Tag: iOS

Windows Server 2025 Preview (Build: Canary 26052)

I had some time to check out the new version of Server 2025.

For the full upcomming features check: https://ignite.microsoft.com/en-US/sessions/f3901190-1154-45e3-9726-d2498c26c2c9?source=sessions

Download Server 2025 Preview: https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewserver

Server 2025 will come with a lot of features (My Top 20+):

  • General – Server 2022 upgrade to .vNext (Controled bij GPO)
  • Hot Patching (Arc Enabled, Monthly Subscription)
  • Active Directory – 32k page
  • Active Directory – Numa
  • Active Directory – LDAP TLS 1.3
  • Active Directory – Improved Security for Confidential Attributes
  • Active Directory – Active Directory LDAP prefers Encryption bij Default
  • Active Directory – Kerberos Support for AES/SHA256/384
  • Active Directory – Changes to Default behavior of legacy SAM RPC Spassword change methods
  • Active Directory – Kerberos en KPINT Support cryptographic agility
  • Active Directory – New AD Forest en Domein Level (Minimal Server 2016 requirement)
  • Storage – NVME 70%/90% peformance increase
  • File Server – SMB over Internet (Quick Protocol)
  • File Server – More Control over SLTM
  • File Server – SMB Limitor (Enabeld bij Default)
  • File Server – Signing by Default
  • File Server – Minimum version SMB
  • File Server – More Secure Bij Default (Netbios disabled bij default)
  • RDS – M365 Apps stil supported for every Windows Server release 2-3 years
  • Finance – General support and Pay-as-you-go Support

Need to find some time to dig in

Handy link: https://techcommunity.microsoft.com/t5/windows-server-insiders/announcing-windows-server-preview-build-26040/m-p/4040858

VMware Horizon 7.3.1 and Horizon Client 4.6 released

VMware has released VMware Horizon 7.3.1 and Horizon Client 4.6! With this new release, Horizon 7.3 enhances key platform features, including Horizon Virtualization Pack for Skype for Business, VMware Instant Clone Technology and the Horizon Help Desk Tool.

Many new items have been introduced, such as HTML5 video redirection support for the Chrome browser and the ability to configure Windows Start menu shortcuts for desktop and application pools using the Horizon Administrator console. As always, you can count on increased operating system support for virtual desktops and clients.

Here is an overview of the new features:

VMware Horizon 7.3 Server Enhancements

Horizon Help Desk Tool

  • Displays application process resources with reset control
  • Role-based access control for help desk staff
  • Activity logging for help desk staff
  • Displays Horizon Client information
  • Granular logon time metrics
  • Blast Extreme display protocol metrics

Instant Clone Technology

  • Instant-clone desktops can now use dedicated assignment to preserve the hostname, IP address and MAC address of a user’s desktop
  • Windows Server OS is now supported for desktop use
  • Instant clones are now compatible with Storage DRS (sDRS)
  • If there are no internal VMs in all four internal folders created in vSphere Web Client, these folders are unprotected, and you can delete them
  • IcUnprotect.cmd utility can now unprotect or delete template, replica or parent VMs or folders from vSphere hosts

Windows Start Menu Shortcuts Created Using the Admin Console

  • Create shortcuts to Horizon 7 resources:
    • Published applications
    • Desktops
    • Global entitlements

Cloud Pod Architecture Scale

  • Total session limit is increased to 140,000
  • The site limit is now seven

VMware Horizon Apps

  • This update makes Horizon Apps easier to use and allows the administrator to restrict entitlements
  • Restrict access to desktop and application pools from specific client machines

Resiliency for Monitoring

  • If the event database shuts down, Horizon administrator maintains an audit trail of the events that occur before and after the event database shutdown

Database Support

  • Always-On Availability Groups feature for Microsoft SQL Server 2014

ADMX Templates

  • Additional GPO settings for ThinPrint printer filtering, HTML5 redirection and enforcement of desktop wallpaper settings

