Intune – Rename iOS devices with Intune Powershell SDK

This will be the first post in a series where I will cover Graph API and in this specific post how we can rename iOS devices that’s being managed by Intune in a more automatic way then going in to the Intune portal and manually renaming them. There’s several levels of automation that can be achieved ranging from manual automation (Manually running a script) to full blown automation with the help of either schedule task running on a computer or using Azure automation and there’s a few challenges along the way that needs to be taken under consideration and ironed out.

 

A couple of weeks ago Microsoft announced bulk renaming of devices with DEP (Deployment enrollment program) and you can now configure the DEP profile to rename the device during enrollment.

 

https://docs.microsoft.com/en-us/intune/whats-new#bulk-device-naming-when-enrolling-corporate-ios-devices

 

Bulk device naming when enrolling corporate iOS devices

When using one of Apple’s corporate enrollment methods (DEP/ABM/ASM), you can set a device name format to automatically name incoming iOS devices. You can specify a format that includes the device type and serial number in your template. To do so, choose Intune > Device enrollment > Apple enrollment > Enrollment program tokens > Select a token >Create profile > Device naming format. You can edit existing profiles, but only newly synced devices will have the name applied.

 

This is a great feature but won’t solve the issue for already enrolled devices. These you still need to either manually rename or factory reset to re-enroll once the configuration is set.

 

In this post we will take a look at using the Intune Powershell SDK to rename iPad’s which in my opinion has the lowest barrier for entry and the least amount of work/complexity to rename iPad’s in Intune on a large scale without needing to do manually rename every iPad within the Intune portal (See picture below). To do this we are going to use the Intune Powershell SDK and for more info about that and how to get started with it check out my post here: https://timmyit.com/2018/10/22/intune-powershell-sdk/

 

 

Overview

The script is fairly simple due to the fact that we are using the Intune Powershell SDK that handles all the webrequest to Graph API “behind the scenes” with the help of the cmdlets thats been created for this powershell module.

 

Once you downloaded and Installed the Intune Powershell SDK module (If you dont know how to do this check out my other blog post here https://timmyit.com/2018/10/22/intune-powershell-sdk/ Then you can to use the sample script provided below.

 

Side note.

When you start an iPad for the first time or do a factory reset the default name will be “iPad”. Some organization doesn’t want to use that name for different reasons and if you would like to have another name then serial number of the device then you need to be able to get that information and map that to a unique iOS device.

 

Rename one specific iOS device

 

If you want to change the name of one specific iOS device you can use the sample below. We need to identify the device we want to change and the easiest way is to do that by serial number. Change the serial number between the single quotation mark from XXXXXXXXXX to the specific serial number for the iPad you want to change as seen in the picture below. Remember that we are only able to rename iOS devices which are supervised thats why we are only filtering on Serial number and if the device is supervised.

 

In this example we are changing the name from iPad or iPhone to the serial number of the device.

 

Important Note. 

As per today there’s a bug in the SDK which causes the Update-IntuneManagedDevice cmdlet not to work as intended when trying to rename a deivce using the cmdlt. Microsoft is aware of the problem and an issue has been raised on githib https://github.com/microsoft/Intune-PowerShell-SDK/issues/29

 

The good thing is that there’s a work around and that’s to use the Invoke-MSGraphRequest cmdlt from the SDK.

 

 

Connect-MSGraph

$Device = Get-IntuneManagedDevice -Filter "contains(serialNumber,'XXXXXXXXXX')"

$DeviceID = $Device.id
$Resource = "deviceManagement/managedDevices('$DeviceID')/setDeviceName"
$graphApiVersion = "Beta"
$uri = "https://graph.microsoft.com/$graphApiVersion/$($resource)"

$JSONName = @"
{
deviceName:"$($Device.serialNumber)"
}
"@

Invoke-MSGraphRequest -HttpMethod POST -Url $uri -Content $JSONName

 

Once we ran the script and go back in to the Intune console, we can find the device and see that there’s a client action pending to rename the device

 

 

 

Rename all company owned and supervised iOS devices

 

The script will start with importing the module then connect to Graph API and here you will need to enter your credentials to your tenant. Then we will get all iOS devices that’s being managed by Intune and is company owned and supervised.  Once that’s done we will go through each devices that got collected and check to see if the current name is equal to the Serial number of the device, if it is nothing will happen and if it’s not we will rename that devies and set the new name to be the serial number of the device.

