process in any way. However it is vital that all Windows and security updates should be evaluated and approved quickly and are, therefore, ideal candidates for automatic approval. If Microsoft Office is a key tool for our users then we should select Office updates too, at least for the business owned computers. To create an automatic approval, follow these steps: 1. Ensure that the Updates section of the Windows Intune console is open. If not, go to the Administration workspace and select Updates. Clicking the Automatic Approval Rules will take us to the right section of the form.
[ 135 ]
Configuring Management Policy
2. Press the New button. A dialog box will appear and here we type the Name of the new Rule and then press Next.
3. Select the Product Categories required. At a minimum, we should select Windows and if this is for all business owned computers, Office as well. When all the desired products have been selected, press Next.
Now we need to select the Update Classifications. As this is for the baseline of updates, I would recommend selecting all items. We may want to keep Feature Packs and Services Packs requiring manual approval, in which case, do not tick those items. Once the correct selection has been completed, press Next.
[ 136 ]
Chapter 6
4. Choose the Groups of computers that we want to receive the updates and press Finish. As this is the company baseline, I have selected those in the Company group, and those that are Mobile, or in the Office. Remember the group select means that a computer in any of those groups would be subject to the rule, so a personal computer located in the office would get the updates automatically. I think this is important as we want to ensure that a computer connecting to our network, or visiting a customer is secure and reliable at all times.
[ 137 ]
Configuring Management Policy
5. We should now see the new rule in the list of Automatic Approval Rules. Press Save to ensure all changes are saved.
6. To run the rule against all previous updates, select the rule and press Run Selected. We will see a short popup window showing the rule is being executed and then it will return back to the Service Settings: Updates screen. If this rule did not cover all computers, we will need to create additional rules for home computers and ones not owned by the business with Windows selected as the product and the Personal and Home groups selected as the groups to update. Our multiple rules will show in the Automatic Approval Rules similar to those below. Each rule will need to have the Run Selected button pressed to accept the historic updates not yet approved.
Manually approving updates
Once we have run the automatic rules, there will still be some updates that require approval for some computers. We need to check this at least monthly, after "patch Tuesday", which is the second Tuesday of each month when Microsoft releases their updates to the Internet, and therefore, Windows Intune. To do this, follow this process:
[ 138 ]
Chapter 6
1. Open the Windows Intune console and navigate to the Updates workspace. In the Overview section, we will see the Update Status showing. In the following screenshot we can see that we have three updates requiring updates. Click the item showing New updates to approve:
2. Select the update or updates we want to approve and then press the Approve button to approve these updates being deployed. If we did not want the update deployed, pressing Decline would achieve this. We will need to repeat this for all updates as required, as different updates may have different deployment timescales applied to them:
[ 139 ]
Configuring Management Policy
3. We have to choose which computer groups will receive these updates. Some are not approved because they require a new End User Licensing Agreement (EULA) being agreed to, as is the case in this example, while others fall outside the scope of the automatic rules. The Updates Details at the bottom will describe why each update requires additional approval. Select the Group Names as required. In the example image, this will go to all machines with those groups selected. We have to change the Approval and Deadline for each group individually.
4. Press the Keep Existing Approvals drop down list for each group to define the next step for these updates. 5. We next need to set a deadline when we want the users to have these approved. As some updates require a reboot, we may wish to extend the time a user has. Press the Keep Existing Deadline list to choose from the following list. Once a selection is made, a date and time will show in the Deadline column: • • • •
None As soon as possible One week Two weeks [ 140 ]
Chapter 6
• •
One month Custom
Press OK to start the process.
6. If we have to approve EULAs we will see each one and have to press Accept.
[ 141 ]
Configuring Management Policy
We can now see that all the updates are approved and awaiting deployment by Windows Intune showing as Updates that are pending installation:
Summary
In this chapter, we have configured the policies that define how Windows Intune operates with the computers and the policies it deploys to the users for updates, firewall, and anti-malware. We have also examined the approval process that we will need to follow each month to approve or decline updates that fall outside the automatic approval rules and policies that we have selected. In the next chapter, we will look at software distribution. This includes both Microsoft software as well as non-Microsoft software, and updates to distributed software too.
[ 142 ]
Software Deployment In this chapter, we will deploy software using Windows Intune. The options available are kept simple by Windows Intune, but it is adequate for most software application deployments, both from Microsoft and others. In this chapter, we will cover the following: •
Preparing an application for uploading
•
Using App-V packaging for deploying an application
•
Uploading an application
•
Deploying an application
•
Managing Non-Microsoft Updates
•
Removing an application
Some aspects of building a package for deployment are beyond the scope of this book, however, there is plenty of advice on how to do this on the Internet and I will provide information on where to find it as part of the topics. It is also vital to ensure you do not break any licensing regulations before deploying technology this way and that we have the software licenses required to cover all the computers we deploy to. The packages are kept secure by encrypting them on our computer before they are uploaded to Windows Intune. For deployment, the encrypted packages are transmitted to the destination computer and then decoded. The packages are never decoded or decrypted on the Windows Intune servers.
Software Deployment
Preparing an application for uploading
Before an application can be deployed by Windows Intune, it needs to be prepared to ensure correct installation. These steps are: •
Understand how the application is installed in silent or quiet mode
•
Create a folder for each installation package
•
Place all files needed for installation into one folder
To explain this, I will work through some examples from Microsoft, Intel, and Adobe.
Understand how the application is installed in silent or quiet mode This is probably the most important step. The applications installed by Windows Intune do not interact with the user as part of the install process. For this reason, understanding how to make this work for each package is vital. If the file can be distributed as a Microsoft Installer package (files with a MSI extension), then there is a switch already built into the install process. One important additional advantage of MSI-based installs is that they can be uninstalled by Windows Intune. EXE installs cannot be uninstalled by Windows Intune.
Once you have understood this, we can move onto the next stage.
Create a folder for each installation package
If the package is a single file, then this step can be avoided. However, it is always good to keep a folder with each application in separate folders underneath it, so we can manage these on an ongoing basis.
[ 144 ]
Chapter 7
Place all files needed for installation into one folder
Some applications come in a container that requires extracting. A good example of this is Windows Intune. In Chapter 4, Signing Up for Windows Intune and Installing the Client Software, we had to unpack Windows Intune before we could install it as part of a sysprep image. Any application you wish to install needs to be copied or unpacked into a single folder that we can point the uploading wizard to. There can be other files and subfolders that are required in this folder, but all files need to be in this folder structure.
Examples
The steps, mentioned previously, all seem very simple, so I thought I would run through some real-world examples in the form of: •
Office 2010
•
Adobe Reader
•
Adobe Flash
•
Intel Chipset software
Office 2010
Microsoft office is distributed on CD/DVD or via a download. If you have downloaded it via the Microsoft store, then you will need to extract the file to enable customization of the configuration files to enable a silent install. First, we need to ensure that we have our software folders sorted out. I have created c:\Software_Repository and I then use these commands to extract the files from a Command Prompt: MD C:\software_Repository\Office_2010_Download "Office 2010 Pro-X17-22376" /extract:c:\Software_repository\Office_2010_ Download
[ 145 ]
Software Deployment
Once this is completed, we need to edit the configuration file for a silent install. Details of this can be found at http://davidoverton.com/r.ashx?2T. It entails editing the config.xml file, found in the subfolder SingleImage.WW, and ensuring that the right lines are uncommented and changed, and then placing the file into the same folder as the setup.exe file. The changed lines in my finished file look as the following:
With these changes, the program is ready for uploading and installing. If you have copied the files from a CD/DVD, then we will need to make the same changes to the config.xml file, but we will not have to extract the files as they are already extracted.
Adobe Reader and Flash
To distribute Adobe Reader and Flash, we must first obtain a license. The whole process took a few minutes for me, including waiting for e-mails to confirm my company details. To get the license, go to http://www.adobe.com/products/ reader/distribution.html and select the Adobe products you wish to distribute. Once we receive the download links, we can distribute the Adobe products. They can be saved as either MSI or EXE files. However, note that the programs are 32-bit and 64-bit dependant as well as operating system version dependant, so be sure to download all versions to cover the requirements of the computers on the networks. The versions I downloaded, each went into a folder as follows in my Software_Repository folder: •
Adobe_Flashx64
•
Adobe_Flashx86
•
Adobe_Reader_Win7
•
Adobe_Reader_XPsp3
You can see here that Flash has both 32-bit and 64-bit versions and the Reader product differs between Windows 7 and Windows XP SP3.
[ 146 ]
Chapter 7
If we have MSI packages, then these can be installed quietly with a /quiet switch which Windows Intune delivers automatically. For the EXE file installs, Adobe changes the commands from time to time, which means you need to find the right command for that version of the installer. For 10.1 of Adobe Flash, the switch / install appears to be the correct line. For the Adobe Reader, we need to master commands like the following ones for Windows 7 and Windows XP. Unfortunately, only by searching around on the web can you find the correct command for each version of each product. Adobe now does have a customization tool that can build MSI files, but we will use these as good examples of complex EXE file installs. •
For Windows 7, use the command: Adberdr1011_en_US.exe /sAll /rs /l /msi "/qb-! /norestart ALLUSERS=1 EULA_ACCEPT=YES SUPPRESS_APP_LAUNCH=YES"
•
For the XP SP3 versions, we use the following command: AdbeRdr940_en_US /sAll /rs /msi "/qb-! /norestart "
We are now ready to upload these files and deploy them with Windows Intune.
Intel chipset software
The Intel chipset software can be downloaded from http://davidoverton.com/r. ashx?2V and is frequently required on Intel-based systems. If appropriate, we could deploy it via Windows Intune, provided we were certain the target machines were Intel based, either through a purchasing policy or group membership inside Windows Intune. To help us work out on how to install silently, the Intel download page has a link to a readme file that states the following on how to deliver a quiet or silent install: •
-S: Silent install (no user prompts or Intel RST user interface display). If used in combination with -B, the installer will automatically reboot.
Knowing this means that we now have the file ready to upload and deploy via Windows Intune.
Using App-V packaging for deploying a package
Building App-V sequenced packages is not something I will be walking through in this book. App-V can require a whole infrastructure, however, it is possible to build the package and then deliver it via Windows Intune. This does not provide the full benefits, such as running the application before it is fully downloaded or updates through the server, however, App-V does provide management benefits including application separation and avoiding DLL hell. [ 147 ]
Software Deployment
A great blog to help you can be found at http://davidoverton.com/r.ashx?2Y.
Uploading an application
We will now upload the application package files, that we prepared so that Windows Intune can deploy them to client computers. To do this, first of all, start the Windows Intune management console and navigate to the Software workspace and select Managed Software.
If there are any applications already uploaded, then they will show here. Now click on Upload to start the process. It will initially download the tool to your computer to upload the installation packages. We will be required to sign in again to ensure security. Once you have read the initial Before you begin screen, choose whether to put a tick in the box to Do not show this page again to avoid having to click through this page each time we start an upload of the installation package. Then click Next to continue.
[ 148 ]
Chapter 7
Now, for each example product that we discussed earlier, we will now complete the upload process. As we repeat the process for each application, I’ve significantly reduced the amount of information provided, as uploading a package is a repetitive process with only a small number of changes for each application that make the vital difference.
Adobe Flash – 64-bit MSI
The Adobe Flash install package is the only Microsoft Installer package used in this example, which means the pages shown as part of the wizard are fewer than those used for EXE setup routines, however, the process is still the same. Follow these steps to upload the 64-bit version of Adobe Flash: 1. Click on the Browse button to select the MSI file for Adobe. 2. Since we do not need any additional files, ensure the Include additional files and subfolders from the same folder checkbox is clear and then click Next.
[ 149 ]
Software Deployment
3. Enter information about the package; wherever possible, this will be pre-populated from the file itself. Once this is all complete, click Next.
4. We now want to limit the platforms this software will be installed on. In this case, we need to ensure that only 64-bit versions of Windows receive this package. To do this, we need to pick 64-bit from the Architecture drop-down box and ensure that Operating System is set to Any. Once the configuration is correct, click Next.
5. If we need to add additional commands to the installer, they should be added here. In this instance, we do not need to add a command line to this installer and to make it non-interactive with the user. If we were deploying from a command line, we would know that MSI-based installs have a /Q or /Quiet install switch and use this. Windows Intune automatically applies this for us, so adding again would cause the install to fail. Once we are ready, click Next. [ 150 ]
Chapter 7
6. Check the summary information and if satisfied that this is correct click Upload to start the compression, encryption, and then upload process.
[ 151 ]
Software Deployment
7. Once the upload is completed successfully, we will be notified. Clicking on Close will close the upload application.
8. Click on Managed Software, to refresh the list of software, and our first package will appear.
Adobe Flash – 32-bit EXE
Our next example is an EXE-based installer that we want to install on 32-bit and 64bit versions of Windows. This is slightly unusual as we normally only want 32-bit versions on 32-bit machines, however, Windows has 32-bit and 64-bit versions of Internet Explorer on 64-bit machines, so we want to target both with this application package. To do this, follow the steps given:
[ 152 ]
Chapter 7
1. Start the Upload application and browse to the 32-bit Adobe Flash installer EXE file in the Software_Repository structure we created earlier and select the file.
2. Continue through the configuration, entering information into the Software description page and click Next. 3. On the Requirements page, we need to make changes to reflect the capabilities of the installer. We want to install this application onto both 32-bit and 64-bit machines as 64-bit Windows machines have a 32-bit and 64-bit version of Internet Explorer. To do this, select the architecture of 32-bit and 64-bit. Also, since this can be loaded on to machines running Windows XP and above, select the Operating System of Windows XP onwards. Once completed, click Next.
[ 153 ]
Software Deployment
4. Windows Intune will only try to install a product if it does not believe it is already installed. We can either let Windows Intune monitor this by tracking previous installations it has delivered or we can add our own rule. If we were to add our own rule, we could then check for a particular file on the hard disk, a MSI product code or a specific registry key. For now, we will be using the default detection rules. Click Next to continue.
