If you are experiencing problems with connecting to Office 365 or Exchange Online using Powershell after enabling Modern Authentication (Multi Factor Authentication) Check out this fantastic guide to solving the problem, and how you can add the information required to your Powershell Profile. All Credit to Cogmotive.com
For many schools, regardless of size, device deployment poses significant challenges, as it is during deployment that group policies are set, data is secured, devices are readied, and essential applications are enabled. Historically, this task has taken a disproportionate amount of time. As a result, schools interested in using educational technology to improve student learning outcomes have turned to ways to manage those devices with less time and effort, so that more IT time can be spent in more strategic, directly supportive functions. Today, as the digital revolution rolls on, cloud-based deployment solutions are available to simplify this task. Read more about the challenges facing EDU IT and how cloud-based solutions like Intune for Education can help address them in the whitepaper The State of Modern Device Deployment in Education.
With the new and simple Intune for Education step-by-step Express Configuration wizard, Education IT selects a group for devices or users, also the specific apps that we wanted to be available, and key configuration settings from those most often used in schools. IT can use a USB drive to set up Windows 10 for each device and the enroll the device in Intune management via Azure AD. That is all they need to do and they can do it in less than an hour. Learn more about using the Intune for Education with the article What is Intune for Education?
If it’s a mixed device environment and/or more enterprise-grade policies are needed, they can move seamlessly to the Intune console and then back to Intune for Education for simplified Windows 10 device management. Ongoing management is also painless with a centralized console for updates and monitoring. Learn more about using full Intune with the Introduction to Intune article.
You can compare the different use cases with the article How is Intune for Education different from the full device management experience in Intune? Note: schools that are licensed for Intune for Education will also have access to the full Intune console.
With Azure AD identity as the backbone, user and device groups (i.e. schools, classes, grades) update automatically while providing insights to IT on usage patterns and any possible threats to the security of their users. Due to this common identity, all the devices and users that show up and are managed in Intune for Education will also be manageable in full Intune. This also means that you can leverage the new co-management capabilities with ConfigMgr in either Intune for Education or full Intune.
To find out more about Azure AD features in Intune for Education compared to other education offers, click on Learn what Azure Active Directory features come with Intune or Education and other plans at the top of the Intune for Education page. Note that customers can have Azure Premium and Azure AD EDU, with Office 365 or Intune for Education, assigned together or separately with no issues removing one or the other. You can also get your free 90-trial of Intune for Education (with full Intune) on this page too!
Containers are a way to wrap up an application into its own isolated box. For the application in its container, it has no knowledge of any other applications or processes that exist outside of its box. Everything the application depends on to run successfully also lives inside this container. Wherever the box may move, the application will always be satisfied because it is bundled up with everything it needs to run.
Imagine a kitchen. We package up all the appliances and furniture, the pots and pans, the dish soap and hand towels. This is our container
We can now take this container and drop it into whatever host apartment we want, and it will be the same kitchen. All we must do is connect electricity and water to it, and then we’re clear to start cooking (because we have all the appliances we need!)
In much the same way, containers are like this kitchen. There can be different kinds of rooms as well as many of the same kinds of rooms. What matters is that the containers come packaged up with everything they need.
Watch a short overview here: Windows-based containers: Modern app development with enterprise-grade control.
Containers are an isolated, resource controlled, and portable runtime environment which runs on a host machine or virtual machine. An application or process which runs in a container is packaged with all the required dependencies and configuration files; It’s given the illusion that there are no other processes running outside of its container.
The container’s host provisions a set of resources for the container and the container will use only these resources. As far as the container knows, no other resources exist outside of what it has been given and therefore cannot touch resources which may have been provisioned for a neighboring container.
The following key concepts will be helpful as you begin creating and working with Windows Containers.
Container Host: Physical or Virtual computer system configured with the Windows Container feature. The container host will run one or more Windows Containers.
Container Image: As modifications are made to a containers file system or registry—such as with software installation—they are captured in a sandbox. In many cases you may want to capture this state such that new containers can be created that inherit these changes. That’s what an image is – once the container has stopped you can either discard that sandbox or you can convert it into a new container image. For example, let’s imagine that you have deployed a container from the Windows Server Core OS image. You then install MySQL into this container. Creating a new image from this container would act as a deployable version of the container. This image would only contain the changes made (MySQL), however it would work as a layer on top of the Container OS Image.
