mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 14:23:38 +00:00
Merge branch 'master' into nimishasatapathy-4769890-5newpolicies
This commit is contained in:
Daniel Simpson
GitHub
@ -22,14 +22,15 @@ ms.topic: article
|
||||
|
||||
- Windows 10
|
||||
|
||||
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/user-help/device-management-azuread-joined-devices-setup). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics).
|
||||
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics).
|
||||
|
||||
|
||||
|
||||
## Set up
|
||||
|
||||
- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 are not supported.
|
||||
- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined if using Windows 10 version 1607 and above, or Azure AD registered if using Windows 10 version 2004 and above. Remote connections to an Azure AD joined PC from an unjoined device or a non-Windows 10 device are not supported.
|
||||
- Your local PC (where you are connecting from) must be either Azure AD-joined or Hybrid Azure AD-joined if using Windows 10, version 1607 and above, or [Azure AD registered](https://docs.microsoft.com/azure/active-directory/devices/concept-azure-ad-register) if using Windows 10, version 2004 and above. Remote connections to an Azure AD-joined PC from an unjoined device or a non-Windows 10 device are not supported.
|
||||
- The local PC and remote PC must be in the same Azure AD tenant. Azure AD B2B guests are not supported for Remote desktop.
|
||||
|
||||
Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you are using to connect to the remote PC.
|
||||
|
||||
@ -41,57 +42,45 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
|
||||
|
||||
|
||||
|
||||
3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Click **Select Users -> Add** and enter the name of the user or group.
|
||||
|
||||
> [!NOTE]
|
||||
> You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once, and then running the following PowerShell cmdlet:
|
||||
> ```powershell
|
||||
> net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"
|
||||
> ```
|
||||
> where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD.
|
||||
>
|
||||
> This command only works for AADJ device users already added to any of the local groups (administrators).
|
||||
> Otherwise this command throws the below error. For example:
|
||||
> - for cloud only user: "There is no such global user or group : *name*"
|
||||
> - for synced user: "There is no such global user or group : *name*" </br>
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1709, the user does not have to sign in to the remote device first.
|
||||
>
|
||||
> In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies:
|
||||
|
||||
- Adding users manually
|
||||
|
||||
4. Click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC.
|
||||
You can specify individual Azure AD accounts for remote connections by running the following PowerShell cmdlet:
|
||||
```powershell
|
||||
net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"
|
||||
```
|
||||
where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD.
|
||||
|
||||
> [!TIP]
|
||||
> When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
This command only works for AADJ device users already added to any of the local groups (administrators).
|
||||
Otherwise this command throws the below error. For example:
|
||||
- for cloud only user: "There is no such global user or group : *name*"
|
||||
- for synced user: "There is no such global user or group : *name*" </br>
|
||||
|
||||
> [!Note]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
> [!NOTE]
|
||||
> For devices running Windows 10, version 1703 or earlier, the user must sign in to the remote device first before attempting remote connections.
|
||||
>
|
||||
> Starting in Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
|
||||
- Adding users using policy
|
||||
|
||||
Starting in Windows 10, version 2004, you can add users or Azure AD groups to the Remote Desktop Users using MDM policies as described in [How to manage the local administrators group on Azure AD joined devices](https://docs.microsoft.com/azure/active-directory/devices/assign-local-admin#manage-administrator-privileges-using-azure-ad-groups-preview).
|
||||
|
||||
> [!TIP]
|
||||
> When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com.
|
||||
|
||||
> [!NOTE]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
|
||||
## Supported configurations
|
||||
|
||||
In organizations using integrated Active Directory and Azure AD, you can connect from a Hybrid-joined PC to an Azure AD-joined PC by using any of the following:
|
||||
The table below lists the supported configurations for remotely connecting to an Azure AD-joined PC:
|
||||
|
||||
- Password
|
||||
- Smartcards
|
||||
- Windows Hello for Business, if the domain is managed by Microsoft Endpoint Configuration Manager.
|
||||
| Criteria | RDP from Azure AD registered device| RDP from Azure AD joined device| RDP from hybrid Azure AD joined device |
|
||||
| - | - | - | - |
|
||||
| **Client operating systems**| Windows 10, version 2004 and above| Windows 10, version 1607 and above | Windows 10, version 1607 and above |
|
||||
| **Supported credentials**| Password, smartcard| Password, smartcard, Windows Hello for Business certificate trust | Password, smartcard, Windows Hello for Business certificate trust |
|
||||
|
||||
In organizations using integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to an AD-joined PC when the Azure AD-joined PC is on the corporate network by using any of the following:
|
||||
|
||||
- Password
|
||||
- Smartcards
|
||||
- Windows Hello for Business, if the organization has a mobile device management (MDM) subscription.
