Wake on LAN in ConfigMgr 1810 and 802.1x authentication

I recently carried out some testing on the new Wake on LAN feature of ConfigMgr 1810 and published the result in this blog post. One of the things I pointed out was that the feature was not supported using 802.1x authentication. I wondered why so I carried out some additional research.

As with all Microsoft support statements, just because something is not supported doesn't mean that it will not work. It's either untested or will not work in all scenarios. This is the case with WoL and 802.1x authentication.

802.1x is a standard for port-based network access control that provides authenticated network access to 802.11 wireless networks and wired Ethernet networks. Port-based network access control uses the physical characteristics of a switched LAN infrastructure to authenticate devices that are attached to a LAN port and to prevent access to that port in cases where the authentication process fails. One of the features of 802.1x is that devices are quarantined when they are turned off. Therefore the switch ports becomes blocked in both directions and prevents the WoL magic packet from being delivered - a chicken and egg situation. 

I figured that this couldn't a new problem and that it would be possible to overcome this in the enterprise. I was right. I researched the main networking vendors and found that they had solutions.

Cisco

The 802.1X authentication with Wake-on-LAN (WoL) feature solves the problem. When a host that uses WoL is attached through an 802.1X port and the host powers off, the 802.1X port becomes unauthorized. The port can only receive and send EAPOL packets, and WoL magic packets cannot reach the host. When the PC is powered off, it is not authorized, and the switch port is not opened.

When the switch uses 802.1X authentication with WoL, the switch forwards traffic to unauthorized 802.1X ports, including magic packets. While the port is unauthorized, the switch continues to block ingress traffic other than EAPOL packets. The host can receive packets but cannot send packets to other devices in the network. 

• When you configure a port as unidirectional by using the dot1x control-direction in interface configuration command, the port changes to the spanning-tree forwarding state. The port can send packets to the host but cannot receive packets from the host. 
• When you configure a port as bidirectional by using the dot1x control-direction both interface configuration command, the port is access-controlled in both directions. The port does not receive packets from or send packets to the host.

Note: If PortFast is not enabled on the port, the port is forced to the bidirectional state.

https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-wake-lan-supp.html

HP

The aaa port-access controlled-direction in command allows Wake-on-LAN traffic to be transmitted on an 802.1X-aware egress port that has not yet transitioned to the 802.1X authenticated state; the controlled-direction both setting prevents Wake-on-LAN traffic to be transmitted on an 802.1X-aware egress port until authentication occurs.

Note: Although the controlled-direction in setting allows Wake-on-LAN traffic to traverse the switch through unauthenticated 802.1X-aware egress ports, it does not guarantee that the Wake-on-LAN packets will arrive at their destination. For example, firewall rules on other network devices and VLAN rules may prevent these packets from traversing the network.

http://h22208.www2.hpe.com/eginfolib/networking/docs/switches/WB/15-18/5998-8152_wb_2920_asg/content/ch13s05.html

Aruba Networks (not Procurve)

In Aruba AOS (not Procurve) there is a MAC pinning feature which basically adds a static MAC address to the port and associates it to the authentication as a pinned-MAC. All traffic to that MAC address would be pre-authenticated and anything else would need to be authenticated.

Summary

For enterprise grade edge switches I would expect a solution for this problem. You may not be so lucky with low end switches and your mileage may vary. That's why this solution is not officially supported by Microsoft.  
 
I hope this helps. Until next time.......

Video training series "Manage ConfigMgr Internet clients with the Cloud Management Gateway"

I'm very pleased that TrueSec have just published my video training series 

Manage ConfigMgr Internet clients with the Cloud Management Gateway

There are five videos in the series:

Introduction to the CMG
This video is an Introduction to the Cloud Management Gateway. Previously when we wanted to manage ConfigMgr clients over the internet we would use Internet-based client management. This was a good technology with many advantages. However, there were also some disadvantages. Now we can use Cloud Management Gateway to manage these clients. It consists of a Microsoft Azure cloud service and a ConfigMgr site system role that communicates with the Azure service. Clients can then use the Azure service to communicate with ConfigMgr.
This is cool technology and gives us many advantages over traditional internet based client management.