Remote Experience

Horizon Virtualization Pack for Skype for Business

  • Multiparty audio and video conferencing
  • Horizon 7 RDSH support
    • Windows Server 2008 R2
    • Windows Server 2012 R2
  • Forward Error Correction (FEC)
  • Quality of Experience (QOE) metrics
  • Customized ringtones
  • Call park and pickup
  • E911 (Enhanced 911) support, to allow the location of the mobile caller to be known to the call receiver
  • USB desktop-tethering support
  • Horizon Client for Linux support for the following Linux distributions:
    • Ubuntu 12.04 (32-bit)
    • Ubuntu 14.04 (32 & 64-bit)
    • Ubuntu 16.04 (64-bit)
    • RHEL 6.9/CentOS 6.x (64-bit)
    • RHEL 7.3 (64-bit)
    • SLED12 SP2 (64-bit)

Additional NVIDIA GRID vGPU Support

  • Support for the Tesla P40 graphics card from NVIDIA

HTML5 Video Redirection

  • View HTML 5 video from a Chrome browser and have video redirected to the client endpoint for smoother and more efficient video playback

Performance Counter Improvements

  • Windows agent PerfMon counters improvements for Blast Extreme sessions: imaging, audio, client-drive redirection (CDR), USB and virtual printing

Linux Virtual Desktops

  • KDE support: Besides RHEL/CentOS 6.x, the KDE GUI is now supported on RHEL/CentOS 7.x, Ubuntu 14.04/16.04 and SUSE Linux Enterprise Desktop 11 SP4
  • MATE  interface is now supported on Ubuntu 14.04 and Ubuntu 16.04
  • Blast Extreme Adaptive Transport is now supported for Linux desktops
  • vGPU hardware H.264 encoder support has been added

USB Redirection

  • USB redirection is supported in nested mode

ThinPrint Filtering

  • Administrators can filter out printers that should not be redirected

Horizon Client 4.6 Updates

Security Update

  • All clients have been updated to use SHA-2 to prevent SHA-1 collision attacks

Session Pre-launch

  • Session pre-launch is now extended to both Horizon Client for macOS and Horizon Client for Windows

Apteligent

  • Integration of Apteligent crash log

Blast Extreme

  • Improvements in Blast Extreme Adaptive Transport mode for iOS and macOS
  • User can change Blast Extreme settings without having to disconnect

Horizon Client 4.6 for Windows

  • Support for UNC path with CDR

Horizon Client 4.6 for macOS

  • Support for macOS Sierra and macOS High Sierra
  • Selective monitor support
  • Norwegian keyboard support

Horizon Client 4.6 for iOS

  • CDR support with drag and drop of files in split view
  • iOS split keyboard enhancement
  • iOS UI updates

Horizon Client 4.6 for Android

  • Android Oreo support
  • Manage the Horizon server list with VMware AirWatch
  • Simple shortcuts
  • External mouse enhancements
  • Real-Time Audio-Video (RTAV) support for Android and Chrome OS

Horizon Client 4.6 for Linux

  • Blast Extreme Adaptive Transport support

Horizon Client 4.6 for Windows 10 UWP

  • Network recovery improvements

Horizon HTML Access 4.6

  • HTML Access for Android with a revised UI
  • Customization of HTML Access page

Horizon Help Desk Tool

The Horizon Help Desk Tool provides a troubleshooting interface for the help desk that is installed by default on Connection Servers. To access the Horizon Help Desk Tool, navigate to https://<CS_FQDN>/helpdesk, where <CS_FQDN> is the fully qualified domain name of the Connection Server, or click the Help Desk button in the Horizon Administrator console.

The Help Desk Tool was introduced in Horizon 7.2 and has been greatly expanded upon in the Horizon 7.3 release.

Help Desktop Tool features with Horizon 7.2:

  • Virtual machine metrics
  • Remote assistance
  • Session control (restart, logoff, reset, and disconnect)
  • Sending messages

Additional features with Horizon 7.3:

  • Display application process resources with reset control
  • Role-based access control for help desk staff
  • Activity logging for help desk staff
  • Granular login time metrics
  • Display Horizon Client information

User Session Details

The user session details appear on the Details tab when you click a user name in the Computer Name option on the Sessions tab. You can view details for Horizon Client, the VDI desktop or RDSH-published desktop, CPU and memory stats, and many other details.

  • Client version
  • Unified Access Gateway name and IP address
  • Logon breakdown (client to broker):
    • Brokering
    • GPO load
    • Profile load
    • Interactive
    • Authentication

Blast Extreme Metrics

Blast extreme metrics that have been added include estimated bandwidth (uplink), packet loss, and transmitted and received traffic counters for imaging, audio, and CDR.