5. Since the Adobe Flash installer requires a command line of /install to deliver a silent install, select Yes and then enter the /install command into the Command line arguments box.
6. Non-MSI installers can inform Windows Intune if the install has been successful via return codes. A return code is a number that the installer sends back to the program that started it. There are some standard codes that are commonly used by installation routines and we should accept these defaults, unless we know specific alternatives for our application. 7. Windows Intune presumes that unless one of the success return codes is provided, the installation has failed in some way. We can, however, have multiple Success and Success with restart codes. Leave these as the default and click Next. [ 154 ]
Chapter 7
8. The wizard can be finalized (the application will upload) and the tool can be closed.
Adobe Reader – Windows 7 EXE
Follow the same process for Adobe Reader for Windows 7 as we have used for other EXE packages. There are two pages where we need to set non-default settings for this installation package. The first is to ensure this application is only installed on Windows 7 or a newer operating system and the second is to put in the correct command line for a silent install. To ensure only Windows 7 is the deployment target, ensure that the Architecture is Any or 32-bit and 64-bit and the Operating System is set to From Windows 7 and to All newer operating systems.
[ 155 ]
Software Deployment
Progress through the wizard until we can enter the command line arguments which needs to be entered as per the discussion earlier, or the following screen. This has an interesting aspect to it as the setup program calls the Microsoft Installer. When this is executed by Windows Intune directly, it automatically adds the /q switches for a silent install. Since Windows Intune is calling the EXE file and not the Microsoft Installer, in this command line we need to keep the /qn switch.
Continue through the wizard and close it once the application is uploaded.
Adobe Reader – XP SP3 EXE
We now need to upload Adobe Reader for Windows XP only. Load the upload tool and select the file and continue.
Now, we need to progress through the tool until the Requirements page and limit the Operating System to Windows XP through to Windows XP, as per the following screenshot. Since Windows XP only shipped as a 32-bit product, we can limit this to a 32-bit install.
[ 156 ]
Chapter 7
The setup again needs a number of setup command line arguments. Move through the tool until we get to the Command line arguments. Set these and finish the wizard.
Intel drivers
The Intel drivers are similar to other rules with a command line argument of –S and the requirements that it is strictly deployed on Windows 7 and not earlier or later operating systems. Ensure the Requirements settings are as per the following screenshot to limit the Operating System only to Windows 7:
Continue through the wizard and finish the upload.
Office 2010
Office 2010 is the first package that we are uploading where we need to include additional files. Since we have modified the config.xml file, there is little we have to do as there are no command line switches to include. This means that the only page that is different to the others we have gone through is the first page to select the setup files where we must select Include additional files and subfolders from the same folder to package all the installation files.
[ 157 ]
Software Deployment
Deploying a package
We now have all our packages uploaded to Windows Intune. By selecting Managed Software in the Software workspace, we can see all the uploaded packages and the statistics on installations, failures, and pending installs.
To deploy a package, select the package or packages and then click on the Deploy button.
We now have to select which groups will have the software deployed to them and when the package must be installed by. In the following example, I am deploying all company-owned machines that are not in a home environment:
[ 158 ]
Chapter 7
Click on OK and the installation of the packages will be scheduled. When we return to the Managed Software page, we can see in the following screenshot that the packages are in various states of installation. We can see that two of the packages have Installed on 1 machine and that 1 has Failed with two more machines with Pending installations. We can also see that 3 machines are flagged as Not Meeting Requirements, so will not have the application installed to them at all.
[ 159 ]
Software Deployment
Clicking on the numbers enables us to gather more information as to what has happened. For example, clicking the number 1 in the Failed column showed the following information:
We now need to research what Error code 0x411 means for that application installer and take action to resolve the problem. This will be specific to each application. Additional information can be found at the Windows Intune help page at http://davidoverton.com/r.ashx?2Z. We can see the application updates on a client PC through the Windows Intune Updates:
[ 160 ]
Chapter 7
Managing Non-Microsoft Updates
A non-Microsoft Update can be used to deliver any update that will not be delivered via the Update Service provided for Microsoft applications. It can be a Microsoft Update or one from another vendor. Since we have deployed Office 2010 through software deployment tool, we will use the non-Microsoft Update capability to update this. The process is almost identical to the software deployment tools that we have already used with Windows Intune, which is why it is in this section. To demonstrate this, we will deliver Office 2010 SP1 update following these steps: 1. Start the Windows Intune management console and navigate to the Non-Microsoft Updates section of the Updates workspace.
2. Select Upload to start the tool to upload the update. 3. Click Next to start the tool. 4. Click on the Browse button to locate the file we will use to deliver the update. If we need to include other files in the folder, click the Include additional files and subfolders from the same folder checkbox.
[ 161 ]
Software Deployment
5. Fill in the details describing the update. As it is an update, it needs a classification to be assigned. Since this is a Service Pack update to Office, choose Service Pack. This is used in the reporting on updates that we discuss in the next chapter. Once the details are complete, click Next.
6. Specify the Requirements as we would for any application upload and click Next.
[ 162 ]
Chapter 7
7. For Windows Intune to understand if the update has been installed, we again have a number of choices as to how to tell. If we select Use the default detection rules, then Windows Intune will work on its own information. We can alternatively look for to see if a File exists, MSI product code exists, or a Registry key exists. For this example, we will use the default detection rules. Click Next once this is complete as desired.
8. We have a choice as to whether this is an update to an existing deployed software item. If it is, then we need to select It is managed software in Windows Intune and click Browse.
[ 163 ]
Software Deployment
9. Select the software item that this is an update to and click OK. In the following example, it is Office 2010 Pro:
10. If the update is for an item that is not managed by Windows Intune, then we can either select None as a dependency, which means it will automatically install, or we can add our own rules. 11. In the following example, I’ve added two File exists rules to check for WINWORD.EXE and Excel.EXE. Once the dependencies are set, click Next.
[ 164 ]
Chapter 7
12. Now, we need to enter any Command line arguments that are required for a silent install. In this case, the requirements are /quiet /passive. Once these are set, click Next.
13. Finally, we have to configure the Return codes in the same way that we have to do this for Managed software within Windows Intune. Set the return codes and then click on Next. 14. We are now shown a full summary of the settings. Once we are sure they are correct, click on Upload for the update to be loaded to the server.
[ 165 ]
Software Deployment
15. Once the update is uploaded, it now needs to be approved. Return to the management console and refresh the window to see the update.
16. Select the update and click on Approve. 17. Choose the groups for the update to be sent to and then set the Approval to Install and chose a Deadline, such as ASAP.
18. We have now completed the process of deploying an update through Windows Intune. [ 166 ]
Chapter 7
Removing a package
Removing a package can mean removing it from Windows Intune’s storage and deployment process or uninstalling it from a client PC. If the package was installed as a MSI, then it can be uninstalled from a computer.
Uninstalling software from a client PC
Uninstalling MSI software is almost identical to installing software. Start at the Windows Intune management console in the Software workspace on Managed Software.
Identify the MSI-based install package and then click Deploy. We can now see the normal deployment screen. However, the Deployment setting can be set to Uninstall with a Deadline of ASAP to ensure it happens quickly. Making the group choices and clicking on OK will remove the software from the computers selected.
[ 167 ]
Software Deployment
Removing a software package
The other option discussed is removing a software package from the list that is managed by Windows Intune. This stops further deployments but does not remove existing installations. To remove a package, go to the Managed Software section of the Software workspace in the Windows Intune console and select the item we want to remove.
Now click on Delete on the toolbar. We will see a large warning. If this is the right item, click Delete:
When we return to the console, the item removed will have a thin line through it to show that is has been selected for removal. Once we refresh this page, the item will be removed.
[ 168 ]
Chapter 7
Summary
In this chapter, we have uploaded and installed a number of different software items, learning about the differences in process for MSI and EXE installation tools. The silent installation process requires careful attention to the settings and files required for a successful installation when we are not at a computer. Through examples, we have examined those options. Windows Intune can also install applications through the wizard-based delivery tools and we have deployed an update using this same mechanism too. Finally, we have removed an application and a software package from Windows Intune. In the next chapter, we will proactively track and report alerts to monitor our effectiveness and demonstrate value to our management. We will also track the computing hardware and software environment to ensure compliance and no misappropriation of our technology.
[ 169 ]
Tracking and Reporting In this chapter, we will ascertain the tasks that we will need to carry out regularly to ensure a good baseline of proactive management for the computers that we manage. We set Windows Intune policy in previous chapters, and now we have to set our own policy on regular tasks that we carry out to ensure the lowest risk of alerts due to failing computers or malware. We also need to be able to demonstrate to our business that is paying for Windows Intune that the impact is positive for the users as well as the IT team. In this chapter, we will discuss the following areas which align to the reports available in Windows Intune and the Reports workspace: •
Reporting basics
•
Update reports
•
Tracking software usage
•
Tracking hardware
•
License management
•
Alerts reporting
•
Custom reports
•
Reporting on overall PC management achievements
Tracking and Reporting
Reporting basics
Most of the reports that we will use in Windows Intune are generated through the Reports workspace, as shown in the following screenshot. We can see that there are many reports available through this workspace and they can be customised and saved to enable quick access to a number of views.
The other location where we will generate data for reports is from the Alerts workspace as there is no report for alerts that have been received or closed. Understanding the outstanding issues that need to be fixed and being able to report on this to the business or customer is vital to show that the management system put in place is working. The report data is generated by the last icon on the toolbar. It is available in many locations throughout Windows Intune; however, from a reporting point of view, only the Alerts workspace provides us with unique information not available via the Reports workspace.
[ 172 ]
Chapter 8
Reporting basics in Reports workspace
While each report in the Reports workspace provides different information, there are some common customizations that we should be aware of. We are going to explore: •
Selection customization
•
Saving and loading customizations
•
Sorting data in the columns
•
Printing a report
•
Exporting data
Selection customization
Each report has a number of customization selection filters to enable you to filter down the data that is reported on. An example is shown in the following screenshot:
[ 173 ]
Tracking and Reporting
If we want to export the data and manage it elsewhere, such as a spreadsheet or database, then it may make sense to not filter data here, but in a spreadsheet. One filter that is available in all but one of the reports is the computer groups filter. To use this filter, press the Edit button and then select the groups to report against. Once the groups are selected, press OK.
Given that this is common across the reports and much of Windows Intune, I shall not be talking through this selection any further in this chapter.
Saving and loading customizations
Once we have customized a report, we can save it so that we do not have to set the customizations in the future. For example, the report in the following screenshot has everything I want to report on:
[ 174 ]
Chapter 8
To save the customizations, press the Save As button in the tool bar and enter a name for the customizations and press OK.
We can now go to the Update Reports any time and reload that report by clicking on the Load button on the toolbar and selecting the previously saved report.
Sorting data in the columns
I know this is a very simple item, but some of the reports have lots of rows with zeros in them. To bring meaningful data to the top of the report, find the column that you are interested in and click on the columns title. The first click may sort the data lowest to highest, so click again to reverse this. In the following example, I have clicked on the Installed column text to bring the updates that have been installed to the top of the list.
Printing a report
Once we have a report sorted and delivering the information we want, printing to a printer or file writer, such as a PDF or XPS writer to enable a permanent copy, is always a good policy to enable historic information to be at hand.
[ 175 ]
Tracking and Reporting
To start printing, press the printer icon in the top-right corner of the report.
Windows Intune will then prepare the data for printing. This may take some time and while it is doing this, we will see a dialog box with only a cancel option as shown in the following screenshot:
Once the processing has completed, the standard printer dialog box will appear. Select the printer and press Print for the report to be printed.
[ 176 ]
Chapter 8
Exporting data
Once a report is produced, we can export the data from the report so that we can present it offline or import it into a spreadsheet. To export data, run a report and select the export icon in the top-right corner of the report, next to the printer icon.
We now have a choice of two Export formats, either .csv or .html. Csv stands for Comma Separated Values and is a format that most spreadsheet applications, such as Microsoft Excel and databases can import. The .html file format is ideal for displaying at a later date in a browser when not connected to the Internet.
For many exports, we also have the option to Export summary data only or full data. When exporting .csv files, I would recommend removing the tick in the Export summary data only checkbox as this gives us more detail to drill down on and report. Once the Export format and summary data choices are selected, press Export.
[ 177 ]
Tracking and Reporting
We are then given a choice of the file name and location for the exported file. Type a file name and location and press Save.
Reporting basics in Alerts workspace
We can also gather information from the workspaces in Windows Intune and we will do so throughout this chapter. However, the Alerts workspace requires special attention as it is the only place to gather information on the alerts that have been raised or closed within Windows Intune, and we can export them in the same way that we export data for reports. This information is a vital section of our report on the effectiveness of the PC management that we provide to the business.
[ 178 ]
Chapter 8
Each Alert is categorized as one of the following: • • • •
Critical Warning Informational Closed
There are some filter concepts we need to understand before we can export data from here. The first is that we can filter the alert by category; however, when the filter is set to None, it does not show Closed Alerts, so None is more like "Open Alerts" in functionality. This means that at the very minimum, we need to export data twice from this workspace to get a complete picture of the user issues and the activity to close them.
Update reports
The update report enables us to review the updates that have been processed by each computer and then evaluate their current deployment status. Because each update is evaluated by the client computer, Windows Intune can only determine if the update is required once the computer has contacted the service. There are a huge number of updates available for Windows and the other products managed by Windows Intune and any report will be very long, which is a strong indicator that this data is perhaps easier to analyze in Microsoft Excel. There are a number of reports we may wish to examine—these can be managed by changing the filters available to us in the report and if desired saving each view. The filters are shown in the following screenshot:
[ 179 ]
Tracking and Reporting
Report settings that we should consider are listed as follows: Settings
Description
Update status = Failed Effective approval = Install
Update installation issues. Status of all approved updates across the estate, including those where installation succeeded, failed, or is pending.
