One of the new features that came out in SCCM Current Branch 1806 was the ability for the SCCM console to show the currently logged on user.
I had an issue where this field was blank. First thing I checked was that the SCCM client on the device was up to date (1806 or later)
On all clients, in the ccmmessaging.log I noticed:
No reply message from Server. Server may be temporarily down or a transient network error.
Post to http://<mp>/ccm_system_windowsauth/request failed with 0x8000000a.
Then when checking the IIS status codes on the Management Point IIS logs it said:
CCM_POST /ccm_system_windowsauth/request 401.2 (401.2 – Logon failed due to server configuration.)
CCM_POST /ccm_system_windowsauth/request 500.0 (500.0 – Module or ISAPI error occurred.)
This was due to Active Directory User Discovery being disabled in my site.
Once it was enabled and the users were discovered, the errors went away in the ccmmessaging.log and as well as the MP IIS logs. Now the Last logged on username appears in the ConfigMgr console.
Recently I was setting up Co-Management in SCCM Current Branch 1810. I was having issues with clients not being enrolled into Intune.
First I confirmed that the device was Hybrid Azure AD joined (this is a requirement, the device needs to be registered in Azure AD) then when looking at the CoManagementHandler.log file on the client I saw the error:
MDM enrollment failed with error code 0xcaa9001f ‘Integrated Windows authentication supported only in federation flow.’. Will retry in 240 minutes…
I found this error to be misleading. I am using Azure AD Connect with password sync, and not ADFS.
In my case, this error was caused by an enrollment restriction being set that blocked Windows 10 devices from being enrolled.
In Intune (portal.azure.com or devicemanagement.microsoft.com) in Device enrollment > Enrollment restrictions
In my Default restriction in Properties, then Select platforms, I had Windows (MDM) set to Block.
After allowing Windows (MDM) to Allow, the CoManagementHandler.log said Queuing enrollment timer to fire at 01/15/2019 21:42:19 local time
After trying again it was successfully enrolled into Intune and you can see the Managed By now says MDM/ConfigMgr Agent
Intune now has a new Tenant Status section. This new section will give you information about your Intune tenant such as
- Tenant Name
- MDM Authority
- Tenant Location
- Service Release (the Intune build, this is handy to see if the latest Intune build has been released to your tenant)
- Total Licensed Users
- Total Intune Licenses
- Total Enrolled Devices
You can also view the Connector Status of the Auto Pilot last sync date and Windows Store for Business last sync date and others.
Intune Service Health is on the Tenant Status, this will let you know of any issues or active incidents.
Intune News is also there. This includes categories like Stay Informed where you can see whats new in the later builds of Intune, and Prevent or Fix Issues where you can view known issue and resolved issues.
For more information see https://docs.microsoft.com/en-us/intune/tenant-status#intune-service-health
To get to the Tenant Status screen to view information about your Intune Tenant, you will find it in https://portal.azure.com , under Intune, then Tenant Status. Here is what it looks like:
This post will show how you can easily configure Enrollment Restrictions in Intune to prevent personal Windows 10 devices from enrolling into Intune. It will also show what Intune authorizes as corporate enrollment, and the end user experience of when a user with a personal device tries to enroll.
The Intune enrollment restrictions support the following platforms:
- Android work profile
However this post will focus on Windows 10.
Further reading: Set enrollment restrictions https://docs.microsoft.com/en-us/intune/enrollment-restrictions-set
Intune will allow the following corporate methods to be enrolled:
- The enrolling user is using a device enrollment manager account.
- The device enrolls through Windows AutoPilot.
- The device is registered with Windows Autopilot but is not an MDM enrollment only option from Windows Settings.
- The device’s IMEI number is listed in Device enrollment > Corporate device identifiers. (Not supported for Windows Phone 8.1.)
- The device enrolls through a bulk provisioning package.
- The device enrolls through automatic enrollment from SCCM for co-management.
These corporate enrollment methods will be blocked:
- Automatic MDM enrollment with Azure Active Directory join during Windows setup (unless registered with Autopilot)
- Automatic MDM enrollment with Azure Active Directory join from Windows Settings (unless registered with Autopilot)
These personal enrollment methods will be blocked:
- Automatic MDM enrollment with Add Work Account from Windows Settings*.
- MDM enrollment only option from Windows Settings.
How to block the enrollments that aren’t authorized corporate devices:
To block the enrollment of Windows personal devices, inn portal.azure.com or https://devicemanagement.microsoft.com, select Intune, Device Enrollment, Enrollment restrictions, then Create restriction (you can modify the Default restriction if you like, but be careful as it targets all users)
Give it a name, and select Device Type Restriction, then click select platforms. In my example I have allowed all platforms then clicked OK.
Click on Configure platforms. Now for Windows (MDM) I am going to block personal enrollments then click OK.
It now needs to be assigned to a group.
So what happens if I try to enroll a personal Windows 10 device?
Automatic MDM enrollment with Azure Active Directory join during Windows setup (unless registered with Autopilot)
Automatic MDM enrollment with Azure Active Directory join from Windows Settings (unless registered with Autopilot)
Automatic MDM enrollment with Add Work Account from Windows Settings
MDM enrollment only option from Windows Settings.
You can also view the errors in the Enrollment Status page under Device Enrollment. If I click on the Windows data then I can see the Enrollment failures saying Enrollment restrictions not met.