Note the following behavior:

  • The text-based counters do not auto-update in the dashboard. Close and reopen the session details to refresh the information.
  • The counters for transmitted and received traffic counters are accumulative from the point the session is queried/polled.

Blast Extreme Metrics for a Windows 10 Virtual Desktop Session

Display and Reset Application Processes and Resources

This new feature provides help desk staff with a granular option to resolve problematic processes without affecting the entire user session, similar to Windows Task Manager. The session processes appear on the Processes tab when you click a user name in the Computer Name option on the Sessions tab. For each user session, you can view additional details about CPU- and memory-related processes to diagnose issues.

Role-based Access Control and Custom Roles

You can assign the following predefined administrator roles to Horizon Help Desk Tool administrators to delegate the troubleshooting tasks between administrator users:

  • Help Desk Administrator
  • Help Desk Administrator (Read Only)

You can also create custom roles by assigning the Manage Help Desk (Read Only) privilege along with any other privileges based on the Help Desk Administrator role or Help Desk Administrator (Read Only) role.

Members of the Help Desk Administrators (Read Only) role do not have access to following controls; in fact, functions such as Log Off and Reset are not presented in the user interface.

Watch this brief demonstration video of the Horizon Help Desk Tool to see it in action:

Horizon Virtualization Pack for Skype for Business

You can now make optimized audio and video calls with Skype for Business inside a virtual desktop without negatively affecting the virtual infrastructure and overloading the network.

All media processing takes place on the client machine instead of in the virtual desktop during a Skype audio and video call.

New support with many expanded features for the Horizon Virtualization Pack for Skype for Business can be found in Horizon 7.3 and Client 4.6.

New Features

Horizon Virtualization Pack for Skype for Business offers the following supported features:

System Requirements

The following table outlines the system requirements for the new release:

Supported Clients

The following table provides the list of support Horizon clients:

Start Menu Shortcuts Configured Through the Admin Console

This feature improves the user experience by adding desktop and application shortcuts to the Start menu of Windows client devices.

You can use Horizon Administrator to create shortcuts for the following types of Horizon 7 resources:

  • Published applications
  • Desktops
  • Global entitlements

Shortcuts appear in the Windows Start menu and are configured by IT. Shortcuts can be categorized into folders.

Users can choose at login whether to have shortcuts added to the Start menu on their Windows endpoint device.

Watch this brief demonstration video of the new Desktop and Apps Shortcuts feature to see it in action:

Dedicated Desktop Support for Instant Clones

Upon the initial release of instant clones in Horizon 7, we supported floating desktop pools and assignments only. Further investments have been made to Instant Clone Technology that add support for dedicated desktop pools. Fixed assignments and entitlements of users to instant-clone machines is now provided as part of Horizon 7.3.

Dedicated instant-clone desktop assignment means that there is a 1:1 relationship between users and desktops. Once an end user is assigned to a desktop, they will consistently receive access to the same desktop and corresponding virtual machine. This feature is important for apps that require a consistent hostname, IP address, or MAC address to function properly.

Note: Persistent disks are not supported. Fixed assignments to desktops does not mean persistence for changes. Any changes that the user makes to the desktop while in-session will not be preserved after logoff, which is similar to how a floating desktop pool works. With dedicated assignment, when the user logs out, a resync operation on the master image retains the VM name, IP address, and MAC address.

Support for the Tesla P40 Graphics Card from NVIDIA

VMware has expanded NVIDIA GRID support with Tesla P40 GPU cards in Horizon 7.3.

HTML5 Video Redirection

This feature provides the ability to take the HTML5 video from a Chrome (version 58 or higher) browser inside a Windows VDI or RDSH system and redirect it to Windows clients. This feature uses Blast Extreme or PCoIP side channels along with a Chrome extension.

The redirected video is overlaid on the client and is enabled as well as managed using GPO settings.

Benefits include:

  • Supports generic sites such as YouTube, without requiring a server-side plugin.
  • Provides smooth video playback comparable to the native experience of playing video inside a browser on the local client system.
  • Reduces data center network traffic and CPU utilization on the vSphere infrastructure hosts.

Improved USB Redirection with User Environment Manager

The default User Environment Manager timeout value has been increased. This change ensures that the USB redirection Smart Policy takes effect even when the login process takes longer than expected.