An example of the second report is shown in the following screenshot:
In the first row, we can see one machine is pending and two have installed the update. We can also consider changing the update classification option. The Important updates classification contains all updates classified as follows: •
Security Updates
•
Critical Updates
•
Rollup Updates
•
Service Packs
The High-priority updates classification only includes those that are security and critical updates, while All includes all update types.
Tracking software usage
By tracking the software used within the business, we can ensure we know what software we have to support down to the product version and who is using it. This also enables us to track authorized versus unauthorized software installation. [ 180 ]
Chapter 8
Windows Intune splits software into two important categories—installed and licensed. All installed and deployed software is managed from the Software workspace. The Licensing workspace shows information regarding our software licenses and detected installations against those purchases. To effectively manage software, we need to look at the installed software as well as the license purchase and usage. There are two ways to look at the software installed on managed computers from within Windows Intune: •
Software installed on an individual computer
•
Estate-wide software view
Software installed on an individual computer
We can examine each computer to see the software installed. This enables us to see what versions of software and the name of the product for auditing purposes for any user. To do this, follow the steps: 1. Start the Windows Intune console by going to the https://manage. microsoft.com site. Navigate to the Computers workspace and find the group that we want to examine in the Computers list. Click on the Computers tab to show the computers in the group, and then select the computer to examine, as shown in the following screenshot:
[ 181 ]
Tracking and Reporting
2. Right click on the name of the computer to examine and select View Properties from the menu shown. Select the Software tab to see the screenshot, shown as follows, listing all the software installed on the computer:
3. We can print or export the data as per the processes discussed earlier in this chapter.
Estate-wide software view
There are multiple ways to get an estate-wide view of the software that Windows Intune has detected. We can drill down and examine the detected software through the Software workspace, as shown in the following screenshot:
[ 182 ]
Chapter 8
While this enables us to examine the information, review the computers, and even export the data, the Detected Software Reports enable customization that is not possible through this view.
[ 183 ]
Tracking and Reporting
For maximum reporting if we are going to export the data, we should leave all the reports as per their defaults of All. If we click on Select publishers option by pressing the Edit button underneath it, we are shown a list of all the publishers for detected software, similar to the list shown in the following screenshot:
Likewise, if we look at the categories, we again see a selection similar to the one shown as follows:
[ 184 ]
Chapter 8
It is worth noting that sometimes an item of software will be installed on more computers than those managed. This is because some software may have multiple versions installed on one computer, thus being counted multiple times. An example of the report is shown in the following screenshot with the detail expanded to show which computers have Adobe AIR 2.6 installed. When exporting the data, the summary data does not contain the per-computer information shown in the following screenshot:
Tracking hardware
Tracking the hardware that is running in the business and how this changes over time enables us to ensure that we are meeting the legal responsibilities we have, as well as ensuring that we are making the right purchasing decision for the future, and are able to support any hardware installed today. Understanding the hardware that we are delivering support for enables us to ensure we have the right support contracts and appropriate spare parts available to deliver a reliable computer experience to the users. It also enables us to make decisions about inventory flow down and replacement, as well as to ensure that all the hardware we purchased is still installed in the machine months or years later. Within Windows Intune, we can track information about the full hardware inventory on a computer-by-computer basis or search for computers that meet a particular specification, perhaps for consideration of replacement or upgrading.
[ 185 ]
Tracking and Reporting
By comparing how this information changes over time, we are able to ensure our computer estate is well maintained. As with the software information, this can be obtained either through the Computers workspace or through the Reports workspace and the Hardware Inventory Reports.
Computers workspace view
By navigating to the Computers workspace and selecting a group, it is possible to see the computers within that group. Setting the filter at the top of the view to Computer details and user account shows the hardware information as shown in the following screenshot:
If we right click on a computer and select View properties from the menu, we then see the computer details. If we select the Hardware tab, then full information on the computer is provided, including information about the manufacturer, BIOS, processor, physical disks, disk partitions, network adapters, and other devices in the system. An example can be seen in the following screenshot:
[ 186 ]
Chapter 8
This information can be exported as a CSV file for storing and comparing in the future.
[ 187 ]
Tracking and Reporting
Hardware Inventory Reports
The Hardware Inventory Reports are in the Reports workspace and enables us to dissect information about the hardware across the estate. The most important feature is found at the end of the filters available to us.
There are a number of filters not shown in the preceding screenshot that are at the top of the form. These cover: •
Computer groups
•
Operating Systems
•
Manufacturers
•
Models
I don't think I need to explain how to use these filters as they are self-explanatory, so we shall concentrate on the ones in the above screenshot. If we wanted to find all the computers with a slow processor and less than 2 GB of RAM, then we would set the last two filters as below:
We should note that the settings are all enforced, so we cannot find all machines with less than 2 GB of RAM or a processor slower than 2 GHz in a single search. Once again we can export the data and carry out greater analysis in a spreadsheet. [ 188 ]
Chapter 8
License management
We have already looked at how to view software installed on computers managed by Windows Intune. Another fantastic benefit of Windows Intune is the ability to compare this usage to the licenses that have been purchased and entered into Windows Intune. There are two reports available for this that we shall explore: •
License Purchase report
•
License Installation report
Purchase report
The Purchase report details the licenses that have been purchased from the license agreement information that we have already entered into Windows Intune. There are only two filters available to us with this report.
The Select license type option can be set to either Volume Licensing agreements or Other software licensing agreements, enabling us to the see the Microsoft or non-Microsoft agreements. When we added license information to Windows Intune, we created license groups and so we can pick from these groups, or view everything. Once again, this information can be exported using the Export button in the top-right corner.
Installation report
The Installation report compares the license purchased information and the number of installations on the managed computers. We have the same options as the Purchase report, plus the ability to view only selected group of computers.
[ 189 ]
Tracking and Reporting
With this report, we can see the software purchases and which computers have software that matches those purchases. Sometimes the information can be mismatched, so this report requires some interpretation. For example, in the following screenshot we can see that Microsoft Office has been purchased, but the license type does not match that which we entered. If this is correct, then the license purchase information needs to be updated. For this report to be truly useful, inserting information on all purchases is required to enable the matching of installed and purchased software otherwise many items will show as unlicensed.
Alerts reporting
There is not a report for alerts in the reports workspace; however, we can get all the information we need by exporting two sets of information from the Alerts workspace. To do this, follow these steps: 1. Start the Windows Intune console by going to the https://manage. microsoft.com site. Navigate to the Alerts workspace and click on All Alerts. If we only wanted a subset of the alerts, we could examine the sub areas under Filters, such as Critical. For reporting, we will only set the Filters option to None.
[ 190 ]
Chapter 8
2. Now export this information using the Export icon in the top-right corner. 3. Change the Filters option to Closed to see all the closed alerts.
4. Now export this information using the Export icon in the top-right corner. We have now exported the data required to report on alerts. We can obviously also use this view to see which alerts require our attention too.
[ 191 ]
Tracking and Reporting
Custom reports
We have now accessed all the information we need to enable us to report, but if we want to provide a useful single snapshot to enable graphs and further analysis, then it is time to utilize a spreadsheet to create a summary of the information with useful statistics. I have placed a sample spreadsheet found at http://davidoverton.com/r.ashx?27 that could be a useful starting point.
If you examine the spreadsheet, you will see that the raw data is loaded into several tabs. If you are familiar with Excel, you can not only use the summary sheet, but also sort and filter the data in the tabs as needed.
[ 192 ]
Chapter 8
Reporting on overall PC management achievements
One very important aspect of pro-active management is to be reporting to the business the information on your management tasks. This covers both pro-active and reactive management. The areas we should report on are as follows: •
Size of estate, by group if appropriate
•
Hardware inventory
•
Software
•
°°
Inventory
°°
Updates approved and installed
Alerts °°
Malware
°°
Open issues
°°
Closed issues
°°
Remote assistance
We have already discussed gathering information for all of the above sections.
Summary
In this chapter, we looked at ensuring that we have exported and stored all information on the hardware and software utilized on the computers being managed. This enables us to audit information when required as well as to ensure our legal responsibilities are covered around licensing and maintenance. We have also examined the different types or reports available, all of which can be exported to enable us to put together our own management report on the activities across the estate. While we do have all the Windows Intune reports, these can be difficult to digest and examine if all kept separate; so I have shared a basic spreadsheet that I use to enable high level reporting and allow further analysis without going through the reports individually. In the next chapter, we will look at how we deal with the alerts that we have reported on here, including requests for assistance, dealing with computer health issues, and responding to malware threats.
[ 193 ]
Monitoring and Responding to Windows Intune Alerts So far we have examined the configuration of the computers with policies to control their behavior. As we manage these computers, they will report back to Windows Intune against those policies in the form of reporting and alerts. We have looked at the reporting, which provides a snapshot of the computer estate. In this chapter, we will examine the real-time nature of PC management as we explore the alerts that Windows Intune raises which require action on our part, exploring how we both monitor and respond to them. In the previous chapters, we have configured the computers to minimize the situations where alerts will be raised through good practices of updates, firewall, and anti-malware management. Problems will still arise with users' computers, whether this is a request for assistance, a computer that will not boot, or some other warning picked up by Windows Intune. These need to be categorized and responded to in a timely manner. Some can be closed and filed depending on circumstances, while others require a visit to the computer itself with other tools to further diagnose and resolve. In this chapter, we will discuss this in the following sections: •
General Windows Intune alerts
•
Malware alerts
•
Remote Assistance alerts
Monitoring and Responding to Windows Intune Alerts
General Windows Intune alerts
Windows Intune will raise an alert in a number of situations where we, as the administrators, need to either be aware of an event or respond directly to it. The alerts will appear in a number of the screens and reports in Windows Intune. Windows Intune has seven alert categories: •
Endpoint Protection
•
Monitoring
•
Notices
•
Policy
•
Remote Assistance
•
System
•
Updates
Some of these alerts require special attention and have their own section, while others can be generically dealt with. The two areas that need some special attention are the Endpoint Protection alerts relating to malware and remote assistance, as the actions taken here always need to be decisive. We have also already tackled the update alerts in the previous chapter. Before we examine alerts in more detail, I thought I should share a quick, but obvious, note. The reporting of alerts from the client computer to Windows Intune requires an Internet connection from the client computer, so we are unlikely to see an alert saying that the user's PC is having network trouble. However, if a computer has not checked in with Windows Intune for a while, we will see an alert for this from Windows Intune, pointing to a machine that has not been turned on for a while, or with problems! It is more likely that a user will contact us via other means if they are having a networking problem, but we should remember to tell users to do that in that situation rather than them requesting remote assistance and wondering why we don't respond!
Monitoring alerts
There are two ways to monitor alerts once they have been enabled and the notification has been completed. The two choices are to either look at the console and refresh, or wait for notifications to arrive via e-mail. The e-mail notifications look similar to the one in the following screenshot. Clicking the link takes us to the Windows Intune console.
[ 196 ]
Chapter 9
To view the alerts in the Windows Intune console, go to the Alerts workspace and go to All Alerts. We can choose which alerts are displayed by changing the Filters selection at the top of the screen. All the filters shown open alerts, except for the filter choice of Closed. The filter choice of None shows all open Critical, Warning, and Informational alerts.
[ 197 ]
Monitoring and Responding to Windows Intune Alerts
We can also view alerts specific to the category by selecting one of the items below All Alerts selection tree. For example, in the Monitoring category, we can see one alert at the moment:
Finally, we can view alerts that relate to a specific computer by looking at the Alerts tab in the Computers workspace.
[ 198 ]
Chapter 9
Responding and closing alerts
Once we have an alert to deal with, we need to respond in some way. By clicking on the alert, the details pane is displayed. Under the Recommended Actions, there will either be a link to Click here to take action or one to View Troubleshooting Information.
If we click the information link, a window will open that, depending on the problem and potential solution, will show either a link to the Windows Intune help file or a link to carry out the action if appropriate. In the following example, the alert is for malware and a link to information on the specific malware that was seen. We can see that the following information does not show us a specific action for malware. We will discuss how to respond to malware a little later in this chapter.
[ 199 ]
Monitoring and Responding to Windows Intune Alerts
Once we have resolved the alert, it needs to be closed to remove it from the console and to enable us to demonstrate that we have resolved an issue with computers that we manage. Windows Intune will not close the alert for us unless one of these criteria is met: •
Windows Intune can detect that the issues have been resolved
•
45 days have passed since the alert was opened
To manually close an alert, follow these steps, but be careful to close the right one. While we can re-activate a closed alert in Windows Intune, if the alert is closed by mistake then we may miss taking important action. 1. Open up the Windows Intune console and find the alert to close. We can select more than one alert if desired here.
2. Click Close Alert in the toolbar, or right-click on the alert and select Close Alert from the menu. We can also close an alert when we have opened it fully and are looking at the Alert Properties by clicking the Close This Alert link under Tasks.
[ 200 ]
Chapter 9
The automated closing of alerts, when an issue has been resolved, can be a little confusing as we see alert e-mails, but then they don't exist in the console. This is most common when malware and policy issues occur as Windows Intune can detect the resolution of these. It is always worth checking the closed alert log to ensure these do not require further action or highlight an underlying issue, such as network or security, that needs resolving. A good example of where we might see this is with the Unable to Update Policies alert which are generated when a user's computer is not in contact with Windows Intune. The alert e-mail looks similar to the following screenshot:
This is the type of alert that will be automatically closed once connectivity is resolved and the policies updated.
Malware alerts
Malware alerts fall into two broad categories; those that indicate a problem with the anti-malware software that installs as part of Windows Intune and those that indicate the anti-malware software has detected and responded to a malware threat. The alerts I have seen are: •
Anti-malware software issue °°
•
Some computers have protection warnings
Malware detection °° °°
Malware seen for first time Some computers have recently resolved malware [ 201 ]
Monitoring and Responding to Windows Intune Alerts
The first alert requires investigation to ensure the machine in question is properly protected, but something as simple as a user cancelling a full scan will generate this error. A quick call to the user or visit from a technician to look at the Windows Intune software will resolve this. This alert can automatically close if the situation is resolved. For the malware detection alerts, these need closer management. When a user first encounters malware they are prompted by Windows Intune to remove it.