Sandbox: Once a container has been started, all write actions such as file system modifications, registry modifications or software installations are captured in this ‘sandbox’ layer.
Container OS Image: Containers are deployed from images. The container OS image is the first layer in potentially many image layers that make up a container. This image provides the operating system environment. A Container OS Image is immutable. That is, it cannot be modified.
Container Repository: Each time a container image is created, the container image and its dependencies are stored in a local repository. These images can be reused many times on the container host. The container images can also be stored in a public or private registry, such as DockerHub, so that they can be used across many different container hosts.
For someone familiar with virtual machines, containers may appear to be incredibly similar. A container runs an operating system, has a file system and can be accessed over a network just as if it was a physical or virtual computer system. However, the technology and concepts behind containers are vastly different from virtual machines.
Mark Russinovich, Microsoft Azure guru, has a great blog post which details the differences.
Windows Containers include two different container types, or runtimes.
Windows Server Containers – provide application isolation through process and namespace isolation technology. A Windows Server Container shares a kernel with the container host and all containers running on the host. These containers do not provide a hostile security boundary and should not be used to isolate untrusted code. Because of the shared kernel space, these containers require the same kernel version and configuration.
Hyper-V Isolation – expands on the isolation provided by Windows Server Containers by running each container in a highly optimized virtual machine. In this configuration, the kernel of the container host is not shared with other containers on the same host. These containers are designed for hostile multitenant hosting with the same security assurances of a virtual machine. Since these containers do not share the kernel with the host or other containers on the host, they can run kernels with different versions and configurations (with in supported versions) – for example all Windows containers on Windows 10 use Hyper-V isolation to utilize the Windows Server kernel version and configuration.
Running a container on Windows with or without Hyper-V Isolation is a runtime decision. You may elect to create the container with Hyper-V isolation initially and later at runtime choose to run it instead as a Windows Server container.
As you read about containers, you’ll inevitably hear about Docker. Docker is the vessel by which container images are packaged and delivered. This automated process produces images (effectively templates) which may then be run anywhere—on premises, in the cloud, or on a personal machine—as a container.
Just like any other container, a Windows Server Container can be managed with Docker.
From a developer’s desktop, to a testing machine, to a set of production machines, a Docker image can be created that will deploy identically across any environment in seconds. This story has created a massive and growing ecosystem of applications packaged in Docker containers with DockerHub, the public containerized-application registry that Docker maintains, currently publishing more than 180,000 applications in the public community repository.
When you containerize an app, only the app and the components needed to run the app are combined into an “image”. Containers are then created from this image as you need them. You can also use an image as a baseline to create another image, making image creation even faster. Multiple containers can share the same image, which means containers start very quickly and use fewer resources. For example, you can use containers to spin up light-weight and portable app components – or ‘micro-services’ – for distributed apps and quickly scale each service separately.
Because the container has everything it needs to run your application, they are very portable and can run on any machine that is running Windows Server 2016. You can create and test containers locally, then deploy that same container image to your company’s private cloud, public cloud or service provider. The natural agility of Containers supports modern app development patterns in large scale, virtualized cloud environments.
With containers, developers can build an app in any language. These apps are completely portable and can run anywhere – laptop, desktop, server, private cloud, public cloud or service provider – without any code changes.
Containers help developers build and ship higher-quality applications, faster.
IT Professionals can use containers to provide standardized environments for their development, QA, and production teams. They no longer have to worry about complex installation and configuration steps. By using containers, systems administrators abstract away differences in OS installations and underlying infrastructure.
Containers help admins create an infrastructure that is simpler to update and maintain.
Ready to begin leveraging the awesome power of containers? Hit the jumps below to get a hands-on with deploying your very first container:
For users on Windows Server, go here – Windows Server Quick Start Introduction
For users on Windows 10, go here – Windows 10 Quick Start Introduction+
Update 1710 for System Center Configuration Manager current branch is available as an in-console update for previously installed sites that run version 1610, 1702, or 1706.
The following sections provide details about changes and new capabilities introduced in version 1710 of Configuration Manager.
Beginning with this release, Peer Cache is no longer a pre-release feature. No other changes for Peer Cache are introduced with this release. For more information, see Peer Cache for Configuration Manager clients.
You can now use cloud-based distribution points in the Azure Government cloud.
As devices now include hard drives with sizes in the gigabyte (GB), terabyte (TB) and larger scales, this release changes the default unit (SMS_Units) used in many views from megabytes (MB) to GB. For example, the v_gs_LogicalDisk.FreeSpace value now reports GB units.