With Horizon Client 4.6, the User Environment Manager timeout value is configured only on the agent and is sent from the agent to the client.

You can now bypass User Environment Manager control of USB redirection by setting a registry key on the agent machine (VDI desktop or RDSH server). This change ensures that smart card SSO works on Teradici zero clients. Note: Requires a restart.

HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB uemFlags (REG_DWORD 1)

Blast Extreme Performance Counter Improvements

The Windows Agent PerfMon counters for the Blast Extreme protocol have been improved to update at a constant rate and to be even more accurate.

Counters include:

  • Imaging
  • Audio
  • CDR
  • USB
  • Virtual printing

Linux Virtual Desktops

Features and functions for Horizon 7 for Linux virtual desktops have been expanded:

  • KDE support – Besides RHEL/CentOS 6.x, the KDE GUI is now supported on RHEL/CentOS 7.x, Ubuntu 14.04/16.04, SUSE Linux Enterprise Desktop 11 SP4.
  • Support for the MATE interface on Ubuntu 14.04, Ubuntu 16.04.
  • Blast Extreme Adaptive Transport support.
  • vGPU hardware H.264 encoder support.

USB Redirection Support in Nested Mode

The USB redirection feature is now supported when you use Horizon Client in nested mode. When using nesting–for example, when opening RDSH applications from a VDI desktop–you can now redirect USB devices from the client device to the first virtualization layer and then redirect the same USB device to the second virtualization layer (that is, nested session).

Filtering Redirected Printers

You can now create a filter to specify the printers that should not be redirected with ThinPrint. A new GPO ADMX template (vmd_printing_agent.admx) has been added to enable this functionality.

By default, the rule permits all client printers to be redirected.

  • Supported attributes:
    • PrinterName
    • DriverName
    • VendorName
  • Supported operators:
    • AND
    • OR
    • NOT
  • Supported searching pattern is a regular expression.

Blast Extreme Improvements in CPU Usage

Now even lower CPU usage is achieved with adaptive Forward Error Correction algorithms. This clever mechanism decides how to handle error correction, lowering CPU usage within virtual desktop machines as well as on client endpoint devices.

Blast Extreme Adaptive Transport Side Channel

New support has been added for Blast Extreme Adaptive Transport side channels for USB and CDR communications. Once enabled, TCP port 32111 for USB traffic does not need to be opened, and USB traffic uses a side channel. This feature is supported for both virtual desktops and RDS hosts.

  • Feature is turned off by default.
  • Enable the feature through a registry key: HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config\UdpAuxiliaryFlowsEnabled 1

Entitlement Restrictions Based on Machine Name

This feature allows IT administrators to restrict access to published applications and desktops based on both client computer and user. With client restrictions for RDSH, it is now possible to check AD security groups for specific computer names. Users only have access to desktops and apps when both the user and the client machine are entitled. For this release, the feature is supported only for Windows clients and works with global entitlements.

Pre-Launch Improvements

Pre-launch provides the ability to launch an empty (application-less) session when connecting to the Connection Server. The feature is now also available to Windows clients, in addition to macOS.

Also, it is no longer necessary to manually make changes to the client settings. You can configure automatic reconnection.

Blast Extreme Adaptive Transport Mode for iOS and macOS

With prior client releases, users were required to configure their Blast Extreme settings before they connected to the Connection Server. After a connection was established, the options to change the Blast Extreme setting—which included H.264, Poor, Typical, and Excellent—were unavailable.

With this release, users can change the network condition setting from Excellent to Typical or the reverse while inflight to sessions. Doing so also changes the protocol connection type between TCP (for Excellent) and UDP (for Typical).

Note: End users will not be able to change the network condition setting if Poor is selected before establishing a session connection.

Horizon Client for Windows

Horizon Client 4.6 updates include:

  • Additional command-line options for the new client installer – When silently installing the Windows client, using the /s flag, you can now also set:
    • REMOVE-SerialPort,Scanner – Removes the serial port, scanner, or both.
    • DESKTOP_SHORTCUT-0 – Installs without a desktop shortcut.
    • STARTMENU_SHORTCUT-0 – Installs without a Start menu shortcut.