At this point, the first alert will be sent. The user is prompted with a choice as to the action to take. If the malware Alert Status is considered to be Medium or Low, then the user may Allow the files to remain as the Recommended action. Once the user has made the choice, the second alert is sent stating that a recent malware issue has been resolved, whether the file was allowed to stay on the hard disk or not. The only time when a file should be allowed is when it is misevaluated as a virus. The best way to resolve this is to create an exception policy in Windows Intune specific to the computers and the program of filename. Once we are satisfied that the situation is correctly resolved, we can close the alert in Windows Intune if it does not do this itself.
Testing malware checks are working
To test that various aspects of an anti-malware system are working, it is vital that we do not use a live virus. Just as in the medical world, the IT world has a universally accepted virus file that does not cause harm and can be used for testing. This is simply a file that has the signature of a dummy virus, not a virus itself. This can be downloaded from EICAR at http://davidoverton.com/r.ashx?2O. Downloading any of these files should trigger Windows Intune Endpoint Protection or any other anti-malware solution. [ 202 ]
Chapter 9
Distributing this file is a little tricky as the download will be blocked by default by Windows Intune, as will copying the file, which means that disabling the malware protection is required to obtain the file.
Actions following malware instance
Once we know that a computer has had a malware incident, we need to gain confidence that the issue has been resolved. Through policy we are able to decide if a user can Allow a file, however, we may wish to take additional precautions. First, we need to identify the computers by opening the alert up by going to the Windows Intune console and selecting the Endpoint Protection in the Alert workspace.
If we click on the link shown as the Source, we will see the computers impacted.
[ 203 ]
Monitoring and Responding to Windows Intune Alerts
We can now remotely run a number of operations on the computer in question. For malware issues, select the computer or computers that we want to inspect and then select Remote Tasks from the toolbar, or right-click on the computers. Then select either Run a Full Malware Scan or Run a Quick Malware Scan.
We will see a confirmation dialog box for the request to run a scan for a short period of time before it disappears. We can check the progress by clicking on the Remote Tasks link in the bottom-right corner of the console which will show us the status, similar to those in the following screenshot:
Remote Assistance alerts
A Remote Assistance alert is generated when a user requests help from the Windows Intune Center by clicking the link under Microsoft Easy Assist.
[ 204 ]
Chapter 9
When the user clicks the link on their computer, the Microsoft Easy Assist changes to look as follows:
While there are many remote administration tools available for Windows the Microsoft Easy Assist tool has the following benefits: • • • •
• •
Secure connection through corporate firewalls providing users access to the Internet and websites Desktop sharing – the user requesting assistance can either show the support person the problem or hand control over completely Application Sharing – rather than share a whole desktop, just an application can be shared File transfers – we can upload and download files so scripts or exported data can be shared between the support person and the computer being supported Chat application – if we can't talk to the person being supported, we can still type in an instant messaging chat window Multiple person assistance – if the particular problem needs another person to assist or offer guidance, this is possible using the Easy Assist tool [ 205 ]
Monitoring and Responding to Windows Intune Alerts
Preparing to deliver support
However, before we can deliver support, it is important to ensure that the Microsoft Easy Assist application is loaded onto the support person's computer and that the user's computer is configured for optimal performance when support is being delivered.
Preparing the client computer for support
Windows Intune configures Microsoft Easy Assist to provide support, however, the configuration of User Account Control (UAC) can mean that every administrative task requires interaction from the user to approve the administrative application being started. To overcome this, search for uac in the start menu. We will see the option to Change User Account Control settings appear as the top result.
Click Change User Account Control settings to start the tool.
[ 206 ]
Chapter 9
Before we make any adjustments, note where this setting is on the client computer – it is normally at the second notch down. Now, lower this to the third notch down and press OK. This means the user's screen will not dim when the UAC dialogs appear, but it also means that we can accept these, which may be desirable. If the user does change this setting for us, we must change it back once we have completed the support session.
Preparing the support agent's computer to offer support
If the computer we are connecting from has Windows Intune installed, then we already have the client loaded. However, if it does not, we will need to install the Microsoft Easy Assist tool. To do this, go to http://davidoverton.com/r.ashx?28 and run the setup program. If Easy Assist is not installed correctly and we try to open a remote assistance session, then we will see the following dialog box from Windows:
Providing Assistance
There is a simple progression that describes the actual process of delivering assistance using Windows Intune. It will consist of the following steps: •
Windows Intune receives the request and creates an alert and sends e-mails
•
Support agent starts communicating with the user and a remote session is initiated
•
Support is provided and the remote session is terminated
•
The alert is closed [ 207 ]
Monitoring and Responding to Windows Intune Alerts
Receiving alert and responding
We are first aware of a remote assistance request through the e-mail notification. Follow the steps given to start the remote assistance: 1. Open the e-mail and click the link in it to open the Windows Intune console.
2. In the Windows Intune console, we will see an alert similar to the one in the following screenshot. Click the link Approve request and launch Remote Assistance to start the remote assistance process.
[ 208 ]
Chapter 9
3. When the windows opens up, click on the link Accept the remote assistance request.
4. This will open a web page that will create a launch.eas file. Open this file to start the session.
5. Once the Microsoft Easy Assist tool has started and connected through the server, we will be asked to provide our display name. Enter a Display Name that will be meaningful to the user we are connecting too. It should also distinguish us from other support agents as we may need further colleagues to join us in the shared session. Then press the Join button.
[ 209 ]
Monitoring and Responding to Windows Intune Alerts
6. We will start the Easy Assist Session tool on the support agent's console as shown in the following screenshot:
7. After a few seconds Easy Assist will continue on the user's desktop with a question as to whether they wish to share their desktop. We should advise them to click OK so that we can see what is on their desktop.
8. The user will see their desktop reformat itself for sharing, which will include turning off the Aero graphics that are part of Windows Vista and Windows 7. 9. The two way joining into the Microsoft Easy Assist support session is acknowledged with a dialog similar to the following screenshot:
[ 210 ]
Chapter 9
10. Finally, both users are shown in the Easy Assist Session window under participants.
Providing remote support
Now that we have access to the remote user's computer, we can manage it as if we were in front of it. We have the following tools available to us: •
Chatting
•
Shared Desktop - View the user's desktop while they are in control
•
Shared Desktop - Take control of the user's desktop and they can watch
•
File transfer between the two computers
•
Reboot the remote computer and continue session once logged in by the user
[ 211 ]
Monitoring and Responding to Windows Intune Alerts
Chat
There is nothing stopping us talking on the phone to the user who requested assistance, but if this is not available then we have a chat window that can be utilized. Type the text to send and press Send.
Shared Desktop
The desktop is shared when we can both enter the session and see the end user's desktop while they are using the computer. Initially, this is in a view-only mode, meaning that the support agent can watch, but not do anything. Frequently, it will be desirable for the support agent to take control and this can be delivered by either the support agent requesting it or the user offering it. To take control, follow the steps given: 1. In the Microsoft Easy Assist shared desktop tool, press the Request Control button.
2. The user will have to acknowledge that we are taking control. If they are happy for us to take control, they should press Yes. They can press Esc at any time to stop the control of their computer.
[ 212 ]
Chapter 9
3. The user will see the small toolbox on their screen that enables them to stop control at any time by pressing the Stop sharing button or pressing Esc.
File transfer
The file transfer facility is a temporary holding area that we can upload to and download files from during the session. The files are automatically removed once the session ends and the total file size that can be stored is 100MB. To transfer files to the holding area, follow these steps: 1. Press the button on the toolbar labeled Upload and download files.
2. Now press the Upload button. Pick the file to upload and press OK.
[ 213 ]
Monitoring and Responding to Windows Intune Alerts
3. We will now see the file in the File Transfer window.
4. Repeat this as required. Once the files have been uploaded, they can be downloaded on another machine in the session. To do this, follow these steps: 1. Select the files to be downloaded by putting a check mark in the box to the left of the filename.
2. Now press the Download button to download the files. 3. We will be asked to choose a folder for the files to be copied to. Find the right folder and press OK.
[ 214 ]
Chapter 9
4. The files will now transfer.
Rebooting the remote computer
The functionality to reboot the computer is really useful as not only does the computer reboot, but once the user logs back in, it will reconnect back to the same remote assistance session to enable further administrative activity. This is vital if a change requires a reboot mid-way through the process. To start the process, follow the steps given: 1. Right-click on the users name in the Participants list and select Request Reboot and Reconnect.
[ 215 ]
Monitoring and Responding to Windows Intune Alerts
2. We will be asked to confirm that we want to reboot the computer. Press OK to continue.
3. The user whose computer we are providing assistance to will now also be asked to confirm the restarting of their computer. If they agree, they also need to press OK on their computer.
4. We will now see confirmation that remote user has accepted the request to restart. Press OK to remove the dialog.
5. When the computer reboots, the user logs in and they will then see a message telling them that the computer is Attempting to reconnect to the Microsoft Easy Assist server. No additional credentials are required.
[ 216 ]
Chapter 9
6. Once the reconnection is complete, the support agent will receive confirmation that the user has joined the session. Press OK to close the notification.
7. The user will again have to confirm they are going to Share Desktop with us.
Closing the alert
Once we have finished providing the assistance to the user, we need to uninstall any utilities that were added to their computer and if appropriate, re-configure UAC to the pre-support level. This then leaves us with one final activity, which is to close the alert in Windows Intune.
[ 217 ]
Monitoring and Responding to Windows Intune Alerts
To do this, find the Remote Assistance Session Request in the Alerts workspace and select Close Alert in the toolbar.
Summary
In this chapter, we have examined the process of monitoring the alerts and responding with appropriate actions. These actions have included anti-malware checks as well as interacting with the users directly to understand their issues and helping them through using the Remote Assistance functionality. In the next chapter, we will look at how to use Microsoft DaRT to resolve more challenging issues that require deeper actions to fix issues, often ones that stop a computer booting, with a skilled engineer sitting at the computer to resolve these issues.
[ 218 ]
Resolve Problems Using Microsoft DaRT In this chapter, we will use the Microsoft Desktop and Recovery Toolset (DaRT) to diagnose and fix more complex computer support issues where Windows itself fails to boot or the removal of a component is not possible through remote access. DaRT itself has been described earlier in the book in terms of the tools and features it provides a user who has signed up for Microsoft Desktop Optimization Pack (MDOP). MDOP has a number of tools and capabilities that can be useful to an organization, however, in terms of resolving computer issues, DaRT is the relevant tool. In this chapter, we will cover the following points: •
Downloading MDOP
•
Installing DaRT
•
Building a DaRT CD
•
Using DaRT to resolve issues
Downloading MDOP To download MDOP, follow these steps:
1. Navigate in a web browser to https://mocp.microsoftonline.com. Sign in and select the Subscription tab.
Resolve Problems Using Microsoft DaRT
2. Find the row where the Service Name is Windows Intune and select the Actions of Download Windows and/or MDOP Software. Press Go to continue.
3. We will see a list of software downloads. Each edition of MDOP supports a different version of Windows; however, the MDOP install often has several versions of DaRT in it. For example, the Microsoft Desktop Optimization Pack for Software Assurance 2011 contains DaRT 6.5 which supports Windows 7 as well as DaRT 6.0 and 5.0 for Windows Vista, XP, and 2000 support. Select the version appropriate for the operating system we need to support and then press Download.
[ 220 ]
Chapter 10
4. Select the language and then press the Download button under Download Manager. While you can download without using the Download Manager, due to the size of the download, the Download Manager will avoid any issues due to connectivity issues.
5. If pop-up windows are not enabled, then we will be prompted to enable pop ups and try again. If this is the case, press OK and then start the download again.
[ 221 ]
Resolve Problems Using Microsoft DaRT
6. The Download Manager window will show, however, we may now need to install the Active-X control. Once this is completed, we may need to close the window and start the download again.
7. You will now be asked to pick a location for the download to be saved into. Pick a folder and press OK. 8. The download will now start using the Download Manager as shown in the following screenshot:
Installing DaRT
Once you have downloaded the MDOP DVD image, this needs to be burnt to a DVD or mounted via tools such as Virtual CloneDrive from slysoft.com. Since Windows 7 can burn the DVD image file without additional software to DVD, I will discuss how to do this here. 1. Find the file you have just downloaded and right-click the filename.
[ 222 ]
Chapter 10
2. Select Burn disc image from the menu. 3. Insert a DVD into the DVD drive. 4. To ensure the quality of the disc, select Verify disc after burning.
5. Press Burn to start burning the DVD. We are now able to install the DaRT utilities by inserting the DVD back into the drive. Follow these steps to install the DaRT: 1. The MDOP window will appear similar to the following screenshot:
[ 223 ]
Resolve Problems Using Microsoft DaRT
2. We now need to install either the 32-bit or 64-bit version of DaRT depending on the version of Windows that you are installing the toolset into. Select the appropriate Install DaRT 6.5 link and click it. If you scroll down, you will see the DaRT build for supporting earlier versions of Windows.
3. We can also see the documentation and release notes links on this page here too and I would strongly encourage looking at them for much greater detail which I will provide here. 4. Once the installer starts, press Next to continue.
5. You will now have to accept the End User License Agreement. Assuming you do agree, press the I Agree button.
[ 224 ]
Chapter 10
6. Change the installation folder if desired and then press Next. Now, select the Complete installation option and then press Next.