 

 

Connect-MSGraph

$AlliOSDevices = Get-IntuneManagedDevice -Filter "(contains(operatingsystem, 'iOS')%20and%20isSupervised eq true)"

Foreach ($AlliOS in $AlliOSDevices)
{

$DeviceID = $Device.id
$Resource = "deviceManagement/managedDevices('$DeviceID')/setDeviceName"
$graphApiVersion = "Beta"
$uri = "https://graph.microsoft.com/$graphApiVersion/$($resource)"

$JSONName = @"
{
deviceName:"$($Device.serialNumber)"
}
"@


if ($AlliOS.deviceName -ne $AlliOS.serialNumber)
{

Invoke-MSGraphRequest -HttpMethod POST -Url $uri -Content $JSONName


}


}

 

 

 

 

Leave a comment or question in the comment section below.

 

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

Intune – Show VPP account information directly from the Client Apps view for easier management

One challange I hear from customers and other IT Pros working with VPP (Volume purchase program) applications from Apple in Intune is that it if you have multiple VPP accounts and need to manage the application deployment for those in Intune there’s no way of seeing which app is linked to a specific VPP account from the Client App -> App overview pane without clicking on the specific app and in the Overview see which VPP account this application was bought with.

 

 

Since there’s no column in the Client app -> App overview for showing the VPP account it can be tedious if one application has been bought by several accounts but you need to deploy the app from a specific VPP account or if you just want to have an easy overview.

 

 

 

To solve this I came up with the Idea of using the Owner column and to populate the VPP account information there so we can see it from the App overview pane. And Instead of manually inputting this information for all the VPP apps I turned to our beloved friend Powershell to help us out. There are several levels of automation that can be done but in this post I’m just going to focus on one of the simplest way to get started in my opinion.

 

Tools to our disposal – Intune Powershell SDK

 

If this is the first time you hear of the Intune Powershell SDK i recommend you check out my earlier blog post on what it is and how to get started here: https://timmyit.com/2018/10/22/intune-powershell-sdk/

 

The Intune Powershell SDK is an easy way of doing administrative tasks with the help of all the cmdlets that the SDK includes. And if you don’t want to use the SDK and still do the same things that’s also possible since the SDK uses the power of Graph API and invoke-restmethod so you can create your own functions and cmdlets if you feel the need for that but to keep it simple I will not cover that in this post but let me know if that’s something that interest you for a future post.

 

The script and execution

 

Here’s the script we’re going to use after the fact that you have Installed the Intune Powershell SDK that’s covered in my post https://timmyit.com/2018/10/22/intune-powershell-sdk/

The first thing thats going to happen is that we need to import the module and then we call the Connect-MSGraph cmdlet that will make prompt for a logon to your tenant. From there we will get all the VPP apps that’s been synced with Intune and store that in a variable.

Once we have all the apps the script will go through all the apps one by one and check if the Owner property of the app object is either Null or empty and if it is we will then update the Owner property with the same information the vppTokenAppleId property currently have.

 

Import-Module .\Microsoft.Graph.Intune.psd1
Connect-MSGraph
$AllVPPApps = (Get-DeviceAppManagement_MobileApps | Where-Object { ($_.'@odata.type').contains("#microsoft.graph.iosVppApp") })


Foreach ($AllVPPApp in $AllVPPApps)
    {
        if ([string]::IsNullOrEmpty($AllVPPApp.owner))
            {
               
            $AllVPPApp | Update-DeviceAppManagement_MobileApps -owner $AllVPPApp.vppTokenAppleId
                 
                
            }
    }

 

Once the script succesfully finish we can now see that the owner property have been updated on all the VPP apps by running the following command

 

Get-DeviceAppManagement_MobileApps | Where-Object { ($_.'@odata.type').contains("#microsoft.graph.iosVppApp") } | Select-Object displayName, owner, vppTokenAppleId 

 

 

What we can do now is to head back to the Intune portal and Client App – Apps click on Columns and select Owner and click Apply. 