|
||||
|
||||
In organizations using integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC by using any of the following:
|
||||
|
||||
- Password
|
||||
- Smartcards
|
||||
- Windows Hello for Business, with or without an MDM subscription.
|
||||
|
||||
In organizations using only Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC by using any of the following:
|
||||
|
||||
- Password
|
||||
- Windows Hello for Business, with or without an MDM subscription.
|
||||
|
||||
> [!NOTE]
|
||||
> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure Active Directory-joined PCs, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities).
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy and configure App-V apps using MDM
|
||||
description: Configure, deploy, and manage Microsoft Application Virtualization (App-V) apps using Microsoft Endpoint Configuration Manager or App-V server.
|
||||
description: Configure, deploy, and manage Microsoft Application Virtualization (App-V) apps using Microsoft Endpoint Manager or App-V server.
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
@ -15,7 +15,7 @@ manager: dansimp
|
||||
|
||||
## Executive summary
|
||||
|
||||
<p>Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies using Microsoft Endpoint Configuration Manager or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.</p>
|
||||
<p>Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies using Microsoft Endpoint Manager or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.</p>
|
||||
|
||||
<p>MDM services can be used to publish App-V packages to clients running Windows 10, version 1703 (or later). All capabilities such as App-V enablement, configuration, and publishing can be completed using the EnterpriseAppVManagement CSP.</p>
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro
|
||||
> [!NOTE]
|
||||
> - Bulk-join is not supported in Azure Active Directory Join.
|
||||
> - Bulk enrollment does not work in Intune standalone environment.
|
||||
> - Bulk enrollment works in Microsoft Endpoint Configuration Manager where the ppkg is generated from the Configuration Manager console.
|
||||
> - Bulk enrollment works in Microsoft Endpoint Manager where the ppkg is generated from the Configuration Manager console.
|
||||
> - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**.
|
||||
|
||||
## What you need
|
||||
|
||||
@ -199,8 +199,111 @@ A Get to the above URI will return the results of the data gathering for the las
|
||||
|
||||
Each data gathering node is annotated with the HRESULT of the action and the collection is also annotated with an overall HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed.
|
||||
|
||||
The zip file which is created also contains a results.xml file whose contents align to the Data section in the SyncML for ArchiveResults. Accordingly, an IT admin using the zip file for troubleshooting can determine the order and success of each directive without needing a permanent record of the SyncML value for DiagnosticArchive/ArchiveResults.
|
||||
### Making use of the uploaded data
|
||||
The zip archive which is created and uploaded by the CSP contains a folder structure like the following:
|
||||
|
||||
```powershell
|
||||
PS C:\> dir C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z
|
||||
|
||||
Directory: C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
la--- 1/4/2021 2:45 PM 1
|
||||
la--- 1/4/2021 2:45 PM 2
|
||||
la--- 12/2/2020 6:27 PM 2701 results.xml
|
||||
```
|
||||
Each data gathering directive from the original `Collection` XML corresponds to a folder in the output. For example, if the first directive was <RegistryKey HRESULT="0">HKLM\Software\Policies</RegistryKey> then folder `1` will contain the corresponding `export.reg` file.
|
||||
|
||||
The `results.xml` file is the authoritative map to the output. It includes a status code for each directive. The order of the directives in the file corresponds to the order of the output folders. Using `results.xml` the administrator can see what data was gathered, what failures may have occurred, and which folders contain which output. For example, the following `results.xml` content indicates that registry export of HKLM\Software\Policies was successful and the data can be found in folder `1`. It also indicates that `netsh.exe wlan show profiles` command failed.
|
||||
|
||||
```xml
|
||||
<Collection HRESULT="0">
|
||||
<ID>268b3056-8c15-47c6-a1bd-4bc257aef7b2</ID>
|
||||
<RegistryKey HRESULT="0">HKLM\Software\Policies</RegistryKey>
|
||||
<Command HRESULT="-2147024895">%windir%\system32\netsh.exe wlan show profiles</Command>
|
||||
</Collection>
|
||||
```
|
||||
|
||||
Administrators can apply automation to 'results.xml' to create their own preferred views of the data. For example, the following PowerShell one-liner extracts from the XML an ordered list of the directives with status code and details.