7. Press Install to start the installation. If you are prompted with a UAC prompt, allow the installation to continue.
[ 225 ]
Resolve Problems Using Microsoft DaRT
8. The DaRT is installed onto the administrator's computer.
Building a DaRT CD
The DaRT is now installed on the administrator's computer. There are two tools installed; the Crash Analyzer Wizard that will help diagnose the memory dump files when a computer blue screens, and the ERD Commander Boot Media Wizard that builds the CD/DVD that is used to boot a problem user's computer. Since we want to use the toolset on a problem computer, we will use the ERD tool. You will also need your Windows 7 DVD that matches the same processor architecture as the version of Windows you are using. This means a 64-bit DVD, if you are running a 64-bit version of Windows on the computer that is building the CD/DVD. Once you have your Windows DVD and are ready to build the recover toolset, follow these steps: 1. Run the ERD Commander Boot Media Wizard program from the start menu. 2. You will be presented with a UAC prompt, we have to click the Yes button to proceed with the tool. 3. Press Next to move to the next screen.
[ 226 ]
Chapter 10
4. Press the Browse button to select the location of the Windows DVD. For example, if your DVD is E: and we have the Windows 7 DVD in there, selecting E:\ here is the right answer.
5. Press Next to extract the relevant files to your hard disk.
6. If the DVD does not have the right processor architecture, you will see this error. If you see this error, press OK to continue, insert the correct DVD and press Next again. If you wish to produce a 64-bit and 32-bit solution, you will need both a 64-bit and 32-bit Windows DVD and a computer running 32-bit and 64-bit Windows to produce the CD.
[ 227 ]
Resolve Problems Using Microsoft DaRT
7. You will be asked to choose the tools to be installed. By default, all tools are included. To remove a tool press the Remove button. Once the tools desired are selected, press Next.
8. For the Crash Analyzer Wizard to work, you will be asked for the location of the Debugging Tools for Windows, either on your system or the system you are installing. Since it is unwise to assume they will be on the system being debugged, either download the tools by going to http://go.microsoft. com/fwlink/?LinkId=99934 or if you already have them installed, press the Browse button to locate them. If you download the tools, you will still need to browse to the correct location.
[ 228 ]
Chapter 10
9. For the anti-malware tools to contain the latest updates, select Yes, download the latest definitions (Recommended) and then press Next.
10. We can add additional drivers if required to the image for specific network or disk hardware. If this is required, press Add Device and browse to the location of the .inf file. Once you have completed this, press Next.
[ 229 ]
Resolve Problems Using Microsoft DaRT
11. Once all the files are processed, we can now see all the files that will be copied to the CD. If there are additional programs or files to copy, press the Show Files button and add them through Windows Explorer. Once you have completed this, press Next.
12. Finally, the ISO CD disk image is ready to be created. Confirm the filename and press Next.
13. Once the ISO image is completed, we can optionally burn the image directly to a CD. If you wish to do so, tick the box to Burn the image and press Next. If you do not wish to burn a CD now, just press Next.
[ 230 ]
Chapter 10
14. Once the process is complete, press Finish to exit the ERD Commander Boot Media Wizard.
Using DaRT to resolve issues
Now that we have an ERD disk, we can boot this to repair a PC. In this version of DaRT, this all has to be carried out by the person in front of the computer. In future versions of DaRT, there will be limited remote capability which means that some of this can be delivered in a remote environment.
[ 231 ]
Resolve Problems Using Microsoft DaRT
When we boot a computer with the DaRT CD, we are asked a number of basic configuration questions before you can start. They are as follows: 1. The first question is about network initialization. Since we are likely to be using network functionality, select Yes.
2. We are now given the choice as to whether the drive letters on the system we are repairing should be made to match the drive mappings when the target operating system is booted. Again, select Yes.
3. Next, we need to choose the keyboard layout. You should set this to match the layout of your keyboard. For example, if you are in the UK, choose United Kingdom and then press Next.
[ 232 ]
Chapter 10
4 Finally, we have to choose the operating system we are fixing. Remember that this needs to match the DaRT operating system version (such as Windows XP, Vista, or Windows 7, and 32-bit or 64-bit). If you have multiple versions of Windows on the hard disk, select the appropriate one and press Next.
5. The System Recovery Options are now shown. These are the same options that are shown when booting from a Windows 7 installation DVD, except for the last option. Select the Microsoft Diagnostics and Recovery Toolkit.
[ 233 ]
Resolve Problems Using Microsoft DaRT
Now, the DaRT environment is loaded and we can see there are 15 options for us to choose from.
Since many of the tools are self-explanatory, we will examine those which provide less familiar functionality. They are: •
Locksmith
•
Crash Analyzer
•
Hotfix Uninstaller
•
Standalone System Sweeper
Locksmith
The Locksmith tool enables us to change the password of any user of the system. If a user has encrypted file stores, these may not be accessible after the password is changed. Follow this short process to change a password: 1. Select Locksmith from the main DaRT menu. 2. We can see the welcome screen. Press Next to proceed.
[ 234 ]
Chapter 10
3. Choose the Account from the list of accounts and then type in the desired password in the New Password and the Confirm Password boxes. Then press Next.
4. Press Finish to return to the DaRT main menu.
Crash Analyzer
The Crash Analyzer is used to work out why a system generates blue screens of death. Since many systems are set to reboot after such a failure, the user may simply see random reboots. If more detailed crash dumps are required, turn on kernel level crash dumps. If we need to do this via the registry, look at http://davidoverton. com/r.ashx?2A. We can use the ERD Registry Editor from the DaRT main menu to do this if you cannot boot the computer to set this option via the graphical interface. One other item of note, if a computer crashes at random moments and the crash report keeps showing different errors, run the memory checker, as this type of random failure is often attributed to bad memory.
[ 235 ]
Resolve Problems Using Microsoft DaRT
To examine a crash dump, follow this process: 1. Start the Crash Analyzer from the main menu. You will see the welcome screen. While you can leave the Automatically configure box ticked, we will examine searching for and selecting the crash dump file, so remove the check mark from the box and then press Next.
2. Since we built the debug tools into the bootable disk, the correct directory for the tools should be X:\windows\system32\DebugTools. This should be prepopulated, so press Next.
3. The Crash Analyzer will require debug information to be available. While we can change where these will be stored, such as onto a USB key, by default, leave the settings as they are and then press Next.
[ 236 ]
Chapter 10
4. We can now browse to find the crash dump. For a system crash, this will normally be found in the C:\windows\MEMORY.DMP file. If this is not the case, press the Browse button to locate the file and then press Next. If there is no dump file then the crash is either being caused by the hard disk controller driver or the settings to create a crash dump are not set. If it is the hard disk controller driver, check that the bios settings have not been change. If the crash dumps are not configured to be created, enable them in the registry and reboot the computer to reproduce the crash.
[ 237 ]
Resolve Problems Using Microsoft DaRT
5. The system will analyze the dump file. It may download the symbol files from the Internet and store them on the hard disk as per the settings in step 3.
6. Once the analysis is complete, you can either view the Details by pressing the button or just examine the summary. Unless you are familiar with the Microsoft debugging software, the details may be overwhelming, but they can be useful to a debug expert to further analyze the problem. If a specific file or driver is at fault, then you now know what to search for on the Internet to find a replacement. Remember that you can modify hardware and drivers using the DaRT toolset. Once you have the information required, press Next:
[ 238 ]
Chapter 10
7. Finally, the process is finished and we can exit the tool using the Finish button.
Hotfix Uninstaller
The Hotfix Uninstaller enables you to remove an update from Microsoft that you believe is the cause of a computer malfunction. This is something that should not be undertaken lightly and preferably only once a full backup has been taken. To complete the task, follow these steps: 1. Start the tool by selecting Hotfix Uninstall from the DaRT main menu. 2. To continue past the welcome screen, press Next. 3. Select the hotfix that you want to uninstall and put a tick in the box. It is recommended that you choose the latest fix first and remove only one before rebooting and seeing if the same issue occurs. Once you have selected the hotfix or update to remove, press Next to continue.
[ 239 ]
Resolve Problems Using Microsoft DaRT
4. The system may take some time processing the removal and then it will show the status. If the status is not Succeeded, then you will need to do further analysis, and perhaps a call to Microsoft support would be a sensible step. Press Next to continue.
5. Finally, press Finish to finish the process. You can now reboot the system to see if the problem has been resolved.
Standalone System Sweeper
The final tool that we are going to examine is the anti-malware tool. This can detect and remove a number of malicious software items on the computer in question, without the worry that the tool is being interfered with by an infected host operating system. This is something that is best delivered with an Internet connection to enable the latest definition file updates to be applied. To scan a system, follow these steps: 1. Start the Standalone System Sweeper from the DaRT main menu. 2. We are prompted to update the definitions. We can ignore this and press Scan immediately, however, I would strongly recommend pressing the Check for updates now button.
[ 240 ]
Chapter 10
3. Unless the latest updates have been manually downloaded, press Download to get these from the Internet now.
4. Press the Scan button to start a scan. As with all full system scans, this will take a good 10-20 minutes to complete, depending of the number of files on the computer and the hard disk speed.
[ 241 ]
Resolve Problems Using Microsoft DaRT
5. Once the scan is complete, you will either need to take specific action to clean files or it will report no errors.
6. We can now close the tool by pressing the cross in the top right corner of the window to carry out more tasks or finish our repair.
Summary
In this chapter, we have we have looked at how DaRT, part of MDOP, can be used to resolve a number of deeper and more challenging issues. DaRT requires several preparation steps before it can be used, including licensing MDOP, downloading, and building a CD before it can be used to resolve a problem. There are 14 tools, plus help as part of the tool and we have examined four extremely useful tools that are not always found on a PC to resolve password issues in a supported manner. We have examined crash dumps to understand what is behind a computer crash as well as learned how to remove hotfixes that may be preventing a computer from booting. Finally, we ran the Microsoft anti-malware tools to ensure a PC is free from unwanted malicious software. In the next chapter, we will download and install Windows 7 Enterprise Edition onto computers running older versions of Windows and look in detail about using Windows XP as a starting point for these upgrades.
[ 242 ]
Deploying Windows 7 Enterprise Edition In this chapter, we will look at the process of moving users from a previous edition of Windows 7 to the Windows 7 Enterprise Edition that users are entitled to through the use of Windows Intune. The benefits of Windows 7 were discussed earlier in the book, so I will not be repeating them here. Before we can progress to Windows 7, we need to ensure the computers are capable of running Windows 7 and that the applications will continue to function. The greater the number of applications and the older they are, the higher the risk that one or more applications will need updating or replacing. Having said that, many utilities that people use with Windows XP are no longer required, such as CD-ROM and DVD burning software or specialist disk defragmentation tools. If the user has Windows XP, there is no direct "upgrade" available, so the process of deploying consists of backing up the user's settings, installing a clean copy of Windows 7, and then installing their software programs back onto the computer. Even if moving from Windows Vista or from Windows 7 Professional Edition, this is often the cleanest process to follow. For this reason, I will start with a version of Windows XP as my baseline and the steps for other versions are similar to this. In this chapter, we will cover the following: • • • • • • •
Downloading Windows 7 Enterprise Edition Checking pre-requisites for Windows 7 Backing up settings for migration Installing Windows 7 Enterprise Edition Restoring user settings and installing applications Updating Windows Intune Considering tools for scale deployment of Windows 7
Deploying Windows 7 Enterprise Edition
Downloading Windows 7 Enterprise Edition
Before we can install Windows 7 Enterprise Edition, we need to download the ISO of the operating system. To do this, follow these steps: 1. Log into the Microsoft Online Customer Portal by going to https://mocp.microsoftonline.com. 2. Select Manage subscriptions from the Actions menu on the right-hand side of the portal.
3. Find Windows Intune under the list of Service Name column and then select the Download Windows and/or MDOP software option under the Actions column. Press Go to continue.
4. Several products will be displayed. Find Windows 7 Enterprise and press View to see the Product Key for the install. Make a note of this as it will be needed.
[ 244 ]
Chapter 11
5. Press Download and the Download Product screen will appear. Choose your installation language and whether we want a 32 bit or 64 bit installation under Operating system type drop-down menu.
6. Put a tick in the I Accept box to accept the legal statement. If you do not agree, then do not proceed! The two download options will be enabled. If they do not, then it means that one of the selection boxes earlier in the form has not been completed.
[ 245 ]
Deploying Windows 7 Enterprise Edition
7. We have a choice on how to download the ISO file. Given its size we should use the Download Manager to ensure a reliable non-corrupt version of the file. Click on Download under the Download Manager title to start the process.
8. We will be prompted with a security prompt from Internet Explorer. Press Allow and then choose a location on your local disk or a file server to store the ISO image. Once this is complete, the download will start and will take several minutes to complete, depending on your Internet connection speed.
9. Once the ISO is downloaded, the Status will change from Downloading to Finished. 10. We can burn to a DVD or install onto a USB stick. For the Microsoft software to do this, go to http://davidoverton.com/r.ashx?2C and install the software. Full instructions are provided on the website and it is a simple process. We now have a bootable DVD or USB stick that we can use to install Windows 7 Enterprise Edition and the product key to do this with. The product key will activate with the Microsoft servers on the Internet.
[ 246 ]
Chapter 11
Checking pre-requisites for Windows 7
The hardware requirements for Windows 7 are higher than those for Windows XP, so older computers may need hardware upgrades before we can proceed. The easiest way to see if a computer meets all the requirements is to run an automated tool from Microsoft. This can be downloaded from http://davidoverton.com/r.ashx?2B. Plug in all the devices that the user will want to use with Windows 7. This should include printers and USB devices, as older ones may not work with Windows 7 and the advisor can only test for the hardware and software installed. To use the advisor, follow these steps: 1. Install the Windows 7 Advisor Tool and start it. 2. Once all your devices are installed, press the Start check button.
3. The tool will display Checking compatibility for several minutes before displaying the list of issues that need addressing and items that are fine. We can choose to consider a 32-bit report or 64-bit report depending on the version of Windows that could be installed on the device by changing the tabs at the top a shown in the following screenshot. 4. First look at the system requirements. In the following screenshot, we can see that the computer will need a RAM upgrade, ideally to 2 GB of RAM and 1 GB as a minimum. There is also a warning about the graphics card, which is suggesting an upgrade to enable the best user interface experience.