  • Support for UNC paths with client drive redirection (CDR):
    • Allows remote applications to access files from a network location on the client machine. Each location gets its own drive letter inside the remote application or VDI desktop.
    • Folders residing on UNC paths can now be redirected with CDR, and get their own drive letter inside the session, just as any other shared folder.

Horizon Client for macOS

Horizon Client 4.6 updates include:

  • Apple macOS High Sierra day 0 support.
  • Users can select which monitors to use for VDI sessions and which to use for the local system.
  • Norwegian keyboard support and mappings are now available

Horizon Client for iOS

Horizon Client 4.6 updates include:

  • iOS 11 support
  • iOS split keyboard update – Removes the middle area in the split keyboard for a better view of the desktop
  • New dialog box for easy connection to a Swiftpoint Mouse

Horizon Client for Android

Horizon Client 4.6 updates include:

  • Android 8.0 Oreo support.
  • Server URL configuration – Allows administrators to configure a list of Connection Servers and a default Connection Server on Android devices managed by VMware AirWatch.

Android and Chrome OS Client Updates

Horizon Client 4.6 for Android and Horizon Client 4.6 for Chrome OS updates include:

  • Simple shortcuts – Users can right-click any application or desktop to add a shortcut to the home screen.
  • Webcam redirection – Integrated webcams on an Android device or a Chromebook are now available for redirection using the Real-Time Audio-Video (RTAV) feature.

HTML Access

HTML Access 4.6 updates include:

  • HTML Access on Android devices – Though HTML Access has fewer features than the native Horizon Client, it allows you to use remote desktops and published applications without installing software.
  • HTML Access page customization – Administrators can customize graphics and text and have those customizations persist through future upgrades.

Horizon Client for Linux

Horizon Client 4.6 updates include:

  • Support for Raspberry Pi 3 Model B devices:
    • ThinLinx operating system (TLXOS) or Stratodesk NoTouch operating system
    • Supported Horizon Client features include:
  • Blast Extreme
  • USB redirection
  • 264 decoding
  • 8000Hz and 16000Hz audio-in sample rate
  • RHEL/CentOS 7.4 support

Horizon Client for Windows 10 UWP

Horizon Client 4.6 updates include:

  • Network recovery improvements – Clients can recover from temporary network loss (up to 2 minutes). This feature was already available for Windows, macOS, Linux, iOS, and Android, and is now available for Windows 10 UWP.
    • Automatically reconnects Blast Extreme sessions
    • Reduces re-authentication prompts

We are excited about these new features in Horizon 7.3.1 and the Horizon Client 4.6.  We hope that you will give them a try.

You can download it here.

If you can‘t send an email with iOS 11 and an Outlook.com or Exchange mail account

You might not be able to send email with an Outlook.com, Office 365, or Exchange account until you update to iOS 11.0.1.

If your email account is hosted by Microsoft on Outlook.com or Office 365, or an Exchange Server 2016 running on Windows Server 2016, you might see this error message when you try to send an email with iOS 11: “Cannot Send Mail. The message was rejected by the server.”

To fix the issue, update to iOS 11.0.1 or later.

EXCHANGE 2013 CU17 AND EXCHANGE 2016 CU6

On June 27, 2017 Microsoft has released its quarterly updates for Exchange 2013 and Exchange 2016. The current version is now at Exchange 2013 CU17 (15.0.1320.4) and Exchange 2016 CU6(15.1.1034.26) . But this time there are some interesting things I’d like to point out.

A couple of days before the release of Exchange 2016 CU6 (15.1.1034.26)
Microsoft blogged about Sent Items Behavior Control and Original Folder Item Recovery. With the Sent Items Behavior Control, a message that’s sent using the Send As or Send on behalf of permission is not only stored in the mailbox of the user that actually sent the message, but a copy is also stored in the delegator mailbox sent items. This was already possible for shared mailboxes, but now it’s also possible for regular mailboxes (like manager/assistant scenarios).

The Original Folder Item Recovery feature is I guess on of the most requested features. In the past (before Exchange 2010) when items were restored after they were deleted, they were restored to their original location. With the Dumpster 2.0 that was introduced with Exchange 2010 this was no longer possible, and items were restored to the deleted items folder. In this case the items had to be moved manually to their original location. With the introduction of the Original Folder Item Recovery the restore of deleted items again takes place in the original folder.

