This document discusses various options for managing Windows 10 devices, including Group Policy, Microsoft Intune mobile device management (MDM), and the built-in Windows 10 MDM capabilities. It covers features of Intune management and Windows 10 MDM, and analogizes Intune to the "blue pill" and Windows 10 MDM to the "red pill" from The Matrix. It also discusses provisioning packages, Azure Active Directory join, managing personal vs corporate devices, and various Windows 10 management features.

1. ccmexec
http://ccmexec.comBlog:

2. TWO NEW SHERIFFS IN TOWN

3. MANAGEMENT OPTIONS

4. WINDOWS 10 MANAGEMENT
• GROUP POLICIES WILL STILL WORK BUT….
• MDM POLICIES WILL HAVE A LOT OF THE SAME CAPABILITITES
• FEATURES LIKE ENTERPRISE DATA PROTECTION, DEVICE HEALTH ATTESTATION WILL REQUIRE ONE OF THE
TWO SHERIFFS.

5. WINDOWS MANAGEMENT FEATURES
Windows Client
WindowsManagementInstrumentation(WMI)
WindowsRemoteManagement(WinRM)
WindowsUpdate
GroupPolicyClient
Windows Server
ActiveDirectory
GroupPolicy
WindowsServerUpdateServices(WSUS)
Products
SystemCenterConfigurationManager
MicrosoftDesktopOptimizationPack(MDOP) Cloud Services
AzureActiveDirectory
AzureRMS
MicrosoftIntune
WindowsStore
WindowsUpdate
MobileDeviceManagement(MDM)
PowerShell
AppLocker

6. INTUNE MANAGEMENT
• ” THIS IS YOUR LAST CHANCE. AFTER THIS, THERE IS NO TURNING BACK. YOU TAKE THE BLUE PILL - THE
STORY ENDS, YOU WAKE UP IN YOUR BED AND BELIEVE WHATEVER YOU WANT TO BELIEVE. YOU TAKE THE
RED PILL - YOU STAY IN WONDERLAND AND I SHOW YOU HOW DEEP THE RABBIT-HOLE GOES.”
“THE MATRIX”
• BLUE PILL = INTUNE MANAGEMENT WITH THE INTUNE AGENT
• RED PILL = WINDOWS 10 MANAGEMENT WITH THE MDM AGENT

7. BLUE PILL – INTUNE MANAGEMENT
• SAME FEATURES AS BEFORE IN INTUNE EXCEPT..
• WINDOWS DEFENDER MANAGEMENT REPLACES THE ENDPOINT PROTECTION CLIENT.

8. RED PILL – THE FUTURE OF MANAGEMENT
• MANAGEMENT WITH THE BUILTIN MDM AGENT
• BRING-YOUR-OWN-DEVICE
• MANY MORE FEATURES IN WINDOWS 10
• MAC OSX SUPPORT COMING
• INTEGRATION WITH AZURE AD JOIN
• CUSTOM POLICIES
• COMING FEATURES ENTERPRISE DATA PROTECTION, DEVICE HEALTH ATTESTATION

9. MOBILE DEVICE MANAGEMENT
Significantinvestmentsinaddedfunctionalityforbothmobileanddesktopdevices
BYOD: simple security settings
Device Lockdown
Fully managed corporate device
Windows 8.1 Windows 10

10. MDM IN WINDOWS 10
Oneconsistent
set
ofMDM
capabilities
acrossMobile,
Desktop,and
Embedded
products
 Provisioning
 Bulk enrollment
 Simple bootstrap
 Converged protocol
 Azure AD Integration
 Greatly extended set of policies
(Parity with Windows Phone 8.1)
 Context based policies
 Client certificates – Direct install (PFX)
 Enterprise Wi-Fi
 VPN management
 Email provisioning
 MDM Push when user not logged in
 Device Update control
 Kiosk Mode, Start screen / Start menu
configuration and control
 Curated Windows Store
 Business Store Portal app
deployment; License reclaim/re-use
 Enterprise App management
 Simplified LOB app management
 Win32 app management
 App inventory (MDM/store apps)
 App allow/deny lists through
Applocker
 Enterprise data protection
 Full device wipe
 Remote Lock, PIN reset, Ring, Find
 Enhanced inventory for compliance
decisions
 Un-enrollment in two phases & alerts
 Removal of Enterprise configuration
(apps, certs, profiles, policies) and
Enterprise encrypted data (with EDP)
 Additional device inventory

11. WINDOWS 10 CUSTOM POLICY
• OPEN MOBILE ALLIANCE DEVICE MANAGEMENT (OMA DM)
• OPEN MOBILE ALLIANCE UNIFORM RESOURCE IDENTIFIER (OMA URI)
• WINDOWS 10 MOBILE AND DESKTOP
• INTUNE AND CONFIGURATION MANAGER
• HTTPS://MSDN.MICROSOFT.COM/EN-
US/LIBRARY/WINDOWS/HARDWARE/DN904962%28V=VS.85%29.ASPX

12. WINDOWS 10 & INTUNE

13. WINDOWS 10 IDENTITY CHOICES
• ComputerjoinsAD
toestablishtrust
• UsersignsonusingADaccount
• GroupPolicy+SystemCenter
• ComputerjoinsAzureADtoestablishtrust
• UsersignsonusingAzureADaccount
• Intune/MDM
• Settingsroaming
Single sign-on to enterprise + cloud-based services

14. AZURE AD JOIN
• SINGLE SIGN ON TO APPS PROTECTED BY AZURE AD (OFFICE 365)
• SYNCED BACK ON-PREM FOR USE IN ADFS
• CONDITIONAL ACCESS FOR OFFICE 365
• CONDITIONAL ACCESS FOR ON-PREMISE (ADFS)