 

 

From the list of all applications we can now see which which VPP account each VPP application have been bought with.

 

 

Leave a comment or question in the comment section below.

 

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

MDM join an already Azure AD joined Windows 10 PCs to Intune with a provisioning package

 

When working with a client the other day an Interesting situation came up where they had already used Azure AD for a while and now were ready to start using Intune for managing their Windows 10 PC’s. Prior to that they haven’t had any device management like ConfigMgr or Intune before. They also didn’t have any on-prem Active Directory and were only using cloud services like Azure AD and Office 365.

 

The question that came up was:

How do we enroll existing Windows 10 machines in Azure AD in to Intune and how can we do that with the minimum amount of effort from the end-user?

 

One of the ways to do it is by enabling the Enable automatic MDM enrollment using default Azure AD credentials policy but the client didn’t want their end-users or admins manually going in and enable that policy on each machine. So the discussion continued on how could me make it easier for the end user to do the things needed to enroll their device. In this post I will cover both the manual of doing it by enabling the policy but this is mainly to give it some context and from their I will show you how it can be done with the help of a provisioning package.

Once you have the provisioning package in place it’s just a matter of delivering it to the end-user in the most simple way possible and let the end-user run the provisioning package.

 

 

Enable automatic MDM enrollment using default Azure AD credentials

 

On all Windows 10 1703 and newer version of Windows there’s a local group policy that can be set to enroll in to MDM using logged on Azure credentials, this comes in handy in a 1 to 1 scenario where the end-user has their dedicated devices. If you have on-prem AD you can create a GPO for this policy but in this example we don’t have an on-prem AD.

Microsoft documentation can be found here:

https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

 

 

On the local machine, go to the Windows 10 start menu and search for “Edit group policy” and open it up with Administrative privileges.

 

 

Navigate to to Computer Configuration -> Administrative Templates -> Windows Components -> MDM and open up Enable automatic MDM enrollment using default Azure AD credentials and choose “Enable” and click on “Apply” and “Ok”

 

 

Once’s this is done 2 things happens,

 

This registry key gets created

HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM\AutoEnrollMDM = 1

 

And a schedule task gets created by the name of “Schedule created by enrollment client for automatically enrolling in MDM from AAD” which can be found in the task scheduler under

Microsoft -> Windows -> EnterpriseMgmt

 

 

 

Logs and Monitoring

 

Once the everything is in place you can monitor the process in Event Viewer

 

From my own testing and experience you will see the following Error message “Auto MDM Enroll Failed (Unknown Win32 Error code 0x8018002b)” for a couple of hours but that’s totally normal and nothing to worry about.

 

 

In this specific example it took about 5 hours before it succeeded to do the MDM join and during this time a user was logged on to the machine. If the machine has no user logged on to it or its put to sleep or turned off the MDM join won’t happen.

 

 

Windows 10 provisioning package and Windows Configuration Designer

 

As mentioned earlier in this post if you have on-prem AD you can create a GPO for this policy an roll out it that way. But if you have no on-prem infrastructure at all to we have to find a easy way for the end-user so we can MDM join them without having to manually go in to local policy and enable the policy.

 

Microsoft documentation on Provisioning package and Windows Configuration Designer can be found here:

https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-packages

https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-install-icd

 

Side note.

In Windows Configuration Designer you are able to something called ADMXIngestion where you can inject ADMX files and configure their settings however I haven’t been able to get that to work when it comes to the MDM policy and its ADMX file. I’m not exactly sure why and while I’m trying to solve that I will instead focus this post on how to get around it and create the same settings as the policy does but with a powershell script instead.

 

Once you installed Windows Configuration Designer from either the Windows ADK or Microsoft Store it’s time to create the provisioning package we are about to use but to make this work.

We also need a powershell script and a .bat file that calls the powershell script within the provisioning package because there are some challenges when it comes to running powershell scripts directly.