Unfortunately, both Sent Items Behavior Control and Original Folder Item Recovery are only available in Exchange 2016 CU6 (and NOT in Exchange 2013 CU17).

When it comes to security TLS 1.2 is a hot topic. Microsoft is aware of this and working hard towards an Exchange environment that only uses TLS 1.2 (so that TLS 1.1 and TLS 1.0 can be disabled). We are not yet at that stage. Exchange 2016 CU6 does have improved support for TLS 1.2, but Microsoft is not encouraging customers to move to a TLS 1.2 environment only.

.NET Framework and Exchange server continues to be a difficult scenario. This is understandable, Exchange is just a consumer of Windows and .NET so the Exchange Product Group does not have much influence on the .NET (and Windows) Product Group.

Exchange 2016 CU6 does NOT support.NET Framework 4.7 at this moment, and you should NOT install .NET Framework on a server running Exchange 2016. Not before and not after the installation of Exchange 2016 CU6. This is also true for Exchange Server 2013 CU17. More information regarding .NET Framework and Exchange server can be found here: https://blogs.technet.microsoft.com/exchange/2017/06/13/net-framework-4-7-and-exchange-server/.

The .NET Framework 4.6.2 is supported by Exchange 2016 CU3 and higher and Exchange 2013 CU15 and higher. For a complete overview of which scenarios are supported, navigate to the Exchange Server Supportability Matrix on https://technet.microsoft.com/en-us/library/ff728623(v=exchg.150).aspx.

KB articles that describe the fixes, features and information in each release are available as follows:

Version

Build

KB Article

Download

UMLP

Schema Changes

Exchange 2016 CU6

15.1.1034.26

KB4012108

Download

UMLP

Yes

Exchange 2013 CU17

15.0.1320.4

KB4012114

Download

UMLP

No

Source: jaapwesselius

Mobile security is more important than ever!!!

The most used device these days is a mobile phone. Malware/Spyware/Hacking is everywhere, anytime,anywhere See: Update: Lookout re-airing on 60 Minutes

Some latest news about Mobile Security Alerts:

Hundreds of millions of devices potentially affected by first major iOS malware outbreak

Lookout discovers new trojanized adware; 20K popular apps caught in the crossfire

Soo what can you do about it:

Install Security app on your device: So i installed the free version of lookout on my phone.

unnamed

It works great so far: Testing it.

Security Bulletin: iOS “Pegasus” Malware and iOS 9.3.5 Security Update

On Aug. 25, 2016,  Apple announced updates to address security vulnerabilities in iOS version 9.3.4 and earlier. The affected components include the iOS kernel and WebKit.

The vulnerabilities can result in jailbreak, remote code execution, and memory corruption.  Security researchers at Lookout, Inc. have identified a high risk malware application, called “Pegasus”, that uses the vulnerabilities to compromise user devices.

MobileIron recommends that users update to iOS version 9.3.5 or later to obtain the necessary security patches. The security researchers have confirmed that the iOS patches prevent the vulnerabilities from being exploited.

Three vulnerabilities were patched in iOS 9.3.5.  The vulnerabilities are referred to collectively as “Trident”.  The reported CVE identifiers include:

  • CVE-2016-4655: An application may be able to disclose kernel memory.
  • CVE-2016-4656: An application may be able to execute arbitrary code with kernel privileges.
  • CVE-2016-4657: Visiting a maliciously crafted website may lead to arbitrary code execution.

Detection of Pegasus Jailbreak:

According to the security researchers at Lookout, EMM vendors cannot currently detect the Pegasus jailbreak. At this time, the only known method to detect Pegasus is to use products from Lookout.

Source: http://blaud.com/blog/pegasus-malware-ios-9-3-5-security-update_lookout_mobileiron

Setup MDT 2013 (Update 2) to encrypt Windows 10 devices (Laptops) automaticlly

This  will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment:

  • A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password.
  • To configure your environment for BitLocker, you will need to do the following:
  1. Configure Active Directory for BitLocker.
  2. Download the various BitLocker scripts and tools.
  3. Configure the rules (CustomSettings.ini) for BitLocker.

Configure Active Directory for BitLocker

To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory.

Note
Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.

In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information.

figure 2

Figure 2. The BitLocker Recovery information on a computer object in the contoso.com domain.