Prerequisites for the Cloud Management Gateway
This video describes the general requirements for the successful implementation of a CMG solution. This includes specific ConfigMgr requirements and the certificates required for Cloud Distribution Point and Cloud Management Gateway.

Certificates for the Cloud Management Gateway
This video is all about certificates. These are the tasks that admins find the most difficult. We’ll be creating the certificates necessary for the configuration of the Cloud Distribution Point and the Cloud Management Gateway.

Configure the Cloud Management Gateway
In this video we will create the Cloud Distribution Point and Cloud Management Gateway. Then we’ll add the Cloud Management Gateway Connection Point.
Finally, we’ll configure the Management Point and Software Update Point to allow CMG traffic.

Managing clients with the Cloud Management Gateway
In this video we’ll have a look at a Windows 7 client and see how the behaviour changes when the client moves from the intranet to the internet. We’ll deploy software to the internet client. Finally, I’ll show you a couple of tricks that should be useful for your deployment.

I hope you enjoy the videos. Thanks to Johan Arwidmark and the guys at TrueSec.

Until next time......

PowerShell script - add and configure Intune Subscription

I've been deploying Microsoft Intune a lot recently. Adding and configuring the Intune subscription in the Configuration Manager console is very straightforward but can take be time-consuming. I've created a simple PowerShell script to automate this.

This script adds an Intune subscription to ConfigMgr Current Branch and configures the subscription to enable management of Android, iOS, Windows and Windows Phone devices.

The cmdlets in this script require a valid Intune subscription. They require Configuration Manager 1511 or later, although it is recommended to use 1606 or later. There are published workarounds for using the cmdlets in pre-1606 environments.

Instructions for use

1. Download an APN certificate request from ConfigMgr and generate the APN certificate directly from Apple in advance of running this script. Save the Apple APN certificate to a local folder eg (E:\Sources\MDM\Apple\AppleCert.pem) https://identity.apple.com
2. Save script to installation folder
3. Install the System Center Configuration Manager Cmdlet Library (if you are already using PoSH with ConfigMgr you will have done this already) https://www.microsoft.com/en-us/download/details.aspx?id=46681
4. Run PowerShell and browse to the installation folder (you may have to run PoSH as administrator as the first step is to set the execution policy to unrestricted)
5. Run IntuneSubscriptionScript.ps1
6. The script will prompt you to enter the following information:

• Enter Site Server name
• Enter Site Code
• Enter Intune subscription username
• Enter Intune subscription password
• Enter Company Color Scheme (options: Blue, Magenta, Purple, Teal, Lime, Brown, Pink, Orange, Red or Green)
• Enter your organization name
• Enter valid contact email address
• Enter contact name
• Enter path to Apple APN certificate
• Enter Apple APN certificate password - leave blank if no password

The script will create the hybrid Intune subscription with your required parameters.

It will then enable management for Android, iOS, Windows and Windows Phone platforms.

Android enabled.

iOS enabled.

Windows enrolled as MDM enabled.

Windows Phone enabled.

Note that the script does not have much error checking for now. I'll get to that when I have a chance.

Download from the TechNet gallery and try it.

https://gallery.technet.microsoft.com/Intune-Subscription-script-997ea195

Until next time....

My second book

I am very pleased to be co-author for the latest book in the System Center Configuration Manager Unleashed series (published by Sams). The book is titled  "System Center Configuration Manager Current Branch Unleashed".

