System Center Configuration Manager и как с ним бороться

Microsoft Endpoint Configuration Manager — видео:

• Deploy and manage updates for Windows 10 and Office;
• Enabling remote management: Cloud Management Gateway, Cloud Attach;
• Microsoft Endpoint Manager Configuration Manager Deep Dive.

Microsoft Endpoint Manager — видео:

• Endpoint analytics: putting the end-user experience front and center;
• Unify endpoint security with Microsoft Endpoint Manager and MDATP;
• Teams Deployment and Microsoft End Point Manager;
• What’s new in Microsoft Endpoint Manager. Part 1;
• What’s new in Microsoft Endpoint Manager. Part 2;
• Surface Security: Chip to Cloud Modern Endpoint Protection from Microsoft;
• Zero Touch Deployment with Surface & AutoPilot;
• Enable security and productivity using Microsoft Endpoint Manager;
• Microsoft management tools to secure and manage work from home;
• Managing Android devices with Microsoft Endpoint Manager;
• Managing Apple devices with Microsoft Endpoint Manager;
• Managing Windows devices with Microsoft Endpoint Manager;
• Setting up Windows Update for Business via Microsoft Intune;
• Securing Teams with Microsoft Endpoint Manager;
• Modern policy management for security and productivity;
• Microsoft Endpoint Manager Reporting Graph APIs and Log Analytics;
• What’s new in Microsoft Intune for Education;
• Deep dive into Role Based Access Control (RBAC) in Intune;
• Flexible paths to cloud management with Microsoft Endpoint Manager;
• Intune App Protection Policies with policy assurance;
• Eliminate on-premises print servers with Universal PrintDiscussion Options;
• Configuring zero trust with Microsoft Endpoint Manager;
• Get started with Microsoft Endpoint Manager.

Microsoft Endpoint Manager — интерактивные гайды:

• Manage and protect Mobile and Desktop Applications with Microsoft Endpoint Manager;
• Manage devices with Microsoft Endpoint Manager;

Разное:

• Enable a combined MFA and SSPR registration experience in Azure AD;
• Best practices for deploying Microsoft 365 Apps;
• Monthly Windows update delivery: remote work & business continuity;
• Plan to deploy and manage updates for Windows 10 and Office;
• Tips for managing Windows 10 and Office updates for remote devices;
• Prepare to deploy and manage updates for Windows 10 and Office;
• Windows updates and recovery: smooth + seamless = happy IT and happy users;
• On-premises Windows update management: what’s new, what’s changed.

Intune:

• macOS device management with Microsoft Intune (видео);
• Managing Surface UEFI BIOS settings with Microsoft Intune (слайды, видео);
• One browser for modern and legacy web apps: Deploying Microsoft Edge and Internet Explorer mode (слайды, видео);
• Protected, productive mobile browsing with Microsoft Edge mobile and Microsoft Intune (слайды, видео);
• Reaching for the cloud: Group Policy transformation to MDM with Microsoft Intune (слайды, видео);
• Run your own Windows Insider Program with Group Policy and Intune (видео);
• Supercharge PC and mobile device management: Attach Configuration Manager to Microsoft Intune and the Microsoft 365 cloud (видео);
• How Microsoft uses Intune internally to manage Windows devices (слайды, видео);
• Keep it simple: the unified administrative experience in Microsoft Endpoint Manager (слайды, видео);
• Deep dive: Group Policy transformation to MDM with Microsoft Intune (видео);
• Extend mobile threat protection to bring-your-own-device (BYOD) users (слайды, видео);
• Android device management with Microsoft Intune (слайды, видео).

Autopilot:

• Modern Windows 10 and Office 365 Deployment with Windows Autopilot, Desktop Analytics, and Microsoft Endpoint Manager (видео);
• Windows Autopilot: White glove pre-provisioning (слайды, видео);
• Windows Autopilot: What’s new, what’s coming, and tips for a smooth rollout (видео).

Configuration Manager:

• Run your own Windows Insider Program with WSUS and Configuration Manager (видео);
• Using Desktop Analytics and Configuration Manager to reduce Windows TCO through data-driven insights for management, servicing, and support (видео);
• What’s new in Microsoft Endpoint Manager, including Microsoft Intune and Configuration Manager (Part 1 of 2) (слайды, видео);
• What’s new in Microsoft Endpoint Manager, including Microsoft Intune and Configuration Manager (Part 2 of 2) (слайды, видео);
• Best practices for compatibility assessment and Microsoft Office 365 ProPlus upgrades using Office Readiness in Configuration Manager (видео).