[ 247 ]
Deploying Windows 7 Enterprise Edition
We can ignore the Outlook Express warning as this can be replaced with Windows Live Mail, but it is best to do the e-mail migration before the upgrade. Each item will need to be examined and the appropriate solution put in place before a migration can be successful.
5. We now examine the programs that are currently installed. While most are fine, there is a warning about the Microsoft .Net Framework 1.1. If this is required for an application, then we should consider Windows XP Mode as noted at the bottom of the report.
[ 248 ]
Chapter 11
6. We can now choose to save the report by pressing the Save Report button, and then press the Close button to close the advisor. Now that we have the report, we can ensure that each computer is adequately prepared for Windows 7. Resolving each blocking issue and making sensible decisions about computer hardware is vital before we can progress to the installation.
Backing up settings for migration
We need to create a secure backup of the settings in the previous version of Windows. This can be used to transfer the user to a new computer or for Windows 7 when installed on the same computer. To do this, follow these steps: 1. Insert the Windows DVD or USB stick. Navigate to \support\migwiz and find the file migsetup.exe. This is the Windows Easy Transfer wizard. Start the program.
2. We will see the welcome screen for the wizard. Press Next to continue through the wizard.
[ 249 ]
Deploying Windows 7 Enterprise Edition
3. Unless we have two machines set side-by-side that we are migrating between, select to transfer using An external hard disk or USB flash drive. Ensure the drive is connected and recognized by the computer before continuing.
4. We need to tell the wizard that we are on the old computer—the one running Windows XP. Do this by pressing the This is my old computer option.
[ 250 ]
Chapter 11
5. We can now see a selection of users that can be migrated as well as any shared resource. Ensure that each user we want to transfer has a tick against their name.
6. If there are any additional files that you want to transfer, press the Customize link, and then the Advanced option at the bottom of the list as shown in the following screenshot:
[ 251 ]
Deploying Windows 7 Enterprise Edition
7. Select any additional files that are required. In this example, I have a folder called Other Stuff that has critical files in it. Ensure that the box to the left of the folder name has a tick in it. Then press Save to return to the user list and then press Next once completed.
8. Since the backup will have the user's files, settings, and any confidential data in them, type a password and then press Save.
9. We now have to choose where the user's files and settings will be saved. Choose a location, such as an external USB drive to save the files to. Once this is done, press Save and the process will start.
[ 252 ]
Chapter 11
10. Once all the files and settings have been successfully completed, press Next on this and the subsequent screens to exit the wizard.
We now have the vital user settings required to create the user on a new installation of Windows 7 Enterprise Edition.
Installing Windows 7 Enterprise Edition
We are now ready to install Windows 7. Close the explorer window if it is still open and start the Windows 7 setup program. I'm assuming that this is not the first time that you have installed Windows 7, so I am going to cover the actual installation process very lightly. If we need to install additional disk or network drivers or wish to upgrade the hard drive in the user's computer while embarking on this process, then you can and should, but I will not cover those details.
[ 253 ]
Deploying Windows 7 Enterprise Edition
To install Windows 7 back onto the computer that was running Windows XP, follow these steps: 1. When the Windows 7 installer has started, press Install now to start the process.
2. Since important updates to Windows 7 setup may have been made since the version of Windows that we downloaded was created, press the Go online button to get latest updates.
3. Accept the license agreement by checking on the I accept the license terms checkbox and then press Next.
[ 254 ]
Chapter 11
4. We cannot upgrade Windows XP, so we have to select Custom (advanced).
[ 255 ]
Deploying Windows 7 Enterprise Edition
5. Select the disk partition that we wish to install on. If there is not enough space, we will see an error. Then press Next to continue.
6. We will see a warning informing us that the previous version of Windows will be stored in C:\Windows.old. Press OK to continue.
7. Windows 7 will now install. The computer will reboot several times through this process. It is time to have a cup of tea!
[ 256 ]
Chapter 11
8. Windows 7's next prompt to us will be asking for the Country or region and associated information. Set this information for the user and then press Next.
9. Now type the name of the primary user. This user will be created as the administrator, so if that is not appropriate, create an administrative user here. We can also choose the name of the computer. I always add the operating system to the computer name. While this makes my life a little easier, users who share files or remotely access their machine may find this inconvenient as their computer name has just changed!
[ 257 ]
Deploying Windows 7 Enterprise Edition
Press Next when completed.
10. Create the password for the user here along with a hint. We will need the user to reset this to something only known to them once they get the computer back. Press Next once completed.
11. Select the default Windows update settings for the computer. It will be necessary to run Windows update several times, and once Windows Intune is loaded onto the computer again, it will override these settings. [ 258 ]
Chapter 11
12. Set the right date and time. This should simply be a case of choosing the Time Zone and then pressing Next.
[ 259 ]
Deploying Windows 7 Enterprise Edition
13. We need to let Windows 7 know that this computer is connected to the work network, assuming that it is. This will impact the firewall settings, so setting this correctly is important.
14. Windows 7 will now finalize the installation and then log us in as a user. Windows 7 Enterprise Edition is installed and we can now restore the user's files and settings and then join the computer into the Windows Intune management list.
Restoring user settings and installing applications
We now need to make this look and feel like the user's computer again. This is done by using Windows Easy Transfer wizard again. Follow these steps to complete the process: 1. Go to the Start menu and search for Easy Transfer. We will see Windows Easy Transfer show on the list of programs. Start this. 2. We will again see the welcome screen. Press Next to pass through this as before. 3. As previously, select the same transfer mechanism, such as An external hard disk or USB flash drive. [ 260 ]
Chapter 11
4. We are now asked if this computer is the new or old one. Select This is my new computer.
5. We need to confirm that the settings have already been saved to the storage device, so select Yes.
6. We need to find the file that we previously created. Navigate to the location and select the file, and then press Open.
[ 261 ]
Deploying Windows 7 Enterprise Edition
7. Enter the password and press Next.
8. We can modify the information that will be restored, although I rarely need to. Once we are happy, press Transfer.
9. Once the process is complete, we can see what was transferred as well as the programs that we need to install. Select the See a list of programs you might want to install on your new computer option.
[ 262 ]
Chapter 11
10. We need to work through the list of programs that need to be installed. Once we have restored the functionality of the computer, close this window and press the Close button.
[ 263 ]
Deploying Windows 7 Enterprise Edition
11. The last part of the process is to reboot the computer. Do this by pressing the Restart now button.
It is worth remembering that if we installed Windows 7 onto the same hard disk that Windows XP was originally installed without formatting, then the user's files and the old copy of Windows XP can be found at C:\windows.old. Once we are sure there is no need of these files, they should be removed using the Disk Cleanup tool that can be found by searching in the Start menu. Press the Clean up system files button and the tool will restart. Once this has completed, we can select the Previous Windows installation(s) option and press OK to remove the files from the hard disk.
Pressing OK will start the process. Note that there is no way to undo this, so only complete this step once you are sure that you need nothing from there. Now that the user's settings and files are back in place, we need to add this computer back into the computers that are managed by Windows Intune. [ 264 ]
Chapter 11
Updating Windows Intune
There are two steps that we need to undertake to manage this computer through Windows Intune. The first is to remove the Windows XP computer from the Windows Intune console, freeing up the license, and stopping any alerts about the computer not communicating with Windows Intune. The second is to add the computer that we have installed Windows 7 on back into Windows Intune as a new computer.
Removing the computer from Windows Intune
Before we add the new computer back into Windows Intune, we need to gather some Windows Intune data on the old computer and then retire it. If you have managed your Windows Intune membership closely, you will not have spare computers in the system, which means that the old computer will have to be removed before the new one is added to keep compliant with your licensing. To do this, follow these steps: 1. Navigate to https://manage.microsoft.com and sign in. 2. Navigate to the All Computers view in the Computers workspace and then select the computer to remove.
3. Select the Edit Group Membership task from the Tasks pane.
[ 265 ]
Deploying Windows 7 Enterprise Edition
4. Make a note of the groups that the computer belongs to, and then press Cancel.
5. While the Easy Transfer wizard has a view of software from the old machine, Windows Intune also provides the Software workspace and it is worth collecting this information before it is lost when the machine is retired. To do this, select the Software view from the tabs along the top of the Computer Properties panel.
[ 266 ]
Chapter 11
6. It is possible to export this information and I would recommend this. Use the Export icon to save this information. 7. We are now ready to remove the computer from Windows Intune. Press the Retire link in the Tasks pane.
8. We are prompted to confirm that we want to retire the computer. Check that the correct computer has been selected and if so, press the Retire Computer button to confirm.
The computer is now removed from Windows Intune management and Windows Intune is ready to have the computer with the new operating system added to the managed computers.
Installing the Windows Intune tools
This process is no different to the normal Windows Intune process. We use the same download to install the software and register with Windows Intune. [ 267 ]
Deploying Windows 7 Enterprise Edition
Once the computer is showing in the Unassigned Computers list in Windows Intune, we can update the group membership to match, where appropriate, the computer that it has replaced. If any of the group memberships relates to Windows XP being installed on it, obviously do not add it back into those groups.
Considering tools for scale deployment of Windows 7
We have migrated from Windows XP to Windows 7 Enterprise Edition using a very manual process. If you are upgrading enough computers, then there are tools that are excellent at streamlining the process; although the benefits are only realised when more than 100 computers are being migrated. We will not be exploring any of these tools in great detail, but I will explain how they can assist in the migration process. These tools are: •
Microsoft Assessment and Planning (MAP) toolkit
•
Microsoft Deployment toolkit
Both of these tools can offer significantly greater value than just migrating from Windows XP to Windows 7.
Microsoft Assessment and Planning (MAP) toolkit The MAP toolkit performs three key tasks for you: •
Inventory assessment of your computing estate, including operating system, hypervisors, databases, and web browsers
•
Analysis of the hardware and software in this environment and its ability to operate in the new environment (Windows 7 in this case)
•
Reporting the state of the environment and usage of software, including compliance
As we can see, this is a significant tool and one that requires deep knowledge to implement. For further details, go to http://davidoverton.com/r.ashx?2D.
[ 268 ]
Chapter 11
Microsoft Deployment toolkit
The Microsoft Deployment toolkit provides a centrally managed desktop deployment tool for Windows 7 and Office 2010, amongst others. The tool uses an on-premise installation of System Center as part of the solution for "zero-touch" deployments or a Lite Touch installation, where the majority of the work is delivered by the tool. For further details, go to http://davidoverton.com/r.ashx?2E.
Summary
In this chapter, we have collected the files and settings from a Windows XP environment and after installing Windows 7, restored that information. We have then updated Windows Intune to manage the new operating system so we can continue to provide excellent management services. Finally, I have pointed out some "scale" tools to help with large scale deployments of Windows 7. In the next chapter, we will look at other Microsoft products and how they interact with a computer running Windows Intune.
[ 269 ]
Integration with Existing Microsoft Products Microsoft has an array of products that are commonly associated with Windows desktops and their management. Some work well with Windows Intune, such as Office 365 and Windows Server 2008 R2, some can cooperate, and others do not work well together as they are trying to achieve the same goals as Windows Intune. In this chapter, we will discuss which Microsoft products mix well with Windows Intune and which to avoid. The more complex an organization, the more likely it is that they will have products that overlap or clash with Windows Intune. This is not because of bad design, but because in larger organizations, Windows Intune is likely to be used to manage a subset of the computers where it is best suited, and these other technologies will be used elsewhere in the business. To this end, this is about products mixed together and their impact on an individual computer, not their impact across an organization using all the products to manage and deliver services to different groups of computers. In this chapter, we will cover the following: •
Typical computing scenarios
•
Office 365 and on-premise SharePoint and Exchange
•
System Center
•
On-premise Windows Server
•
Windows Small Business Server
•
Windows Home Server
•
On-premise versus cloud solutions summary
•
Mixing on-premise and cloud solutions
•
Anti-malware products
Integration with Existing Microsoft Products
Typical computing scenarios
The typical computing scenarios that relates to a desktop user are made up of three areas: •
Desktop environment
•
Management tools
•
Services to enable productivity and collaboration
These technologies fit together as shown in the following diagram:
The technologies are not mutually exclusive or exhaustive, but are indicative of those most businesses would use. The Management and Services shown on the right-hand side of the diagram could be replaced with Windows Small Business Server 2011 for smaller organizations and we shall look at that as a specific scenario. These technologies can be delivered on premise or in the cloud as the diagram suggests. There are numerous reasons why we may pick one over the other, including flexibility, physical location, security, and payment profile with most cloud services being subscription based.
Desktop environment
The desktop environment in the Microsoft world consists of Windows 7, Office 2010, and any related tools to enable the management of that desktop. There will be a number of additional applications installed on the desktop to connect to all other services. Some will be provided by Microsoft and many might not be. [ 272 ]
Chapter 12
There should always be anti-malware tools on the computer too, whether they are provided by Microsoft or not. For small businesses, Microsoft Security Essentials is free for up to 10 computers in the organization and can deliver the same or better anti-malware capabilities as many charged products. Security Essentials does not have the centralized management ability that other products deliver, including Windows Intune. Windows Intune delivers Windows 7 Enterprise Edition, which is not a benefit of any of the other products discussed later in the chapter, although purchasing Windows Intune simply for Windows 7 does not make sense. Windows Intune will work with previous versions of Windows too, so a solution could be delivered with Windows XP or Windows Vista, although the older operating systems will need upgrading eventually, ideally to Windows 7 as provided by Windows Intune.
Management tools
The on-premise management tools are provided by two areas from Microsoft. They are Windows Server 2008 R2 with Group Policy and Active Directory being the most obvious, and then System Center, which is a dedicated system management platform. These both reside on-premise and are operated by the business. As an alternative to the on-premise management tools, we have Windows Intune. This provides some of the technology and capabilities from both of these products to deliver its service as well as having some components that are unique to Windows Intune itself. Both technologies manage access to Windows Updates for Microsoft product updates, although the actual delivery can be from a Windows server when using the on-premise technology.