The author list is:

• Kerrie Meyler (MVP) (Co-author)
• Greg Ramsey (MVP) (Co-author)
• Kenneth van Surksum (MVP) (Co-author)
• Michael Wiles (Dell) (Co-author)
• Gerry Hampson (MVP) (Co-author)
• Saud Al-Mishari (Microsoft) (Co-author)
• Garth Jones (MVP) (Contributing author)
• Byron Holt (MVP) (Contributing author)

The chapter list is as follows:

1. Configuration Management Basics
2. Configuration Manager Overview
3. Looking Inside Configuration Manager
4. Architecture Design Planning
5. Network Design
6. Installing System Center Configuration Manager
7. Migrating to System Center Configuration Manager
8. Using the Configuration Manager Console
9. Client Management
10. Managing Compliance
11. Creating and Managing Applications and Deployment Types
12. Creating and Managing Packages and Programs
13. Distributing and Deploying Applications and Packages
14. Managing Software Updates
15. Integrating Intune Hybrid into Your Configuration Manager Environment
16. Managing Mobile Devices
17. Conditional Access
18. Endpoint Protection
19. Configuration Manager Queries
20. Configuration Manager Reporting
21. Operating System Deployment
22. Security and Delegation in Configuration Manager
23. Backup, Recovery, and Maintenance

Writing a book can be a very time-consuming process. However I've submitted my four chapters ahead of schedule after several re-writes (Kerrie is a tough taskmaster). The chapters will then undergo technical and editorial reviews (probably more re-writes). The book is scheduled to be published in early 2017 and will be available on Amazon.

Currently it is available for pre-order

ConfigMgr Current Branch - native integration with Windows Store for Business

System Center Configuration Manager landing page

The eagerly awaited 1606 version of ConfigMgr Current Branch was recently released. As we have come to expect from the ConfigMgr team this version is full of enhancements and new features. There are changes in the following areas and you can find full details on TechNet

• Updates and servicing
• Accessibility
• Administration
• On premises Mobile Device Management
• Application Management
• Software Updates
• Operating System Deployment
• Compliance Settings
• Device Configuration and Protection
• Remote Control

I really like the subtle change in the Updates and Servicing node. The clutter of previous versions has been removed.

Only the latest version (and hotfix) is now listed.

Click on the History button on the ribbon to see the previous versions.

My two favourite features of this version continue the trend of "cloud integration".

• Sync data from Configuration Manager to the Microsoft Operations Management Suite
• Windows Store for Business integration

In this blog I'll concentrate on the WSfb integration. In a previous blog I described the WSfB and explained how to set up a store account so I won't repeat that here. Follow the steps below to integrate WSfB with ConfigMgr. At the end of the blog I list the issues encountered by me and some colleagues in configuring the solution.

Turn on Windows Store for Business integration

WSfB integration is a pre-release feature (even though it doesn't say so in the ConfigMgr console). You must first give you consent to use pre-release features.

Navigate to Administration > Site Configuration > Sites. Select your site and choose Hierarchy Settings in the ribbon above.

Tick the box Consent to use Pre-Release features.

Navigate to Administration > Cloud Services > Updates and Servicing > Features. Right click Windows Store for Business Integration and select Turn on.

Accept the warning to turn on the feature. Close and re-open the Configuration Manager console. The Windows Store for Business node is now available under Cloud Services.

Register ConfigMgr as a management tool in WSfB

For this step we are going to need access to the Azure and WSfB portals for the tenant.

Open the Azure Portal. Select your Azure Active Directory and click Applications > Add

Select Add an application my organization is developing.

Choose a suitable name for the application and select Web application and/or Web API. Click the arrow to continue.

Enter a URL for the Sign-on URL and App ID URI. The URL needs to be the same for both but doesn't have to exist. Click on the tick to complete the wizard.

The app has been added. Click on Configure from the menu at the top.

Note the Client ID (copy it as we'll need it later).

Under Keys select a duration and then click Save. This will create a new client key. You will only be able to copy the client key while on this page so don't navigate away until you have completely finished the process.

Copy the client key. We'll need it later.

Now log into the WSfB to add Configuration Manager as the store management tool. Select Settings > Management tools.

Click Add a management tool.

Search for the application you just created in AAD and click Add.

Activate the management tool (I missed this step first time round - see "Issues encountered" below).