15. REQUIREMENTS AZURE AD JOIN/INTUNE
• EMS / AZURE AD PREMIUM / INTUNE SUBSCRIPTION
• AZURE AD CONNECT TO SYNCHRONIZE YOUR IDENTITIES
• REGISTER YOUR DOMAINNAME
• ADFS OR PASSWORD SYNC
DNS:
• ENTERPRISEENROLLMENT.YOURDOMAIN.COM
• ENTERPRISEREGISTRATION.YOURDOMAIN.COM

16. PERSONAL VS CORPORATE DEVICES
PERSONAL DEVICE
• INTUNE ENROLLMENT FORCES A WORKPLACE JOIN
IN AZURE AD
• ENROLLED DEVICE=PERSONAL DEVICE
CORPORATE DEVICE
• AZURE AD JOIN, OPTIONAL INTUNE ENROLLEMENT.
• ENROLLED DEVICE = CORPORATE DEVICE
• GLOBAL ADMINISTRATORS ARE MADE LOCAL
ADMINISTRATORS
• ADD ADDITIONAL LOCAL ADMINISTRATORS

17. AZURE AD JOIN

18. PROVISIONING PACKAGES
• QUICKLY CONFIGURE A NEW DEVICE WITHOUT GOING THROUGH THE PROCESS OF INSTALLING A NEW
IMAGE.
• SAVE TIME BY CONFIGURING MULTIPLE DEVICES USING ONE PROVISIONING PACKAGE.
• QUICKLY CONFIGURE EMPLOYEE-OWNED DEVICES IN AN ORGANIZATION WITHOUT A MOBILE DEVICE
MANAGEMENT (MDM) INFRASTRUCTURE.
• SET UP A DEVICE WITHOUT THE DEVICE HAVING NETWORK CONNECTIVITY.

19. PROVISIONING PACKAGES
• APPLICATIONS WINDOWS APPS, LINE-OF-BUSINESS APPLICATIONS
• BULK ENROLLMENT INTO MDM AUTOMATIC ENROLLMENT INTO MICROSOFT INTUNE OR A THIRD-PARTY
MDM SERVICE
• CERTIFICATES ROOT CERTIFICATION AUTHORITY (CA), CLIENT CERTIFICATES
• CONNECTIVITY PROFILES WI-FI, PROXY SETTINGS, EMAIL
• MUCH MORE…

20. PROVISIONING PACKAGE

21. POP QUIZ - WHICH FEATURE IS THIS OLD
NUGGET?
• LOCAL ADMIN PASSWORD SOLUTION (LAPS)
• EHANCED MITIGATION EXPERIENCE TOOLKIT (EMET)
• DRIVERS ERRORS
• APPLICATIONS ERRORS
• UNTRUSTED FONT BLOCKING
EVENT FORWARDING!

22. COMMUNITY SOLUTIONS
• IF YOU DON’T USE ANY CLIENT MONITORING TOOL
• USE EVENT FORWARDING!
COMMUNITY SOLUTION
• POWERSHELL SCRIPT TO WRITE FORWARDED EVENT LOGS TO A SQL DATABASE
HTTPS://BLOG.NETNERDS.NET/2013/03/IMPORTING-WINDOWS-FORWARDED-EVENTS-INTO-SQL-SERVER-
USING-POWERSHELL/

24. EDGE
FAVORITES LOCATION
• %USERPROFILE%APPDATALOCALPACKAGESMICROSOFT.MICROSOFTEDGE_8WEKYB3D8BBWEACMI
CROSOFTEDGEUSERDEFAULT
TO COPY FAVORITES THE FOLLOWING REGISTRY KEY MUST BE DELETED AS WELL OTHERWISE COPIED
FAVORITES WILL NOT SHOW UP.
”HKEY_CLASSES_ROOTLOCAL
SETTINGSSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONAPPCONTAINERSTORAGEMICROSOFT.
MICROSOFTEDGE_8WEKYB3D8BBWEMICROSOFTEDGEFAVORDER”

25. EDGE
• YOU CANNOT IMPORT FAVORITES FROM IE IF
FOLDER REDIRECTION IS USED.
• FAVORITES CAN ONLY BE IMPORTED FROM
%USERPROFILE%FAVORITES
• USE POWERSHELL:
HTTPS://GALLERY.TECHNET.MICROSOFT.COM/PO
WERHSELL-SCRIPT-TO-COPY-1E300DE5

26. UNINSTALL BUILT-IN APPS
• FOR CURRENT USER, USE:
• REMOVE-APPXPACKAGE
• TO REMOVE THEM FOR ALL NEW USERS CREATING THEIR PROFILE.
• REMOVE-APPXPROVISIONEDPACKAGE
HTTP://CCMEXEC.COM/2015/08/REMOVING-BUILT-IN-APPS-FROM-WINDOWS-10-USING-POWERSHELL/

27. BLOCK BUILT-IN APPS USING APPLOCKER
• EDGE, WINDOWS FEEDBACK, CONTACT SUPPORT CANNOT BE UNINSTALLED.
• IF BLOCKED WITH APPLOCKER AND THE POLICY IS APLIED TO THE COMPUTER BEFORE THE USER LOGS IN
THE FIRST TIME. THE APPLICATIONIS NOT INSTALLED FOR THE USER AT ALL.
HTTP://CCMEXEC.COM/2015/08/BLOCKING-BUILT-IN-APPS-IN-WINDOWS-10-USING-APPLOCKER/

28. QUESTIONS?