Services to enable productivity and collaboration
The final part of the scenario is the Microsoft productivity services. For most users, this means Microsoft Office Outlook connected to an Exchange Server for e-mail, calendar, and contact management, and the use of a SharePoint site for collaboration and web applications. These can be provided on-premise as separate servers or with Windows Small Business Server as a basis for these.
[ 273 ]
Integration with Existing Microsoft Products
There are other products that are becoming more prevalent in this, including Microsoft Lync which provides instant messaging, presence (being able to tell if someone is available, busy, away, or not to be disturbed), group conferencing, webinars, and voice communications and management. The cloud-based alternative is Office 365, which is hosted by Microsoft. A number of hosting companies also offer similar services, often with greater customization and flexibility than that currently offered by Microsoft.
Office 365 and on-premise SharePoint and Exchange
Office 365 and the on-premise versions of Exchange 2010 and SharePoint provide very similar functionality, with Office 365 being a Microsoft hosted version of the same product. Office 365 also can include the Office WebApps (Word, Excel, PowerPoint, and OneNote) and Lync (instant messenger and online meetings) as well as these being available to install on-premise as well. Information on Office 365 can be found at http://www.office365.com. With Office 365, the amount of customization and integration with other products is restricted versus the on-premise products; however, the cost of running a standardized service may be much lower with Office 365 as this includes both the software, maintenance, and upgrades in the price. Either solution works equally well with Windows Intune; however, since we have opted for a subscription business model for desktop management with Windows Intune, opting for a subscription business model for these other services can make sense to ensure your IT services are delivered in a predictable way. Management of an Office 365 and Windows Intune subscription is delivered via the same web interface, the Microsoft Online Customer Portal (MOCP).
System Center
System Center is the Microsoft umbrella brand for its management products. The tools behind Windows Intune are from System Center, so there is definitely an overlap. Windows Intune is a small subset of the functionality provided by System Center. System Center has not just the capability to manage and secure the desktop, but also back it up, deploy applications, and much more. System Center also manages all other Microsoft products, so it really does cover a much bigger target area than just the desktop.
[ 274 ]
Chapter 12
The only time when Windows Intune and System Center being mixed together makes sense is when we are managing desktops that are not connected to the corporate domain or do not have access the corporate network. If this is not the case, it is unlikely we will mix these products on the same computer. More information on System Center can be found at http://davidoverton.com/r.ashx?2K. While Windows Intune is strictly aimed at policy and update management of Windows desktop computers, System Center offers a much broader range of capabilities. It is designed to deliver management of Windows client and server solutions as well as non-Windows based technology. System Center also goes beyond the functionality sphere offered by Windows Intune with products such as Data Protection Manager that enables snapshot backup technology of your important files. If you want to use Windows Intune and a good backup technology and you are a business with less than 25 computers, then Windows SBS 2011 Essentials in an excellent product that offers this functionality as an alternative to System Center and has a much lower level of overlap with Windows Intune. System Center Service Manager provides fantastic management of the whole suite to deliver IT Service Management. This again delivers significantly more than the functionality of Windows Intune and again can supplement it or replace it. Overall, as has been said before, if you are after a deep, highly modular, and customizable solution for managing a broad range of devices with deep reporting and protection technologies, then System Center is for you. If this is your first step towards desktop management, then Windows Intune will deliver an excellent solution.
On-premise Windows Server
Windows Server 2008 R2 is the current version of Windows Server with the next edition being expected in 2012 or 2013. When connected with a desktop user, the typical functionality we might expect to deliver which has any overlap with Windows Intune is as follows: •
Identity management with Active Directory
•
Group Policy
•
Update management with Windows Software Update Services
Windows Server can deliver many other benefits to the user, including additional security management, file storage, and web serving, but these are more about services the user may use and have very little overlap with Windows Intune. [ 275 ]
Integration with Existing Microsoft Products
One very important difference between an on-premise based solution using a server and Windows Intune is the need to manage the server and all the tools. Windows Intune provides this functionality without you having to manage it, while Windows Server, Small Business Server, and Windows Home Server all require a server on premise.
Identity management with Active Directory
Active Directory (AD) launched as part of Windows 2000 and has become the most common mechanism for managing users, the groups they belong to, and their permission to access resources. Many applications use the information in AD to manage their own permissions too, so it can be a critical part of a solution. Windows Intune does have group management; however, the other functionality is not provided by Windows Intune today and, therefore, it is very common to require both solutions in a business. Today, there is no integration between the AD users and groups and those in Windows Intune, which could lead to some complexity if both products are being used to manage users and computers. If computer management is delivered using Windows Intune, which is device based, and user and application management is managed by AD, then those complexities largely disappear. Also, since AD includes the user sign-in and network permission, most organizations will use Windows Servers with AD as well as Windows Intune unless network identity and access to local network file stores is not required.
Group Policy
Group Policy (GP) is a very broad capability of Windows Server and other Microsoft products to control Windows and other applications. Given the broad range of capabilities, some find it a little daunting. Windows Intune offers control over the ones that are commonly used to monitor and manage desktop computers. For complex solutions, Windows Server will always provide the greater control and management of these policies and as with AD, if the computer management is left to Windows Intune and the user and other tasks are managed by Group Policy, then little complexity should arise. Given though that it is more likely that there will be overlap between the two sets of policy, a very simple rule has been put in place. In the situation where AD Group Policy and Windows Intune Policy conflict, the GP settings will always override the Windows Intune policies. More information about AD and GP can be found http://davidoverton.com/r.ashx?2L. [ 276 ]
Chapter 12
Windows Intune includes a tool to enable us to check if policies are in conflict so that we can understand the details of any policy issues. We would see a policy alert if an error was detected. When looking at the information on a specific computer in the Computers workspace, we can see information in the Policy tab.
Update management with Windows Software Update Services
Windows Software Update Services (WSUS) has been available for a number of years to move the update process from user management to policy-based management. With WSUS, we can also locate the updates themselves on a server inside the corporate firewall to reduce Internet bandwidth and data consumption requirements. One hundred people all trying to update the same 10 MB update is 1 GB of data saved if the update is being locally serviced, and is likely to download much faster too. The management of updates is a complete overlap between Windows Intune and WSUS, although as mentioned earlier, the delivery is different. WSUS settings are configured via group policy, so if we have Windows Intune and WSUS running, WSUS will be in control of the updates.
[ 277 ]
Integration with Existing Microsoft Products
Windows Small Business Server
Windows Small Business Server (SBS) is an amazing product that delivers high power capability all squeezed into one system box. Obviously, as the author of a book on SBS, you would expect me to say so, but I really do think that. The functionality provided by each version of SBS 2011 is not identical, even when limiting to the areas that Windows Intune covers. The following table describes the different versions: SBS 2011 Essentials
SBS 2011 Standard
Windows Server 2008 R2
Yes
Yes
AD
Yes
Yes
WSUS
No
Yes
Group Policy
No
Yes
Management tools
Simple monitoring
Yes
Exchange 2010
No
Yes
SharePoint Foundation
Optional, but not pre-built
Yes
Premium Add-on Services
Optional
Optional
User / PC limit
25
75
SBS 2011 Standard Edition delivers most of the items of functionality that we have just discussed. It has Windows Server 2008 (or 2008 R2 with the 2011 version), Exchange, and SharePoint Services for the collaboration components. It also has its own customized user-management tools and some limited device management. This version is limited to a maximum of 75 users or devices, each of which will require a Client Access License (CAL) as well as the core product. It provides a significant number of features not discussed here. SBS 2011 Essentials is based on Windows Home Server and offers a much simplified solution that is ideal for non-IT skilled small businesses. While there is some use of policy in both products, there is almost no overlap with Windows Intune in the policy or management capabilities. One stand-out feature of the Essentials edition is the integrated PC backup solution that will also back up the computers on the LAN to the server for added security. This product is licensed to a maximum of 25 users or computers and has no additional license fees besides the initial server product. Both products can work well with Windows Intune for managing the device as well as using the additional functionality of SBS for other functions.
[ 278 ]
Chapter 12
Since the Essentials edition does not provide the likely desired collaboration services, this is well suited to being paired with Office 365, meaning that we can get the most optimum solution using Windows Intune, Office 365, and Essentials if we do not have more than 25 users or computers. For more information about Windows SBS, have a look at my blog: http://davidoverton.com/blogs/doverton or for the product comparison go to http://davidoverton.com/r.ashx?2G.
Windows Home Server
Windows Home Server has been used by some small businesses since its release. The latest version, Windows Home Server 2011, delivers some functionality that is found in SBS Essentials. A quick comparison of features can be seen in the following table: SBS 2011 Essentials
Windows Home Server 2011
Windows Server 2008 R2
Yes
Yes
AD
Yes
No
WSUS
No
No
Group Policy
No
No
Management tools
Simple monitoring
Simple monitoring
Exchange 2010
No
No
SharePoint Foundation
Optional, but not pre-built
No
Premium Add-on Services
Optional
No
User / PC limit
25
10
The overlap between Home Server and Windows Intune is even lower than SBS Essentials and as such can be used as a companion to Windows Intune without worry or conflict. For more information on Windows Home Server, please go to http://davidoverton.com/r.ashx?2M.
[ 279 ]
Integration with Existing Microsoft Products
On-premise versus cloud solutions summary
We have discussed a number of technologies in this chapter, and for those who prefer a table to compare against, here are the Microsoft technologies compared side by side: Small Business Server 2011
Traditional on-premise
Microsoft cloud
Windows Server 2008 R2
Yes
Yes
Yes through Windows Azure
Active Directory
Yes
Yes
No
WSUS
Essentials—No
Yes
Intune—Yes
Yes
Intune—Yes (some)
System Center—Yes
Intune—Yes
Exchange 2010—Yes
Office 365—Yes
Yes
Office 365—Yes
Standard—Yes Group Policy
Essentials—No
Management tools
Essentials—Simple
Exchange 2010
Essentials—No
Standard—Yes Standard—Yes Standard—Yes SharePoint Foundation
Essentials—Optional
Premium add-on services
Optional
Full Purchases only
Azure—Yes
User / PC limit
Essentials—25
Unlimited
Unlimited
Windows 7 (and later versions)
No
Full purchase only
Intune—Yes
Anti-malware
No (non-centralized for 1-9 PCs)
Forefront Protect Manager—Yes
Intune—Yes
Remote shared screen assistance
No
Yes
Yes
Payment model
Up front
Up front or three-year contract with annual payment
Subscription
Standard—Yes
Standard—75
[ 280 ]
Chapter 12
Mixing on-premise and cloud solutions
Having described where the products do and do not work together, there may be an expectation that a System Center organization would have no use for a Windows Intune solution. This is not the case, however, as organizations often have to provide solutions for a number of different scenarios. If an organization wishes to support users who rarely connect to the corporate network or users who wish to utilize non-company PCs, often referred to as Bring Your Own Technology (BYOT), then Windows Intune enables an excellent level of management for what could otherwise be a complex management issue. To this end, hybrid solutions are possible where a non-traditional desktop support model is desired. This might look a bit as the following diagram:
[ 281 ]
Integration with Existing Microsoft Products
Anti-malware products
While not all anti-malware products are made by Microsoft, there is an interesting process that is executed by Windows Intune to decide whether to install the Windows Intune Endpoint Protection software on a client computer or not. The process is described by the flow chart shown as follows:
The process ensures that a computer is never left without anti-malware protection. If a computer has no anti-malware, or has Microsoft Security Essentials, or Forefront Endpoint Protection, then an upgrade is carried out to Windows Intune Endpoint Protection. If it has another anti-malware tool, then this will be removed and Windows Intune Endpoint Protection will be installed if the policy explicitly says to install the product. If not, then the existing anti-malware solution will be left in place. It is worth stating again though that Windows Intune can only provide alerts and manage via policy if the Windows Intune Endpoint Protection is installed. [ 282 ]
Chapter 12
Summary
There are a number of Microsoft products that overlap and compliment Windows Intune. Depending on our requirements, the importance of the overlap and, whether all or some computers should use both products, can be decided. System Center is the product with the most overlap and additional functionality with Windows Intune. SBS 2011 Standard Edition is the next closest, but Windows Intune still provides several unique benefits over SBS 2011, including the Windows 7 Enterprise Edition license and the ability to purchase MDOP. All other products complement Windows Intune significantly and should be considered as part of our IT estate in one way or another. We are now ready to deliver a well-managed PC estate and report on how this estate performs against expectations. We can proactively and reactively resolve user's computer challenges so they can get on with their day job and we can spend more time improving this, rather than fighting IT management fires.