 

The scripts

 

In this example we will be using MDMPS.ps1 as our powershell script and MDM.bat

With powershell we create a registry key and a Schedule task which is the same schedule task that runs if one manually enables the MDM join policy on the local computer.

 

<#   
    .NOTES
    ===========================================================================
     Created on:    12/12/2018 
     Modified on:   12/12/2018 
     Created by:    Timmy Andersson
     Twitter:       @TimmyITdotcom
     Blog:          www.timmyit.com & https://blog.ctglobalservices.com/author/tan/
    ===========================================================================
    .DESCRIPTION
        MDM Join script. Creates a registry key and a schedule task to start the process to MDM join a computer. 
#>

Begin{

$RegKey ="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\"
$RegKey1 ="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM"
$ScheduleName = "Schedule created by enrollment client for automatically enrolling in MDM from AAD"
$Date = Get-Date -Format "yyyy-MM-dd"
$Time = (Get-date).AddMinutes(5).ToString("HH:mm:ss")

$ST = @"
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>Microsoft Corporation</Author>
<URI>\Microsoft\Windows\EnterpriseMgmt\Schedule created by enrollment client for automatically enrolling in MDM from AAD</URI>
<SecurityDescriptor>D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;LS)</SecurityDescriptor>
</RegistrationInfo>
<Triggers>
<TimeTrigger>
<Repetition>
<Interval>PT5M</Interval>
<Duration>P1D</Duration>
<StopAtDurationEnd>true</StopAtDurationEnd>
</Repetition>
<StartBoundary>$($Date)T$($Time)</StartBoundary>
<Enabled>true</Enabled>
</TimeTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<UserId>S-1-5-18</UserId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>Queue</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>true</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>false</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>%windir%\system32\deviceenroller.exe</Command>
<Arguments>/c /AutoEnrollMDM</Arguments>
</Exec>
</Actions>
</Task>

"@

}
Process
{

New-Item -Path $RegKey -Name MDM
New-ItemProperty -Path $RegKey1 -Name AutoEnrollMDM -Value 1

(Register-ScheduledTask -XML $ST -TaskName $ScheduleName -Force) | Out-null

}

 

Bat file executing the powershell script from the provisioning package

 

powershell.exe -noprofile -executionpolicy bypass -Command "& '%~dpn0PS.ps1'"

 

 

Putting it all together

 

Start with saving the powershell script and the .bat file. Once’s thats done open up Windows Configuration Designer and under the create section click on “Advanced provisioning” 

 

Select “All Windows desktop editions

 

 

In the next step just click on “Finish” there’s no need to import a provisioning package.

 

 

 

Navigate to Runtime Settings -> ProvisioningCommands -> DeviceContext -> CommandFiles

Click on “Browse” and find the .PS1 script file and click on “Add” repeat this for the .Bat file as well.

 

You should now see the 2 added files under CommandFiles. In this example the MDMPS is the powershell script and MDM is the .Bat script.

 

 

 

Next thing is to click on “CommandLine” and add write “cmd.exe /c MDM.bat” this will tell the provisioning pack to run the .bat file and the .bat file will run the powershell script.

 

Now we just need to export the provisioning pack and to do so you click on “Export -> Provisioning package” in the top left corner

 

 

Give the provisioning package a name and click on “Next

 

 

You can encrypt the package or sign it with a certificate if you want, but since there’s no unique/sensitive or secret information in this specific package you don’t need to do this. Click “Next

 

 

Choose the path where you want to save your provisioning package to and click on “Next” 

 

 

Click “Build 

 

 

On the last page click on “Finish

 

 

Go the file location where you save the file and grab your newly created provisioning package

 

 

 

Applying provisioning package

 

When it comes to distribution there’s not much we can do without any prior management or on-prem AD so with this one solution is to just email the package to the end-users and just write a small guide on how they apply it.

 

There’s a few different ways of applying a provisioning package but in this example we will cover one way.

 

The file needs to be present on a Windows 10 1703 or later PC where the end user is logged on with their Azure AD credentials.

 

Double click on the provisioning package


 

If UAC is turned on and gives you a popup, click “Yes

 

a provisioning package warning will appear if its not signed, Click on “Yes, add it

 

 

And that’s it.