In the previous Windows 10 updates, you can already join a Windows 10 device to on-premises Active Directory (AD) and cloud-based Azure AD at the same time (hybrid Azure AD). Starting with Configuration Manager version 1710, co-management takes advantage of this improvement and enables you to concurrently manage Windows 10, version 1709 (also known as the Fall Creators Update) devices by using both Configuration Manager and Intune. It’s a solution that provides a bridge from traditional to modern management and gives you a path to make the transition using a phased approach. For details, see Co-management for Windows 10 devices.
Beginning with this release, you can use the Configuration Manager console to identify client devices that require a restart, and then use a client notification action to restart them.
See How to manage clients in System Center Configuration Manager
This release brings several improvements to the Run Scripts feature, which lets you deploy PowerShell scripts to run on managed devices. This feature was first introduced in version 1706.
Improvements include:
For more on using Run Scripts, see Create and run scripts.
The following settings have been added to the mobile application management policy settings:
With this release, Software Center will no longer distort icons that are larger than 250×250. Software Center made such icons look blurry. You can now set an icon with a pixel dimensions of up to 512×512, and it displays without distortion.
To add an icon for your app in Software Center, see Create applications.
Tip
Beginning with the Windows 10, version 1709 (also known as the Fall Creators Update) release, Windows media includes multiple editions. When configuring a task sequence to use an operating system upgrade package or operating system image, be sure to select an edition that is supported for use by Configuration Manager.
You can add a new task sequence step that runs another task sequence, which creates a parent/child relationship between the task sequences. This allows you to create more modular task sequences that you can re-use.
To learn more about the child task sequence, see Child task sequence.
You can add enterprise branding elements and specify the visibility of tabs on Software Center. You can add your Software Center specific company name, set a Software Center configuration color theme, set a company logo, and set the visible tabs for client devices.
For more information, see Plan for and configure application management in System Center Configuration Manager.
Beginning with this release, managing Surface driver updates is no longer a pre-release feature.
You can now set the Windows 10 telemetry data collection level to Enhanced (Limited). This setting enables you to gain actionable insight about devices in your environment without devices reporting all of the data in the Enhanced telemetry level with Windows 10 version 1709 or later.
For more information, see How to configure client settings in System Center Configuration Manager.
You can now configure a time-ordered sequence of actions that are applied to devices that fall out of compliance. For example, you can notify users of non-compliant devices via e-mail or mark those devices non-compliant. For details, see Set up actions for non-compliance.
Hybrid mobile device management (MDM) scenarios will be supported on ARM64 devices running Windows 10 when these devices are available.
These scenarios include:
Note
Deploying .appxbundle applications built for multiple architectures may not work on these devices, and this scenario is not supported at this time.
With this release, we’ve updated the VPN profile wizard and properties pages to display settings appropriate for the selected platform:
These changes apply to new VPN profiles.
To minimize compatibility risk, existing VPN profiles are unchanged. When you edit an existing profile, the settings appear as they did when the profile was created.
For more information, see VPN Profiles on mobile devices in System Center Configuration Manager.
Configuration Manager has limited support for Cryptography: Next Generation (CNG) certificates. Configuration Manager clients can use PKI client authentication certificate with private key in CNG Key Storage Provider (KSP). With KSP support, Configuration Manager clients support hardware-based private key, such as TPM KSP for PKI client authentication certificates.
For more information, see CNG certificates overview.
You can create and deploy policies that manage all four components of Windows Defender Exploit Guard, including attack surface reduction, controlled folder access, exploit protection, and network protection.
You can create and deploy Windows Defender Application Guard policies by using the Configuration Manager endpoint protection.
The following three changes have been made in relation to Device Guard policies:
Thanks for visiting, AT Computer Consultants Ltd are based in the North West of England and provide high quality technical training and consultancy services based around Microsoft System Center, Windows Azure, and Microsoft Office 365.
Whatever your needs, we can provide a total solution, working together with you from that initial spark of an idea, through it’s planning and to it’s realisation.
Founded in January 2003 by Tony Law and Alan Moss, both of whom have passion and a drive for all forms of technology, we have an outstanding reputation for customer service, and for a personal focus. The fact that the majority of business is generated by personal referrals from existing customers speaks volumes.
We have a wealth of experience working with Academic Institutes, Public Sector, Defence and flagship training providers.