Разное:

• Strategic and tactical considerations for ring-based Windows 10 deployments (видео);
• Streamline and stay current with Windows 10 and Office 365 ProPlus (видео);
• Surface and Microsoft 365 – Securing Today’s Modern Enterprise Endpoint (слайды, видео);
• Surface Autopilot: The easiest deployment for today’s mobile workforce (слайды, видео);
• Why Windows 10 Enterprise and Office 365 ProPlus? Security, privacy, and a great user experience (видео);
• How to capitalize on the best of Microsoft 365 with Microsoft Surface (видео);
• How to manage Windows 7 Extended Security Updates (ESUs) for on-premises and cloud environments (видео);
• EXAM PREP: MS-101 | Microsoft 365 Mobility and Security (слайды, видео);
• Best practices for deploying and managing Microsoft Office 365 ProPlus (слайды, видео).

При попытке обновить MDT Deployment share и получить загрузочные образы видим такую ошибку:

В первую очередь проверяем, используем ли мы последний Windows 10 ADK и существуют ли файлы на диске. Далее пробуем монтировать файл вручную при помощи DISM и видим ошибку «1314 A required privilege is not held by the client»:

В dism.log видим следующую ошибку:

[2316] [0xd0000061] WimApplyPrivileges:(139)
[2316] [0xd0000061] RestoreAllData:(863)
[2316] [0xd0000061] WIMApplyImageInternal:(709)
[2316] [0x80070522] ImageStubMountDirectory:(985): A required privilege is not held by the client.
[2316] [0x80070522] WIMMountImageHandle:(1275): A required privilege is not held by the client.
Error DISM DISM WIM Provider: PID=2316 TID=3052 «Failed to mount the image.» — CWimImageInfo::Mount(hr:0x80070522)

Проблема крылась локальной политике безопасности «Managing auditing and security log». После добавления учётной записи проблема исчезла, т.е. даже если мы работаем под учётной записью, обладающей правами локального администратора, этого недостаточно.

Написал инструкцию по настройке и работе с Upgrade Readiness, правда, на английском языке. Скачать можно здесь.

Привет. На прошлой неделе я выступал на Microsoft Ignite Milan с сессией «Transform device deployment and management with Windows AutoPilot, Intune, and OneDrive». Запись рабочего стола, как обычно, можно найти на моём канале.

Intune:

• Running the Intune Service: automation, auditing, reporting, and roles;
• Improve user experience and secure access to company resources with Microsoft Intune;
• What’s new in Windows 10 mobile device management (MDM);
• Understanding the platforms managed by Microsoft Intune to build mobility solutions;
• Simplify user adoption and increase data security with Microsoft Intune;
• Learn how to leverage Intune support for Microsoft Graph and PowerShell to enable powerful automation and IT security;
• Shared devices for kiosk and Firstline Workers with Windows 10 and Intune;
• Leveraging the Microsoft Store for Business private store with Intune;
• Prepare your organization for Android enterprise management with Microsoft Intune;
• Manage and secure iOS and MacOS devices and apps with Microsoft Intune;
• Managing devices with Microsoft Intune: What’s new and what’s next;
• Specialized device deployments for Windows 10 with Microsoft Intune;
• Deep dive into evolution of Windows app management with Intune;
• Lessons from the field: protecting corporate data on any device with Microsoft Intune;
• Intune for Education, how it works in a School;
• Get started with Intune application protection and conditional access in 20 minutes;
• Fast, easy, and secure provisioning for corporate devices using Microsoft Intune;
• Deep insights and custom reports with Microsoft Intune Data Warehouse.

SCCM:

• Attach the power of Microsoft 365 cloud management and security to Configuration Manager (SCCM);
• A day in the life of an OSD guru;
• What’s new in System Center Configuration Manager;
• Updating your existing Configuration Manager apps to MSIX;
• Expert-level Windows 10 deployment;
• Deep dive into Configuration Manager infrastructure simplification with the cloud;
• Configuration Manager Product Team Chalk Talk.

Autopilot:

• Modern deployment with Windows Autopilot and Microsoft 365 (Part 1 of 2);
• Modern deployment with Windows Autopilot and Microsoft 365 (Part 2 of 2);
• Embracing modern management with Microsoft 365.