 

The powershell script will now create the schedule task and create the registry key needed to do the MDM Join. A few hours later the machine will be MDM Joined in the same way if you enabled the policy. For logs for the MDM join see the section Logs and Monitoring in this blog post.

 

If you want to make sure the provisioning package has been applied you can go to Windows start menu -> Settings -> Account -> Access Work or School  -> Add or Remove provisioning package 

 

 

 

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

Intune Powershell SDK

 

 

For those who want to administrate Intune with the help of powershell there’s been a good source of sample scripts over at https://github.com/microsoftgraph/powershell-intune-samples for quite some time now. If you want to interact with Intune, Azure, O365 and more you need to use Microsofts Graph API. To get started with Intune and Graph API I recommend you take a look at Niall Brady’s post on how to get started

https://www.niallbrady.com/2017/08/23/getting-started-with-microsoft-graph-and-using-powershell-to-automate-things-in-intune/

 

During Microsoft Ignite 2018 in Orlando there was a session about a Powershell SDK for Intune which was very intressting because it removes some of the barriers for people who are used to Powershell but not might have the time to dive in to Graph API specifially. The SDK contains cmdlets that communicates through Graph API behind the scenes but you as the adminstrator doesnt have to think about doing webrequest to the API and so on.

 

https://github.com/Microsoft/Intune-PowerShell-SDK

 

I highly recommend wathing the session “Learn how to leverage Intune support for Microsoft Graph and Powershell to enable powerful automation and IT security” from Ignite 2018 about the SDK.

 

 

 

Here’s just a quick walkthrough on how to get started and use the SDK.

 

Download the SDK from https://github.com/Microsoft/Intune-PowerShell-SDK

 

Once downloaded, extract it and import the module in to Powershell

 


Import-Module .\Microsoft.Graph.Intune.psd1

 

Run Connect-MSGraph and logon to the tenant

 

Connect-MSGraph 

 

 

You are now connected and are able to use all the cmdlets against your tenant.

For example

 

Get-DeviceAppManagement_MobileApps

 

Will get all applications under MobileApps (Client Apps is the new name in the Intune console)

 

 

 

To list all available cmdlets in the Powershell module just do the following in powershell. As of this post there’s 1311 cmdlets which is pretty impressive I have to say for something
thats just a preview.

 

Get-Command -Module Microsoft.Graph.Intune 

 

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

ConfigMgr Current Branch 1802 – Phased deployments

 

Late January Microsoft introduced something they called phased deployment in the technical preview 1801 for ConfigMgr and I went through the feature in a blog post here: https://timmyit.com/2018/01/22/configmgr-technical-preview-1801-phased-deployment

 

2 months later we now have a new ConfigMgr current branch release version 1802 and with that we now have the phased deployment as a pre-release feature in latest version of ConfigMgr Current Branch.

Here’s a blogpost from Miocrosoft talking about some of the new features in this release:

https://cloudblogs.microsoft.com/enterprisemobility/2018/03/22/now-available-update-1802-for-system-center-configuration-manager/

Where they mention this new feature:

  • Phased deployments – Phased deployments automate a coordinated, sequenced roll out of software without creating multiple deployments.

 

Activating Phased deployment

 

Since this is a pre-release feature you need to specify that you want to activate this feature before you can use it, this can be done either during the upgrade process or from the ConfigMgr console as soon as you have updated to version 1802.

 

Recommend you also check out this doc about pre-release features from Microsoft

https://docs.microsoft.com/en-us/sccm/core/servers/manage/pre-release-features

 

First you need to make sure you have activated the option to use pre-release features, this how you do it:

  1. Go to “Administration”
  2. Expand “Site Configuration” and click on “Sites”
  3. Choose the site you want to configure and click on “Hierarchy Settings”
  4. Under “General” make sure you have checked the “Consent to use Pre-release features”

 

 

Once that’s done you need to activate the Phased deployment feature it self

  1. Go to Administration
  2. Expand”Update and servicing” and click on “Features”
  3. Find the Phased deployment feature and right-click on it and choose “turn on”
  4. Reopen the ConfigMgr Console