[ 283 ]
Index A Active Directory. See AD AD 88, 276 administrators additional administrators, adding to Windows Intune 83-85 tenant administrators, adding to Windows Intune 85-87 Adobe Flash - 32-bit EXE 152-154 Adobe Flash - 64-bit MSI 149-152 Adobe Reader - Windows 7 EXE 155, 156 Adobe Reader - XP SP3 EXE 156 alerts and support, Windows Intune about 49 remote assistance 52, 53 alerts, Windows Intune about 196 activation, configuring 96-98 closing 200, 201, 217 configuring 96 customer alert rule, creating 101-104 malware alerts 201 monitoring 196-198 notification, changing 98-101 notification, rules 98 remote assistance alerts 204 responding 199 alerts workspace about 178, 179 categories 179 reporting basics 178, 179
anti-malware products 282 protection 45 application installation modes 144 package, deploying 158-160 package files, folder creating for 144 preparing, for uploading 144 application package files Adobe Flash - 32-bit EXE 152-155 Adobe Flash - 64-bit MSI 149-152 Adobe Reader - Windows 7 EXE 155, 156 Adobe Reader - XP SP3 EXE 156 Intel drivers 157 Office 2010 157 placing, in one folder 145-147 uploading 148 auditing, Windows Intune 47
B Background Intelligent Transfer Service (BITS) 129 Bring Your Own Technology (BYOT) 281
C CAL 278 chat tool 212 Client Access License. See CAL cloud computing about 7 centralized solution 9, 10
challenges 18 client software 15 customization 20 data accesses and synchronization 19 elastic in scale and power 10 facets 8 Infrastructure as a Service (IaaS) 17 levels 16 management 9, 10 multiple client device types 14, 15 network bandwidth and latency 19 network requisites 19 programmable interfaces 16 protocols 11 secure and private 12 security 20 upgrades 9, 10 utilization based pricing 11 cloud solutions and on-premise, mixing 281 versus on-premise, summary 280 Comma Separated Values (CSV) 177 computer groups All Computers groups 88 computer, assigning to multiple groups 94, 95 configuring 87 group structure, selecting 88-91 PCs, assigning 92-95 Unassigned Computers groups 88 Computer Management option 41 computers workspace view 186, 187 computing scenarios about 272 desktop environment 272, 273 management tools 273 productivity services 273, 274 Crash Analyzer option 41, 235 Create New Policy 113 customer alert rule creating 101-104
D DaRT about 40, 219 CD, building 226-230 Crash Analyzer 235-239 Hotfix Uninstaller 239, 240 installing, steps 222-226 Locksmith tool 234, 235 standalone system sweeper 240-242 troubleshooting with 231-234 Data Protection Manager 275 deploy policy, Windows Intune Agent Settings 130 desktop environment, computing scenarios 272, 273 Diagnostic and Recovery Toolset. See DaRT Disk commander option 41 Disk Wipe option 41
E Endpoint Protection section, Windows Intune Agent Settings Default Actions 126 Endpoint Protection Service 122, 123 files and processes, excluding 126-128 Microsoft SpyNet 128 Real-time Protection 123, 124 Scan Options 125 Scan Schedule 124 Endpoint Protection Service 122 End User Licensing Agreement (EULA) 140 ERD Commander Boot Media Wizard 231 ERD Registry Editor option 41 estate-wide software view 182-185
F File Restore option 41 file transfer 213, 214 firewall 46 Forefront Client Security Filter Manager QFE for Windows XP/SP2 URL 60
[ 286 ]
G
L
GP 276, 277 Group Policy. See GP
license installation report 189 Microsoft Volume License details, managing 104, 106 other license details, managing 107, 108 purchase report 189 Locksmith option 41 Locksmith tool 234, 235
H hardware computers workspace view 186, 187 inventory reports 188 tracking 185 Hotfix Uninstaller 239, 240
M
I IaaS 17 individual computer software view 181, 182 infrastructure as a Service. See IaaS installation report, license 189 installation, Windows Intune 42 Intel drivers 157 Internet Explorer 6 (IE6) 42 inventory reports, hardware 188 IT management goals, defining 24, 25 reporting on 33 IT policies against business goals 26 alerts 31 education 27 hardware assets, tracking 28, 29 hardware issues 32 issues, reacting to 30 major issues, dealing with 32 malicious theft of data, stopping 27, 28 malware, blocking 28 ongoing maintenance tasks 30, 31 PC, updating 29, 30 PC, updating with updatesDeploy Windows 7 29 security settings, ensuring on PC 26 software assets, tracking 28, 29 software issues 33 users' Support Requests, working with 31, 32 using 25, 26
malware alerts about 201, 202 anti-malware software issue 201 detecting 201 malware checks, testing 202 management console, Windows Intune 43, 44 management tools, computing scenarios 273 MDOP about 40, 62 downloading, steps 219-222 MED-V 42 Microsoft Assessment and Planning (MAP) toolkit 268 Microsoft Core XML Services (MSXML) 6.0 URL 60 Microsoft Deployment toolkit 269 Microsoft Desktop and Recovery Toolset. See DaRT Microsoft Desktop Optimization Pack. See MDOP Microsoft Easy Assist tool benefits 205 Microsoft Enterprise Desktop Virtualization. See MED-V Microsoft Installer Package (MSI) 75 Microsoft Online Customer Portal (MOCP) about 62, 274 contacts, configuring 66, 67 signing into 66, 67 Microsoft SpyNet 128
[ 287 ]
Microsoft Volume License details managing 104, 106 multiple organizations, Windows Intune managing 54
N network bandwidth, Windows Intune Agent Settings 129 Network Inspection System 124 Non-Microsoft Updates managing 161-166
O Office 365 about 274 and on-premise Exchange 274 and on-premise SharePoint 274 URL 274 Office 2010 157 on-premise and cloud solutions, mixing 281 versus cloud solutions, summary 280 Windows Server 275, 276 on-premise Exchange and Office 365 274 on-premise SharePoint and Office 365 274
P PaaS 17 package deploying 158-160 removing 167 software package, removing 168 PC management about 23 alerts 31 continuous cycle 24 IT policies, using for configuration 25, 26 IT policies, using for deployment 25, 26 ongoing maintenance tasks 30, 31 problem management, categories 30
users' Support Requests, working with 31, 32 Platform as a Service. See PaaS policy management about 111-113 Create New Policy 113 existing policy, editing 131 General section 114 Windows Firewall Settings 111, 114-116 Windows Intune Agent Settings 111, 121 Windows Intune Center Settings 111, 119-121 productivity services, computing scenarios 273, 274 purchase report, license 189
R Real-time Protection 123 remote assistance alerts about 204, 205 assistance, providing 207 client computer, preparing for support 206, 207 receiving 208-210 remote support, providing 211-213 steps 208-210 support agent's computer, preparing for support 207 support delivery, preparing 206 remote computer rebooting 215-217 reporting alerts 190 basics 172 custom reports 192 in alerts workspace 178, 179 in reports workspace 173 on PC management achievements 193 updating 179, 180 reporting, Windows Intune 47 reports workspace about 173 customization, loading 174, 175 customization, saving 174, 175
[ 288 ]
customization, selecting 173, 174 data, exporting 177, 178 data, sorting in columns 175 reporting basics 173 report, printing 175, 176
S SaaS 18 SBS 278 Scan Options 125 script scanning 124 security management, Windows Intune about 44 anti-malware protection 45 firewall control 46 Windows system updates 44, 45 Security update, MSXML 6.0 SP2 URL 60 Service Level Agreement. See SLA shared desktop 212, 213 SLA about 12 availability 12 recompense 13 service hours 13 Window Intune SLA 14 software estate-wide software view 182-185 individual computer software view 181, 182 usage, tracking 180 Software as a Service. See PaaS software distribution, Windows Intune 53, 54 standalone system sweeper 240-242 System Center about 274, 275 service manager 275 URL 275
T
U update management about 131 automatic approval of updates, configuring 135-138 classification, selecting 132 products categories 133 products, selecting 132 Update Classification section 134, 135 updates, approving manually 138-142 updatesDeploy Windows 7 used, for updating PC 29 User Account Control (UAC) 206
V Virtual CloneDrive 222
W Windows 7 Enterprise Edition downloading, steps 244-246 installing 253 installing, steps 254-260 prerequisites, checking for 247-249 scale deployment, tools 268 settings, backing up for migration 249-253 Windows 7, Windows Intune about 39 Diagnostic and Recovery Toolset (DaRT) 40, 41 Microsoft Desktop Optimization Pack (MDOP) 40 Microsoft Enterprise Desktop Virtualization (MED-V) 42 Windows 7 Software Assurance customers 40 Windows Easy Transfer wizard 249 Windows Firewall Settings about 114, 115 Profile Settings 115 Windows Home Server 297
Total Cost of Ownership (TCO) 39
[ 289 ]
Windows Intune about 23, 57, 58 adding, to basket 67-70 additional administrators, adding 83-85 advantages 36, 37 application installation, modes 144 application package files, folder creating for 144 application package files, placing in one folder 145, 147 application, preparing for upload 144 application, uploading 148 App-V packaging, used for deploying package 147 App-V packaging, using to deploy package 147 architecture 37, 38 client PC, image based deployment 75 client PC installation, confirming 76-78 client PC installation, via alternative methods 74 client PC, MSI file deployment 75 client PC, quiet installation 75 client PC, update process 76 client software, downloading to device 72 complex management skills 61 computer, removing from Windows Intune 265-267 diagnostic skills 61 features 38, 39 hardware requisites 59 help page, URL 160 installing, on client PC 72 licensing 58 management skills 61 MDOP, adding to purchase 71, 72 need for 35, 36 package, deploying 158-160 package, removing 167 partner, adding to subscription 79, 80 purchase, activating 70, 71 purchase, configuring 67-70 reporting, basics 172 signing up 62
skills requisites 60 software package, removing 168 software requisites 60 software, uninstalling from client PC 167 Switch to another account 80, 81 tenant administrator, changing 85-87 tools, installing 267 unzipping 74 updating 265 Windows Intune Agent Settings about 121 deploy policy 130 Endpoint Protection section 122 General section 122 network bandwidth 129 Updates section 128 Windows Intune Center Settings about 119 All Policies section 120 Create Policy 120 Windows Intune Center Settings 120 Windows Intune, features about 38 alerts and support 49 auditing 47 management console 43, 44 multiple organizations, managing 54 reporting 47, 48 security management 44 software distribution 53, 54 Windows 7 39 Windows Intune, installing on client PC about 72 client software, downloading 72 confirming 76-78 image based deployment 75 MSI file deployment 75 quiet installation 75 uninstalling 74 unzipping 74 update process, completing 76 via alternative methods 74 Windows Intune, signing up MDOP, adding to purchase 71, 72 MOCP, signing into 66, 67
[ 290 ]
Windows Intune, adding to basket 67-70 Windows Intune, purchase activating 70, 71 Windows Intune, purchase confirming 67-70 Windows Live ID, creating 62-65 Windows Intune SLA 14 Windows Live ID, Windows Intune creating 62-65 Windows Server, on-premise about 275, 276 Group Policy (GP) 276
identity management, with Active Directory (AD) 276 on-premise 275, 276 Windows Software Update Services (WSUS) 277 Windows Small Business Server. See SBS Windows Software Update Services. See WSUS Windows system updates 44 WSUS 277
[ 291 ]
Thank you for buying
Microsoft Windows Intune 2.0: Quickstart Administration About Packt Publishing
Packt, pronounced 'packed', published its first book "Mastering phpMyAdmin for Effective MySQL Management" in April 2004 and subsequently continued to specialize in publishing highly focused books on specific technologies and solutions. Our books and publications share the experiences of your fellow IT professionals in adapting and customizing today's systems, applications, and frameworks. Our solution based books give you the knowledge and power to customize the software and technologies you're using to get the job done. Packt books are more specific and less general than the IT books you have seen in the past. Our unique business model allows us to bring you more focused information, giving you more of what you need to know, and less of what you don't. Packt is a modern, yet unique publishing company, which focuses on producing quality, cutting-edge books for communities of developers, administrators, and newbies alike. For more information, please visit our website: www.packtpub.com.
About Packt Enterprise
In 2010, Packt launched two new brands, Packt Enterprise and Packt Open Source, in order to continue its focus on specialization. This book is part of the Packt Enterprise brand, home to books published on enterprise software – software created by major vendors, including (but not limited to) IBM, Microsoft and Oracle, often for use in other corporations. Its titles will offer information relevant to a range of users of this software, including administrators, developers, architects, and end users.
Writing for Packt
We welcome all inquiries from people who are interested in authoring. Book proposals should be sent to
[email protected]. If your book idea is still at an early stage and you would like to discuss it first before writing a formal book proposal, contact us; one of our commissioning editors will get in touch with you. We're not just looking for published authors; if you have strong technical skills but no writing experience, our experienced editors can help you develop a writing career, or simply get some additional reward for your expertise.
Microsoft Forefront UAG 2010 Administrator's Handbook ISBN: 978-1-84968-162-9
Paperback: 484 pages
Take full command of Microsoft Forefront Unified Access Gateway to secure your business applications and provide dynamic remote access with DirectAccess 1.
Maximize your business results by fully understanding how to plan your UAG integration
2.
Consistently be ahead of the game by taking control of your server with backup and advanced monitoring
3.
An essential tutorial for new users and a great resource for veterans
Least Privilege Security for Windows 7, Vista and XP ISBN: 9978-1-849680-04-2
Paperback: 464 pages
Secure desktops for regulatory compliance and business agility 1.
Implement Least Privilege Security in Windows 7, Vista and XP to prevent unwanted system changes
2.
Achieve a seamless user experience with the different components and compatibility features of Windows and Active Directory
3.
Mitigate the problems and limitations many users may face when running legacy applications
Please check www.PacktPub.com for information on our titles
Microsoft Windows Server AppFabric Cookbook ISBN: 978-1-84968-418-7
Paperback: 526 pages
Over 60 recipes for getting the most out of WCF/WF services on the Microsoft Windows Platform using Windows Server AppFabric 1.
Gain a solid understanding of the capabilities provided by Windows Server AppFabric with a pragmatic, hands-on, results-oriented approach
2.
Learn how to apply the WCF and WF skills you already have to make the most of what Windows Server AppFabric has to offer
3.
Includes step-by-step recipes for developing highly scalable composite services that utilize the capabilities provided by Windows Server AppFabric including caching, hosting, monitoring and persistenc
Microsoft Windows Azure Development Cookbook ISBN: 978-1-84968-222-0
Paperback: 392 pages
Over 80 advanced recipes for developing scalable services with the Windows Azure platform 1.
Packed with practical, hands-on cookbook recipes for building advanced, scalable cloudbased services on the Windows Azure platform explained in detail to maximize your learning
2.
Extensive code samples showing how to use advanced features of Windows Azure blobs, tables and queues.
3.
Understand remote management of Azure services using the Windows Azure Service Management REST API
Please check www.PacktPub.com for information on our titles
