mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 13:17:23 +00:00
Merge pull request #5491 from MicrosoftDocs/master
Publish 08/09/2021, 3:30 PM
This commit is contained in:
Gary Moore
GitHub
commit
bac09e37da
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Bulk enrollment
|
||||
description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. In Windows 10.
|
||||
description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. In Windows 10 and Windows 11.
|
||||
MS-HAID:
|
||||
- 'p\_phdevicemgmt.bulk\_enrollment'
|
||||
- 'p\_phDeviceMgmt.bulk\_enrollment\_using\_Windows\_provisioning\_tool'
|
||||
@ -18,7 +18,7 @@ ms.date: 06/26/2017
|
||||
|
||||
# Bulk enrollment
|
||||
|
||||
Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. In Windows 10 desktop and mobile devices, you can use the [Provisioning CSP](provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario.
|
||||
Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. In Windows 10 and 11 desktop devices, you can use the [Provisioning CSP](provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario.
|
||||
|
||||
## Typical use cases
|
||||
|
||||
@ -37,27 +37,29 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro
|
||||
> - Bulk enrollment does not work in Intune standalone environment.
|
||||
> - Bulk enrollment works in Microsoft Endpoint Manager where the ppkg is generated from the Configuration Manager console.
|
||||
> - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**.
|
||||
> - Bulk Token creation is not supported with federated accounts.
|
||||
|
||||
## What you need
|
||||
|
||||
- Windows 10 devices
|
||||
- Windows Imaging and Configuration Designer (ICD) tool
|
||||
To get the ICD tool, download the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information about the ICD tool, see [Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) and [Getting started with Windows ICD](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
- Enrollment credentials (domain account for enrollment, generic enrollment credentials for MDM, enrollment certificate for MDM.)
|
||||
- Windows 10 devices.
|
||||
- Windows Configuration Designer (WCD) tool.
|
||||
|
||||
To get the WCD tool, download from the [Microsoft Store](https://www.microsoft.com/store/productId/9NBLGGH4TX22). For more information about the WCD tool, see [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) and [Getting started with Windows WCD](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
- Enrollment credentials (domain account for enrollment, generic enrollment credentials for MDM, enrollment certificate for MDM.).
|
||||
- Wi-Fi credentials, computer name scheme, and anything else required by your organization.
|
||||
|
||||
Some organizations require custom APNs to be provisioned before talking to the enrollment endpoint or custom VPN to join a domain.
|
||||
|
||||
## Create and apply a provisioning package for on-premises authentication
|
||||
|
||||
Using the ICD, create a provisioning package using the enrollment information required by your organization. Ensure that you have all the configuration settings.
|
||||
Using the WCD, create a provisioning package using the enrollment information required by your organization. Ensure that you have all the configuration settings.
|
||||
|
||||
1. Open the Windows ICD tool (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
|
||||
1. Open the WCD tool.
|
||||
2. Click **Advanced Provisioning**.
|
||||
|
||||
|
||||
3. Enter a project name and click **Next**.
|
||||
4. Select **All Windows editions**, since Provisioning CSP is common to all Windows 10 editions, then click **Next**.
|
||||
4. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then click **Next**.
|
||||
5. Skip **Import a provisioning package (optional)** and click **Finish**.
|
||||
6. Expand **Runtime settings** > **Workplace**.
|
||||
7. Click **Enrollments**, enter a value in **UPN**, and then click **Add**.
|
||||
@ -70,8 +72,9 @@ Using the ICD, create a provisioning package using the enrollment information re
|
||||
- **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank.
|
||||
- **Secret** - Password
|
||||
For detailed descriptions of these settings, see [Provisioning CSP](provisioning-csp.md).
|
||||
Here is the screenshot of the ICD at this point.
|
||||
|
||||
Here is the screenshot of the WCD at this point.
|
||||
|
||||
|
||||
9. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (e.g., **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**).
|
||||
10. When you are done adding all the settings, on the **File** menu, click **Save**.
|
||||
11. On the main menu click **Export** > **Provisioning package**.
|
||||
@ -90,12 +93,12 @@ Using the ICD, create a provisioning package using the enrollment information re
|
||||
|
||||
## Create and apply a provisioning package for certificate authentication
|
||||
|
||||
Using the ICD, create a provisioning package using the enrollment information required by your organization. Ensure that you have all the configuration settings.
|
||||
Using the WCD, create a provisioning package using the enrollment information required by your organization. Ensure that you have all the configuration settings.
|
||||
|
||||
1. Open the Windows ICD tool (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
|
||||
1. Open the WCD tool.
|
||||
2. Click **Advanced Provisioning**.
|
||||
3. Enter a project name and click **Next**.
|
||||
4. Select **Common to all Windows editions**, since Provisioning CSP is common to all Windows 10 editions.
|
||||
4. Select **Common to all Windows editions**, since Provisioning CSP is common to all Windows editions.
|
||||
5. Skip **Import a provisioning package (optional)** and click **Finish**.
|
||||
6. Specify the certificate.
|
||||
1. Go to **Runtime settings** > **Certificates** > **ClientCertificates**.
|
||||
@ -129,8 +132,7 @@ Using the ICD, create a provisioning package using the enrollment information re
|
||||
Here's the list of topics about applying a provisioning package:
|
||||
|
||||
- [Apply a package on the first-run setup screen (out-of-the-box experience)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment#apply-package) - topic in Technet.