 

 

 

Creating a Phased deployment

 

Microsoft Docs:

https://docs.microsoft.com/en-us/sccm/osd/deploy-use/create-phased-deployment-for-task-sequence

 

Let’s take a quick look at this and head over to a task sequence and in this particular case we will try to do a phased deployment with the “Awesome task sequence” and from there we will right-click on the Task sequence and choose ” Create Phased deployment” (We also have an icon for to do this see picture 2)

 

 

A wizard will appear were we need to specify a name and choose our pilot collection and production collection

 

 

Once we clicked “Next” we get some options to configure

 

  • Criteria for success of the first phase
    • Deployment success percentage – Were we can specify a critera between 0-100 %

 

  • Conditions for beginning the the second phase of deployment after success of the first phase
    • Automatically begin this phase after a deferral period in days – Pick how many days after the success of the first phase the production deployment should start. (From my own testing if you choose 0 days it will start within minutes once the the deployment success percentage has been reached)
    • Manually begin the second phase deployment – Determine if we want to start it manually or not

 

  • Once the device is targeted, apply the upgrade
    • As soon as possible
    • Deadline time (relative to the time the device is targeted) – Choose between hours, days, weeks, months

 

 

Click “next” and you will get an overview of the different deployment phases, you can reorder them, Add and Edit.

 

 

Continue to the end of the wizard and once done you will find the phased deployments

 

 

As we can see in the previous pic there’s one Phased deployment and at this time we only have 1 deployment because that deployment haven’t reached the success percentage we configured in the wizard.

 

 

You also have a few options on the Phased deployment to either manually move it  to the next phase or if you want to suspend the phases by right-clicking on the phased deployment or by selecting it and do it from the bar at the top.

 

 

Once the first phase has reached the success percentage we configured and the clients have reported back to ConfigMgr within a few minutes ( Becasue we configured the “Automatically begin this phase after a deferral period in days” to 0, if we would have gone with 1 day deferral it would wait until that time to kick off phase 2 )

 

 

There’s a bunch more settings we could have gone through but I will leave at this as for now and probably do a video showcasing it more in depth.

 

I didn’t touch on troubleshooting in this post but if you want to look at the log files these are the ones that you should look to over at the primary site server.

SMS_PhasedDeployment.log

SMSProv.log

 

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

 

 

#configmgr, #features, #phased-deployments

ConfigMgr Technical Preview 1801 – Phased deployments

 

The ConfigMgr product group just keeps on producing builds for us to test out and here is the latest one, ConfigMgr Technical Preview 1801. One of the new features they introduced that caught my attention was something they called “Phased deployment” and in the documentation

they wrote:

 

Phased deployments automate a coordinated, sequenced rollout of software without creating multiple deployments. In this Technical Preview version, the phased deployment wizard can be completed for task sequences in the admin console. However, deployments are not created.

 

Links to the ConfigMgr Technical Preview 1801 docs and info :

 

https://docs.microsoft.com/en-us/sccm/core/get-started/capabilities-in-technical-preview-1801

https://cloudblogs.microsoft.com/enterprisemobility/2018/01/22/update-1801-for-configuration-manager-technical-preview-branch-available-now/

 

Let’s take a quick look at this and head over a task sequence and in this particualar case we will try to do a phased deployment with the “Awesome task sequence” and from there we will right-click on the TS and choose ” Create Phased deployment”

 

 

A wizard will appear were we need to specify a name and choose our pilot collection and production collection

 

Once we clicked “Next” we get some options to configure and they seem to be self explanatory

 

  • Criteria for success of the pilot phase
    • Deployment success percentage – Were we can specify a critera between 0-100 %

 

  • Conditions for  beginning the production phase of deployment
    • Automatically begin this many days after the success of the pilot phase – Pick how many days after the success of the pilot phase the production deployment should start
    • Wait for me to manually being this phase of deployment – Determine if we want to start it manually

 

  • Once the production phase begins, target all the devices within days – Choose number of days

 

  • Once the device is targeted, apply the upgrade
    • As soon as possible
    • Deadline time (relative to the time of the device is targeted) – Choose between hours, days, weeks, months

 

 

Click “next” and you will get an overview of the different phases

 

 

Next up is to set a failure rate where the deployments will be stopped if the failure rate is above X procent

 

 

 

 

Once done with the Wizard you will find the phased deployment under the lower statusbar.