Add the BitLocker Drive Encryption Administration Utilities

The BitLocker Drive Encryption Administration Utilities are added as features via Server Manager (or Windows PowerShell):

  1. On DC01, log on as CONTOSO\Administrator, and, using Server Manager, click Add roles and features.
  2. On the Before you begin page, click Next.
  3. On the Select installation type page, select Role-based or feature-based installation, and click Next.
  4. On the Select destination server page, select DC01.contoso.com and click Next.
  5. On the Select server roles page, click Next.
  6. On the Select features page, expand Remote Server Administration Tools, expand Feature Administration Tools, select the following features, and then click Next:
    1. BitLocker Drive Encryption Administration Utilities
    2. BitLocker Drive Encryption Tools
    3. BitLocker Recovery Password Viewer
  7. On the Confirm installation selections page, click Install and then click Close.

figure 3

Figure 3. Selecting the BitLocker Drive Encryption Administration Utilities.

Create the BitLocker Group Policy

Following these steps, you enable the backup of BitLocker and TPM recovery information to Active Directory. You also enable the policy for the TPM validation profile.

  1. On DC01, using Group Policy Management, right-click the Contoso organizational unit (OU), and select Create a GPO in this domain, and Link it here.
  2. Assign the name BitLocker Policy to the new Group Policy.
  3. Expand the Contoso OU, right-click the BitLocker Policy, and select Edit. Configure the following policy settings:

    Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives

    1. Enable the Choose how BitLocker-protected operating system drives can be recovered policy, and configure the following settings:
      1. Allow data recovery agent (default)
      2. Save BitLocker recovery information to Active Directory Domain Services (default)
      3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives (Do Not Enable This Winking smile)
    2. Enable the Configure TPM platform validation profile for BIOS-based firmware configurations policy.
    3. Enable the Configure TPM platform validation profile for native UEFI firmware configurations policy.

      Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services

    4. Enable the Turn on TPM backup to Active Directory Domain Services policy.

(Don’t forget to disable Secure Boot & Enable the secure boot again after deployment is succes vol!!)

Set permissions in Active Directory for BitLocker

In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the Add-TPMSelfWriteACE.vbs script from Microsoft to C:\Setup\Scripts on DC01.

  1. On DC01, start an elevated PowerShell prompt (run as Administrator).
  2. Configure the permissions by running the following command: 
    cscript C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs

figure 4

Figure 4. Running the Add-TPMSelfWriteACE.vbs script on DC01.

Add BIOS configuration tools from Dell, HP, and Lenovo

If you want to automate enabling the TPM chip as part of the deployment process, you need to download the vendor tools and add them to your task sequences, either directly or in a script wrapper.

Add tools from Dell

The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named cctk.exe. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool:

cctk.exe --tpm=on --valsetuppwd=Password1234
Add tools from HP

The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here is a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool:

BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234

And the sample content of the TPMEnable.REPSET file:

English
Activate Embedded Security On Next Boot
*Enable
Embedded Security Activation Policy
*No prompts
F1 to Boot
Allow user to reject
Embedded Security Device Availability
*Available
Add tools from Lenovo

The Lenovo tools are a set of VBScripts available as part of the Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide. Lenovo also provides a separate download of the scripts. Here is a sample command to enable TPM using the Lenovo tools:

cscript.exe SetConfig.vbs SecurityChip Active

CustomSettings.ini

[Default]
SkipBitLocker=YES

[LAPTOP]
TaskSequenceID=LAPTOP
MachineObjectOU=OU=Bitlocker,OU=LAPTOPS,OU=Clients,DC=wardvissers,DC=local
BDEKeyLocation=\\mdt01.wardvissers.local\Bitlocker$

Source

Don’t use DHCP Option 60/66/67 when you want to use UEFI & Legacy PXE Boot with MDT

If you want to use EUFI Boot with MDT 2013 Update X.
Don’t use DHCP Option 60/66/67!!!

DC01 = Windows Server 2008 R2 SP1
DC02 = Windows Server 2012
MDT01 = Windows Server 2012 R2

UEFI Client: Dell Laptop E5450
BIOS Client: HyperV Virtual machine with Legacy network adapert

DC1; MDT01 and DHCPServer all in Subnet1.
(IP Helper is set for DHCPServer for DHCP and for DC01 & MDT01 for DHCP and BootP – I checked serveral times if everything is right here)
UEFI Client and BIOS Client in Subnet2.