Only one management tool can be active at a time.

If you are going to use offline-licensed apps navigate to the Manage > Account Information page.

Select Show offline licensed apps.

Add WSfB store account in Configuration Manager console.

Navigate to Administration > Cloud Services > Windows Store for Business.

Right click and choose Add Windows Store for Business account.

Read the instructions and verify that you have already carried out the steps.

Enter your tenant name. Enter the Client ID and Client key that you copied earlier. Click Verify. This verifies that the Client ID and Key are correct. It doesn't check that you have correctly added a management tool.

Add a location to store the content.

Select Application Catalog languages.

WSfB integration has been configured.

First sync has succeeded.

See WsfbSyncWorker.log file for progress.

Apps are available in Software Library > Application Management > License Information for Store Apps.

Application content has been downloaded.

Create application.

Create a ConfigMgr application as normal. Right click an app in Software Library > Application Management > License Information for Store Apps.

Select Create Application.

Review the information and click Next.

Application information was imported from the appx package.

Enter a suitable name and details.

The application has been created.

See the application and deployment types. The app can now be distributed and deployed as normal.

Issues encountered.

I just wanted to share some issues encountered by me and some of my colleagues while configuring the solution.

1. Unauthorized - this one happened to me.

The first sync failed and the error below appeared in the WsfbSyncWorker.log file.

Error occured making http request calling 'GET' method on 'https://bspmts.mp.microsoft.com/V1/Inventory?maxResults=1000&modifiedSince=0001-01-01T00:00:00.0000000': (Unauthorized) 'Unauthorized'.

This was caused by the fact that I had added my app as a management tool for WSfB but I had missed the step the activate the tool. This meant that ConfigMgr was not authorized as a client to manage the WSfB. Once I activated the app and restarted the SMS_CloudConnection component the sync started and I could see the apps downloading to the content share (and could see them in the Software Library).

2. Proxy authentication

The error below appeared in the WsfbSyncWorker.log file.

                          ErrorCode: unknown_error
                          StatusCode: 407
[24, PID:9024][08/22/2016 14:20:04] :Failed authenticate with the Windows Store for Business.

The correct proxy credentials had been configured and the Software Update Point on the same server was able to authenticate.

Proxy support for WSfB has not yet been implemented. It is planned for a future release. As a workaround, set the proxy in the system level IE proxy settings on the server where the SCP is installed.

3. Delete and re-create the WSfB account

You've made a mistake and you want to start again. Try it. You can't remove the WSfB account in the console. This has not yet been exposed but you can get out of trouble using WMI.

I believe my colleague will be posting a blog post shortly on how to do this so I don't want to interfere with that.

I hope this information in this blog post will be of use to you.

Until next time..... 

Configuration Manager: in-console upgrade to latest Current Branch

System Center Configuration Manager landing page

As promised, Microsoft have really delivered with the new style in-console upgrade of Configuration Manager. It works seamlessly. I've carried out the upgrade numerous times (both in production and lab) and have only seen minor issues to resolve.

Remember that the first iteration of Configuration Manager was 1511 (released November 2015). Now we have 1602. We've been given many seriously cool new features with this release. For the full list, see What's new in version 1602 of Configuration Manager

The Configuration Manager Team Blog has already provided this summary of the new features.

• Client Online Status: You can now view the online status of devices in Assets and Compliance. New icons indicate the status of a device as online or offline.

• Support for SQL Server AlwaysOn Availability Groups: Configuration Manager now supports using SQL Server AlwaysOn Availability Groups to host the site database.

• Windows 10 Device Health Attestation Reporting: You can now view the status of Windows 10 Device Health Attestation in the Configuration Manager console to ensure that the client computers have a trustworthy BIOS, TPM, and boot software.

• Office 365 Update Management: You can now natively manage Office 365 desktop client updates using the Configuration Manager Software Update Management (SUM) workflow. You can manage Office 365 desktop client updates just like you manage any other Microsoft Update.