 

 

As stated in the release docs for 1801 the phased deployment in this release doesn’t create any deployments so the feature Isnt “working” yet but I personally think its a really good Idea thats needs some fine tuning for sure but the concept Is awesome ! Can’t wait for the “updated” version of this feature so we can play around some more with it.

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

#configmgr, #technical-preview, #technical-preview-1801, #tp1801

ConfigMgr Technical Preview 1710 – Run script update

 

Last night for us Europeans there was another ConfigMgr Technical Preview release and this time its version 1710. There are many new great features indroduced to this Technical Preview and the full overview you can find over at Microsoft.

https://docs.microsoft.com/en-us/sccm/core/get-started/capabilities-in-technical-preview-1710

 

In this post I will focus on one of the things that i find the most exciting in regards to the Run Script feature which is a way to almost in real-time execute powershell scripts directly on clients.

See my other posts on this feature if you need to get up to speed on what it is and how to use it:

 

http://blog.ctglobalservices.com/powershell/tan/how-to-activate-the-new-feature-run-powershell-scripts-from-the-configmgr-console-on-current-branch-1706/

http://blog.ctglobalservices.com/powershell/tan/create-and-run-scripts-with-the-new-feature-run-powershell-scripts-from-the-configmgr-console-on-current-branch-1706/

https://timmyit.com/2017/09/18/baseline-evaluation-with-run-script-feature-in-configmgr-1706/

 

 

 

The Wizard

 

One of the big updates here is the wizard and the ability to get realtime output to show up in the wizard during execution of the script.

When executing the script you will see a green statusbar that indicates that somethings i happening and under that you know have box that will populate with data onces the client have runned the script and reported back which just takes a few seconds.

 

(Side note, The script I’m running below is just a Ping to localhost on each client)

 

 

One of the options you have is the “Script details” found in the botton left corner and here you will se information like “Script name, Script Version, Last modified Time, Collection ID”

 

 

In the middle you have “Summary” which is the default one you will see and from here you can change how you want to view the data.

The data you can view is

  • Script output
  • Script Exit code

and you can view them as

  • Bar Chart
  • Pie Chart
  • Data table

 

 

You can also view this information on scripts you ran histroically if you go to Monitoring -> Script Status and right-click and than click on Show status (You will also able to preview the some information in the lower part of the console)

 

 

After clicking on Show Status you will get prompted by this windows containing all the info we saw in the Wizard when executing the script and can sort the data in the same way.

 

Parameters

The next thing i want to showcase is the Parameter functionallity which gives us the ability to specify a parameter when executing the script towards a collection. Here we are creating a new script which is called “Ping Parameter”

and in this script we will add a parameter and then do a ping with a variable based on that parameter.

 

 

Once clicking “Next” we get option to Edit the Parameter

 

 

From here we can change a few options like Data Type, required true or false etc. Also able to add a Description that will show up later when executing the script.

 

 

Once configured click next and then you have to approve the script as always. Next step is to run the script and when we do that we get the following option now to enter a parameter. In this case we need to enter the computer name we want to ping with the ping script we just created.

The description box shows the information we wrote earlier telling the user who executes the script some information about the parameter and what they need to enter.

 

 

We run the script and gets prompted with information as expected

 

 

but if we check under “Script Details” we find additional information on the parameter we entered

 

 

 

These are really cool additions to this great feature and I’m really happy that the ConfigMgr team just keep on working on it and add functionallity. Hopefully we can see some of these changes to the pre-release feature in the next ConfigMgr CB build.

 

 

That’s all for now and until next time, cheers !

Don’t forget to follow me on twitter

 

And you can also find me blogging over at http://blog.ctglobalservices.com/

 

 

#configmgr, #powershell, #run-script, #technical-preview, #technical-preview-1710