Situation1 — Using no DHCP Options and WDS running (IP HELPER-ADDRESS):
UEFI Client – Boots perfectly (contacting Server MDT01)
BIOS Client – Boots perfectly (contacting Server MDT01)

Situaion2 — Using no DHCP Options and WDS just running on MDT01:
UEFI Client – Does not boot (no error information is provided)
BIOS Client – Does not boot (no Bootfilename recieved)

Situation3 — Using DHCP Options(Option 66=”IP of MDT01″ Option 67=”\x86\wdsnbp.com”) and WDS just running on MDT01:
UEFI Client – Does not boot (no error information is provided)
BIOS Client – Boots perfectly (contacting Server DP1)

Situation4 — Using DHCP Options(Option 60=”PXEClient” Option 66=”IP of MDT01″ Option 67=”\x86\wdsnbp.com”) and WDS just running on MDT01:
UEFI Client – Boots perfectly (contacting Server DP1)
BIOS Client – Does not boot (taking hours to recieve dhcp options..)

Solution:

On most switches you can configure ip helper-addresses. This is most time al ready configured for the use of DHCP.

Add the IP of the MDT server als ip helper-address:

Example:

interface Vlan100
description GEBRUIKERS VLAN
ip address 192.168.101.254 255.255.254.0 show
ip helper-address 192.168.25.6   (DC01)
ip helper-address 192.168.25.7   (DC02)
ip helper-address 192.168.25.30 (MDT01)
end

MDT 2013 Update 2 (6.3.8330) Released

The Microsoft Deployment Toolkit (MDT) 2013 Update 2 (6.3.8330) is now available on the Microsoft Download Center. This update requires the Windows Assessment and Deployment Kit (ADK) for Windows 10, available on the Microsoft Hardware Dev Center. (Note that there are known issues with the v1511 release of the Windows 10 ADK and System Center Configuration Manager; these issues do not directly affect MDT although may still impact ZTI or UDI scenarios.)

MDT 2013 Update 2 is primarily a quality release; there are no new major features. The following is a summary of the significant changes in this update:

  • Security- and cryptographic-related improvements:
    • Relaxed permissions on newly created deployment shares (still secure by default, but now also functional by default)
    • Creating deployment shares via Windows PowerShell adds same default permissions
    • Updated hash algorithm usage from SHA1 to SHA256
  • Includes the latest Configuration Manager task sequence binaries
  • Enhanced user experience for Windows 10 in-place upgrade task sequence
  • Enhanced split WIM functionality
  • Fixed OSDJoinAccount account usage in UDI scenario
  • Fixed issues with installation of Windows 10 language packs
  • Various accessibility improvements
  • Monitoring correctly displays progress for all scenarios including upgrade
  • Improvements to smsts.log verbosity

There are no other new release notes or significant known issues. See the previous post for more information as much of it is still applicable (other than the fix list above).

See the following post on How to get help with MDT.

Frequently Asked Questions

In anticipation of some questions that you may have about this release (or MDT in general):

Q: Should I expect a release of MDT with every new Windows 10 and/or Configuration Manager build release?

No. We shipped multiple MDT releases this year due to the timing of Windows 10 and Configuration Manager releases, but do not intend to keep that same cadence going forward.

Q: What branches of Windows 10 does MDT support?

MDT supports both the current branch of Windows 10 as well as the long-term servicing branch.

Q: What branches of System Center Configuration Manager does MDT support?

For ZTI and UDI scenarios MDT 2013 Update 2 supports the current branch of System Center Configuration Manager (currently version 1511) for an integrated solution for deploying Windows 10 current branch as well as prior Windows versions.

Q: When is the next planned release of MDT?

We do not currently have a timeframe. We will release any tactical changes as needed which may be required to support new builds of Windows 10 or Configuration Manager, but do not currently expect this to be needed.

Q: Is this the last release of MDT?

No, we will continue to iterate and invest in the product.

Q: Why is it still “MDT 2013” when the year is almost 2016?

Two primary reasons. First, we have only made minor changes to MDT which in our opinion does not constitute a major version revision. Second, per the MDT support lifecycle, a new major version will drop support for MDT2012 Update 1 which still supports legacy platforms.

Source

Translate »