• New Antimalware Policy Settings: New antimalware settings that can now be configured include protection against potentially unwanted applications, user control of automatic sample submission, and scanning of network drives during a full scan.

• Windows 10 Servicing: New improvements were added based on your feedback such as filters in servicing plans for upgrades that meet specified criteria, integration with deployment verification and a dialog in Software Center when starting an upgrade.

For Configuration Manager with Intune:

• Conditional Access for PCs Managed by Configuration Manager: You can now use conditional access capabilities to help secure access to Office 365 and other services on PCs managed with Configuration Manager agent. Conditions that can be used to control access include: Workplace Join, BitLocker, Antimalware, and Software Updates.

• Windows 10 Conditional Access Enhancements: For Windows 10 devices that are managed through the Intune MDM channel, you can now set and deploy an updated Compliance Policy that includes additional compliance checks and integration with Health Attestation Service.

• Microsoft Edge Configuration Settings: You can now set and deploy Microsoft Edge settings on Windows 10 devices.

• Windows 10 Team Support: You can now set and deploy Windows 10 Team configuration settings.

• Apple Volume Purchase Program (VPP) Support: You can now manage and deploy applications purchased through the Apple Volume Purchase Program for Business portal.

• iOS App Configuration: You can now create and deploy iOS app configuration policies to dynamically change settings such as server name or port for iOS applications that support these configurations.

• iOS Activation Lock Management: New capabilities include enabling iOS Activation Lock management, querying for the status, retrieving bypass codes, and performing an Activation Lock bypass on corporate-owned iOS devices.

• Kiosk Mode for Samsung KNOX Devices: Kiosk mode allows you to lock a managed mobile device to only allow certain apps and features.

• User Acceptance of Terms and Conditions: You can now see which users have or have not accepted the deployed terms and conditions.

How to Upgrade

Carry out the following tasks before you start (you'll know how to do this by now):

1. Back up your site
2. Snapshot the virtual machine
3. Run TestDBUpgrade
4. Back up Configuration.mof (it will be overwritten by the upgrade)

Now let's have a look at the upgrade process. Navigate to Administration > Cloud Services > Updates and Servicing.

1602 is available and ready for installation. All subsequent upgrades will also be available here. Note that the upgrades will be cumulative. In the future you will not have to install them all if you don't want to (if you don't need their new features). You can skip a few and install the latest if you wish.

Right click the upgrade and select "Run prerequisite check". This is important to verify that there are no issues before you actually start the upgrade.

The console verifies that Configuration Manager is checking the prerequisites.

Have a look at the CMUpdate.log file. See "Update package will not install as it is marked for prereq check only".

Brilliant. The prerequisite check has not found any issues. So far, in all the upgrades I've done, this has been the case.

Now let's do the upgrade. Choose "Install Update Pack" this time.

The Configuration Manager Updates Wizard is launched. You can see some general information. Click Next to continue.

Some new features are not enabled by default. You can choose to enable them now if you wish. If you don't you can enable them in the console later. I normally just select them all - why not? Make your choices and click Next.

Select your preference for overwriting the Configuration Manager client package. You can overwrite immediately or you can select to have a period of validation first. Continue through the wizard.

Read and accept the license terms.

You're almost there. Confirm the settings on the summary page and click Next to upgrade.

The wizard has completed successfully. This doesn't mean that the upgrade has finished. You've simply started the process.

Monitor the CMUpdate.log for progress.

You can see progress in the Updates and Servicing node.

You can also see progress in the Monitoring > Site Servicing Status node.

Right click the upgrade and select Show Status for more details.

You can see full details of the upgrade steps.

Soon you will see that the upgrade has completed successfully.

Verify that all the components are healthy.

Finally you will get notification that you need to upgrade your consoles. Click OK to install.

That's it. Upgrade has been completed and you can now enjoy the new features. Wasn't that seriously slick and seamless? Remember that this upgrade process will be the same for future in-console upgrades.

I hope this blog post was useful to you. Until next time.....