|
||||
```powershell
|
||||
Select-XML -Path results.xml -XPath '//RegistryKey | //Command | //Events | //FoldersFiles' | Foreach-Object -Begin {$i=1} -Process { [pscustomobject]@{DirectiveNumber=$i; DirectiveHRESULT=$_.Node.HRESULT; DirectiveInput=$_.Node.('#text')} ; $i++}
|
||||
```
|
||||
This example produces output similar to the following:
|
||||
```
|
||||
DirectiveNumber DirectiveHRESULT DirectiveInput
|
||||
--------------- ---------------- --------------
|
||||
1 0 HKLM\Software\Policies
|
||||
2 0 HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
|
||||
3 0 HKLM\Software\Microsoft\IntuneManagementExtension
|
||||
4 0 HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
|
||||
5 0 %windir%\system32\ipconfig.exe /all
|
||||
6 0 %windir%\system32\netsh.exe advfirewall show allprofiles
|
||||
7 0 %windir%\system32\netsh.exe advfirewall show global
|
||||
8 -2147024895 %windir%\system32\netsh.exe wlan show profiles
|
||||
```
|
||||
|
||||
The next example extracts the zip archive into a customized flattened file structure. Each file name includes the directive number, HRESULT, and so on. This example could be customized to make different choices about what information to include in the file names and what formatting choices to make for special characters.
|
||||
|
||||
```powershell
|
||||
param( $DiagnosticArchiveZipPath = "C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z.zip" )
|
||||
|
||||
#region Formatting Choices
|
||||
$flatFileNameTemplate = '({0:D2}) ({3}) (0x{2:X8})'
|
||||
$maxLengthForInputTextPassedToOutput = 80
|
||||
#endregion
|
||||
|
||||
#region Create Output Folders and Expand Zip
|
||||
$diagnosticArchiveTempUnzippedPath = $DiagnosticArchiveZipPath + "_expanded"
|
||||
if(-not (Test-Path $diagnosticArchiveTempUnzippedPath)){mkdir $diagnosticArchiveTempUnzippedPath}
|
||||
$reformattedArchivePath = $DiagnosticArchiveZipPath + "_formatted"
|
||||
if(-not (Test-Path $reformattedArchivePath)){mkdir $reformattedArchivePath}
|
||||
Expand-Archive -Path $DiagnosticArchiveZipPath -DestinationPath $diagnosticArchiveTempUnzippedPath
|
||||
#endregion
|
||||
|
||||
#region Discover and Move/rename Files
|
||||
$resultElements = ([xml](Get-Content -Path (Join-Path -Path $diagnosticArchiveTempUnzippedPath -ChildPath "results.xml"))).Collection.ChildNodes | Foreach-Object{ $_ }
|
||||
$n = 0
|
||||
foreach( $element in $resultElements )
|
||||
{
|
||||
$directiveNumber = $n
|
||||
$n++
|
||||
if($element.Name -eq 'ID'){ continue }
|
||||
$directiveType = $element.Name
|
||||
$directiveStatus = [int]$element.Attributes.ItemOf('HRESULT').psbase.Value
|
||||
$directiveUserInputRaw = $element.InnerText
|
||||
$directiveUserInputFileNameCompatible = $directiveUserInputRaw -replace '[\\|/\[\]<>\:"\?\*%\.\s]','_'
|
||||
$directiveUserInputTrimmed = $directiveUserInputFileNameCompatible.substring(0, [System.Math]::Min($maxLengthForInputTextPassedToOutput, $directiveUserInputFileNameCompatible.Length))
|
||||
$directiveSummaryString = $flatFileNameTemplate -f $directiveNumber,$directiveType,$directiveStatus,$directiveUserInputTrimmed
|
||||
$directiveOutputFolder = Join-Path -Path $diagnosticArchiveTempUnzippedPath -ChildPath $directiveNumber
|
||||
$directiveOutputFiles = Get-ChildItem -Path $directiveOutputFolder -File
|
||||
foreach( $file in $directiveOutputFiles)
|
||||
{
|
||||
$leafSummaryString = $directiveSummaryString,$file.Name -join ' '
|
||||
Copy-Item $file.FullName -Destination (Join-Path -Path $reformattedArchivePath -ChildPath $leafSummaryString)
|
||||
}
|
||||
}
|
||||
#endregion
|
||||
Remove-Item -Path $diagnosticArchiveTempUnzippedPath -Force -Recurse
|
||||
```
|
||||
That example script produces a set of files similar to the following, which can be a useful view for an administrator interactively browsing the results without needing to navigate any sub-folders or refer to `results.xml` repeatedly:
|
||||
|
||||
```powershell
|
||||
PS C:\> dir C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z.zip_formatted | format-table Length,Name
|
||||
|
||||
Length Name
|
||||
------ ----
|
||||
46640 (01) (HKLM_Software_Policies) (0x00000000) export.reg
|
||||
203792 (02) (HKLM_Software_Microsoft_Windows_CurrentVersion_Uninstall) (0x00000000) export.reg
|
||||
214902 (03) (HKLM_Software_Microsoft_IntuneManagementExtension) (0x00000000) export.reg
|
||||
212278 (04) (HKLM_SOFTWARE_WOW6432Node_Microsoft_Windows_CurrentVersion_Uninstall) (0x00000000) export.reg
|
||||
2400 (05) (_windir__system32_ipconfig_exe__all) (0x00000000) output.log
|
||||
2147 (06) (_windir__system32_netsh_exe_advfirewall_show_allprofiles) (0x00000000) output.log
|
||||
1043 (07) (_windir__system32_netsh_exe_advfirewall_show_global) (0x00000000) output.log
|
||||
59 (08) (_windir__system32_netsh_exe_wlan_show_profiles) (0x80070001) output.log
|
||||
1591 (09) (_windir__system32_ping_exe_-n_50_localhost) (0x00000000) output.log
|
||||
5192 (10) (_windir__system32_Dsregcmd_exe__status) (0x00000000) output.log
|
||||
```
|
||||
|
||||
## Policy area
|
||||
|
||||
|
||||
@ -138,10 +138,11 @@ There are two ways to retrieve this file from the device; one pre-GDR1 and one p
|
||||
2. Set a baseline for this configuration item with a “dummy” value (such as zzz), and ensure that you do not remediate it.
|
||||
|
||||
The dummy value is not set; it is only used for comparison.
|
||||
3. After the report XML is sent to the device, Microsoft Endpoint Configuration Manager displays a compliance log that contains the report information. The log can contain significant amount of data.
|
||||
3. After the report XML is sent to the device, Microsoft Endpoint Manager displays a compliance log that contains the report information. The log can contain significant amount of data.
|
||||
4. Parse this log for the report XML content.
|
||||
|
||||
For a step-by-step walkthrough, see [Retrieve a device update report using Microsoft Endpoint Configuration Manager logs](#retrieve-a-device-update-report-using-microsoft-endpoint-configuration-manager-logs).
|
||||
For a step-by-step walkthrough, see [Retrieve a device update report using Microsoft Endpoint Manager logs](#retrieve-a-device-update-report-using-microsoft-endpoint-manager-logs).
|
||||
|
||||
|
||||
**Post-GDR1: Retrieve the report xml file using an SD card**
|
||||
|
||||
@ -460,7 +461,7 @@ DownloadFiles $inputFile $downloadCache $localCacheURL
|
||||
```
|
||||
|
||||
<a href="" id="how-to-retrieve"></a>
|
||||
## Retrieve a device update report using Microsoft Endpoint Configuration Manager logs
|
||||
## Retrieve a device update report using Microsoft Endpoint Manager logs
|
||||
|
||||
**For pre-GDR1 devices**
|
||||
Use this procedure for pre-GDR1 devices:
|
||||
|
||||
@ -31,7 +31,6 @@ Here's the XSD for the ProfileXML node in the VPNv2 CSP and VpnManagementAgent::
|
||||
<xs:element name="AlwaysOn" type="xs:boolean" minOccurs="0" maxOccurs="1" />
|
||||
<xs:element name="DnsSuffix" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="TrustedNetworkDetection" type="xs:string" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="LockDown" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="DeviceTunnel" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="RegisterDNS" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="ByPassForLocal" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
|
||||
@ -442,4 +441,4 @@ Here's the XSD for the ProfileXML node in the VPNv2 CSP and VpnManagementAgent::
|
||||
<PrefixSize>16</PrefixSize>
|
||||
</Route>
|
||||
</VPNProfile>
|
||||
```
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user