Разно-полезное:

• Ask the experts: Successfully deploying, servicing, and managing Windows 10;
• What’s new in Windows Analytics: An introduction to Desktop Analytics;
• Transition to cloud-based management of Windows 10 and Microsoft Office 365 ProPlus with EMS;
• Modern desktop deployment and management with Microsoft 365;
• Managing your deployments with Desktop Analytics;
• Deploying Windows 10 in the enterprise using traditional and modern techniques;
• Deploying Windows 10: Making the update experience smooth and seamless;
• Delivery Optimization deep dive: How to reduce internet bandwidth impact on your network.

 SELECT DISTINCT dbo.v_R_System.Name0, dbo.v_Update_ComplianceStatus.LastEnforcementMessageID, dbo.v_FullCollectionMembership.CollectionID
FROM            dbo.v_R_System INNER JOIN
                         dbo.v_Update_ComplianceStatus ON dbo.v_R_System.ResourceID = dbo.v_Update_ComplianceStatus.ResourceID INNER JOIN
                         dbo.v_FullCollectionMembership ON dbo.v_R_System.ResourceID = dbo.v_FullCollectionMembership.ResourceID
WHERE        (dbo.v_Update_ComplianceStatus.LastEnforcementMessageID = 9) AND (dbo.v_FullCollectionMembership.CollectionID = N'FRA00020')

За последний год накопилась куча ссылок и наконец-то дошли руки опубликовать.

Книги:

• System Center Configuration Manager Current Branch Unleashed;
• Deploying Configuration Manager Current Branch with PKI — Step by Step;
• Deploying Microsoft System Center Configuration Manager;
• System Center Configuration Manager administration e-book.

Windows 10:

• Lynda — Windows 10: Plan and Implement Software Updates;
• Lynda — Windows 10: Provision and Manage Mobile Devices;
• Lynda — Windows 10: Deploy and Manage Virtual Applications;
• Lynda — Windows 10: Plan Desktop and Device Deployment;
• Lynda — Windows as a Service: Planning Deployment;
• ELEU17 — Windows 10 servicing — do’s and don’ts.

ConfigMgr:

• TrueSec — Manage ConfigMgr Internet clients with the Cloud Management Gateway;
• Lynda — Microsoft System Center Configuration Manager Essential Training;
• Packt — Implementing Configuration Manager Features;
• Packt — Managing Mobile Devices with Configuration Manager System Center Current Branch;
• ELEU17 — Are you Afraid of Configuration Managers Power;
• ELEU17 — OSD Front-Ends;
• ELEU17 — OMS and ConfigMgr;
• ELEU17 — ConfigMgr Client Health Strategies;
• ELEU17 — What’s new in the World of Enterprise Client Management.

Intune и Microsoft 365:

• Lynda — Microsoft Enterprise Mobility Suite: Management and Security;
• Lynda — Microsoft Cloud Services: Administering Office 365 and Intune;
• Lynda — Learning Microsoft Enterprise Mobility Suite;
• Lynda — Windows 10: Intune Device Management;
• TrueSec — Understanding, Configuring, and Troubleshooting Windows AutoPilot;
• ELEU17 — Conditional Access with Azure AD and Intune.

Разное:

• Lynda — Learning System Center 2016 Endpoint Protection;
• Lynda — Microsoft Cybersecurity Stack: Identity and Endpoint Protection Basics.

SELECT DISTINCT 
 TOP (100) PERCENT v_R_SYSTEM.Name0 AS 'Physical Servers', dbo.v_RA_System_MACAddresses.MAC_Addresses0 AS [MAC address], 
 V_GS_COMPUTER_SYSTEM.Model0 AS Model, V_GS_OPERATING_SYSTEM.Caption0 AS [Operating System]
FROM dbo.v_R_System INNER JOIN
 dbo.v_GS_COMPUTER_SYSTEM ON V_GS_COMPUTER_SYSTEM.ResourceID = v_R_SYSTEM.ResourceId INNER JOIN
 dbo.v_FullCollectionMembership ON dbo.v_R_System.ResourceID = dbo.v_FullCollectionMembership.ResourceID INNER JOIN
 dbo.v_GS_OPERATING_SYSTEM ON V_GS_OPERATING_SYSTEM.ResourceId = v_R_SYSTEM.ResourceId INNER JOIN
 dbo.v_RA_System_MACAddresses ON dbo.v_R_System.ResourceID = dbo.v_RA_System_MACAddresses.ResourceID
WHERE (V_GS_OPERATING_SYSTEM.Caption0 LIKE '%Server%') AND (v_R_System.Client0 = 1) AND (NOT (V_GS_COMPUTER_SYSTEM.Model0 LIKE '%Virtual%')) 
 AND (dbo.v_FullCollectionMembership.CollectionID = N'FRA00475')
ORDER BY 'Physical Servers'