|
||||
- [Apply a package to a Windows 10 desktop edition image](/windows/configuration/provisioning-packages/provisioning-create-package#to_apply_a_provisioning_package_to_a_desktop_image) - topic in MSDN
|
||||
- [Apply a package to a Windows 10 Mobile image](/windows/configuration/provisioning-packages/provisioning-create-package#to_apply_a_provisioning_package_to_a_mobile_image) - topic in MSDN.
|
||||
- [Apply a package to a Windows desktop edition image](/windows/configuration/provisioning-packages/provisioning-create-package#to_apply_a_provisioning_package_to_a_desktop_image) - topic in MSDN
|
||||
- [Apply a package from the Settings menu](#apply-a-package-from-the-settings-menu) - topic below
|
||||
|
||||
## Apply a package from the Settings menu
|
||||
|
||||
@ -679,6 +679,11 @@ Sign-in a workstation with access equivalent to a _domain user_.
|
||||
|
||||
10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list.
|
||||
11. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate.
|
||||
|
||||
> [!NOTE]
|
||||
> If the distinguished name contains special characters like a plus sign ("+"), comma (","), semicolon (";"), or equal sign ("="), the bracketed name must be enclosed in quotation marks: CN=”{{OnPrem_Distinguished_Name}}”.
|
||||
> If the length of the distinguished name is more than 64 characters, the name length enforcement on the Certification Authority [must be disabled](/previous-versions/windows/it-pro/windows-server-2003/cc784789(v=ws.10)?#disable-dn-length-enforcement).
|
||||
|
||||
12. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}.
|
||||
13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to the configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**.
|
||||
14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile.
|
||||
@ -712,4 +717,4 @@ You have successfully completed the configuration. Add users that need to enrol
|
||||
> * Install and Configure the NDES Role
|
||||
> * Configure Network Device Enrollment Services to work with Microsoft Intune
|
||||
> * Download, Install, and Configure the Intune Certificate Connector
|
||||
> * Create and Assign a Simple Certificate Enrollment Protocol (SCEP Certificate Profile)
|
||||
> * Create and Assign a Simple Certificate Enrollment Protocol (SCEP Certificate Profile)
|
||||
|
||||
@ -86,6 +86,32 @@ To enable 3090 allow events, and 3091 and 3092 events, you must instead create a
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300
|
||||
```
|
||||
|
||||
## System Integrity Policy Options
|
||||
The WDAC policy rule-option values can be derived from the "Options" field in the Details section of the Code integrity 3099 event. To parse the values, first convert the hex value to binary. Next, use the bit addresses and their values from the table below to determine the state of each [policy rule-option](/select-types-of-rules-to-create#table-1-windows-defender-application-control-policy---rule-options).
|
||||
|
||||
| Bit Address | Policy Rule Option |
|
||||
|-------|------|
|
||||
| 2 | `Enabled:UMCI` |
|
||||
| 3 | `Enabled:Boot Menu Protection` |
|
||||
| 4 | `Enabled:Intelligent Security Graph Authorization` |
|
||||
| 5 | `Enabled:Invalidate EAs on Reboot` |
|
||||
| 7 | `Required:WHQL` |
|
||||
| 10 | `Enabled:Allow Supplemental Policies` |
|
||||
| 11 | `Disabled:Runtime FilePath Rule Protection` |
|
||||
| 13 | `Enabled:Revoked Expired As Unsigned` |
|
||||
| 16 | `Enabled:Audit Mode (Default)` |
|
||||
| 17 | `Disabled:Flight Signing` |
|
||||
| 18 | `Enabled:Inherit Default Policy` |
|
||||
| 19 | `Enabled:Unsigned System Integrity Policy (Default)` |
|
||||
| 20 | `Enabled:Dynamic Code Security` |
|
||||
| 21 | `Required:EV Signers` |
|
||||
| 22 | `Enabled:Boot Audit on Failure` |
|
||||
| 23 | `Enabled:Advanced Boot Options Menu` |
|
||||
| 24 | `Disabled:Script Enforcement` |
|
||||
| 25 | `Required:Enforce Store Applications` |
|
||||
| 27 | `Enabled:Managed Installer` |
|
||||
| 28 | `Enabled:Update Policy No Reboot` |
|
||||
|
||||
## Appendix
|
||||
A list of other relevant event IDs and their corresponding description.
|
||||
|
||||
|
||||
@ -70,6 +70,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru
|
||||
| **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. NOTE: This option is only supported on Windows 10, version 1903, and above. | No |
|
||||
| **18 Disabled:Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. NOTE: This option is only supported on Windows 10, version 1903, and above. | Yes |
|
||||
| **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries. NOTE: This option is only supported on Windows 10, version 1803, and above. | No |
|
||||
| **20 Enabled:Revoked Expired As Unsigned** | Use this option to treat binaries signed with expired and/or revoked certificates as "Unsigned binaries" for user-mode process/components under enterprise signing scenarios. | No |
|
||||
|
||||
## Windows Defender Application Control file rule levels
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user