Where do I get my ADMX files for the OneDrive Next Gen sync client?

With Windows 10 1709 Microsoft is rolling out a new sync client for OneNote. The client introduces new functionality such as the ability to download specific files in an on-demand fashion. People were asking me if there was a set of ADMX files and there are however the ones on the Microsoft download site are stale. Check out my blog article over here on how you can get the latest files into your environment.

www.checkyourlogs.net/?p=43293

Virtually There with Kevin Kaminski Episode 6: Emile Cabot

Emile is a local Cloud and Datacenter MVP I work within the Calgary area, he has spoken multiple conferences and co-authored several books. I take a moment to discuss Microsoft Ignite in general and some of his thoughts around Windows Server 2016.

Virtually There with Kevin Kaminski Episode 5: Tim Mangan

Tim has been a mentor of mine; he helped get Microsoft to recognize my community contributions when App-V was still referred to as SoftGrid. We developed an App-V master's class together though he is the one that is laser-focused specifically on App-V. I thought it would be good to catch up and see where he is at with his App-V tools, research and book publishing.

Virtually There with Kevin Kaminski Episode 4: Kevin Goodman

Kevin Goodman goes way back to when VDI was referred to as server based computing, he has a development background and founded RTO Software which was later acquired by VMware. I take a moment to catch up with him and talk about where he is at with FSLogix.

Virtually There with Kevin Kaminski Episode 3: Bob Kelly

Bob Kelly is a long time member of the application packaging world where he has been recognized as a Microsoft MVP, written books and has done public speaking engagements. He is currently over at Flexera, and I take a few minutes to catch up with him and discuss the current state of application packaging.

Virtually There with Kevin Kaminski Episode 2: Ruben Spruijt

In this episode I catch up with fellow MVP Ruben Spruijt who has taken a CTO position over at Frame which is a cloud based virtual desktop vendor. Join me as I find out what Ruben and Frame have been up to in the VDI space.

  Recently I took an in-depth tour of SupTool which is a cloud-based solution for ensuring Configuration Manager client health along with some other specific health checks for Windows Update using an architecture that mainly resides in the cloud. In the blog article below I take you on a virtual tour of SupTool and how it can cut down on the reoccurring maintenance of your endpoints while giving better visibility into the overall health of your environment.

Check out my post over at: http://www.checkyourlogs.net/?p=39763

Virtually There with Kevin Kaminski: First Episode!

  Before Microsoft Ignite I had an idea that I should bring a camera with me and interview different personalities in the IT business that I know and add them to my currently very small YouTube channel. The channel started with a couple of popular App-V videos, but I wanted to add some different content since I am often attending conferences and talking to my peers in the industry.

To kick off the series I've posted an interview with a co-worker and Microsoft MVP Marcos Nogueira. We chat about Azure and System Center along with the challenges customers face. To tune in just view the video below.

Building Bridges: Co-Management with Intune and Configuration Manager

On Monday, Microsoft finally announced the rollout of the capability to manage a Windows 10 device with Intune MDM and the Configuration Manager agent. This long-sought-after capability has been requested by many of my Enterprise customers after they’ve embarked on the journey to modern management with Windows 10. If you want to unlock this superpower, read on.

Before diving into co-management, let’s take a moment to differentiate between modern management and traditional management. At the onset, I would characterize the fundamental difference between the two management methodologies by how they deploy and manage a machine.

On one end of the spectrum, traditional management designs and deploys a Windows machine with a high level of customization defined by the corporate IT department. On the other end of the spectrum, modern management prioritizes simplicity with a simple and minimal image that has little to no customizations.

I see the value of the modern approach; however, it is worth noting that it brings its nuances, which if not handled well can become problematic.

Let me elaborate briefly what I mean by that. In a modern, Enterprise-scale IT environment, when I provision a user for a client, I must either coordinate with a deployment technician internally or a hardware vendor to image the machine with my highly-customized version of Windows.

After successfully coordinating the device image, I need to ensure that the device is joined to Active Directory and that it has the Configuration Manager agent installed. As you know, both scenarios can be time-consuming and error-prone because the image evolves considerably over time.

While you start with a clean albeit customized base image, throughout deployment you will undoubtedly implement many additional customizations using Configuration Manager to apply more software and settings to the device.

And it doesn’t stop there. After you’ve finished with Configuration Manager to deploy the machine, Group Policy is applied to the machine through Active Directory where user and machine specific security and configuration needs are further layered on top of the base image. In Enterprise environments, Group Policy customizations can affect hundreds of settings on the machine depending on which role the computer and user is assigned to perform their work functions.

The whole process requires considerable planning, building, and testing before being promoted into production as a finished solution, and it needs to be revised at least twice a year to keep in synchronization with Windows 10 release schedule. Once you have a validated image, it can take the system anywhere from 45 minutes up to two hours to provision the device to an end user.

My goal is always the same: to make the process as hands-free as possible. However, more often than not, this goal falls short for many of my customers because their existing environment is chock-full of customizations that the deployment technician must manually specify at deployment time. For example, machines might be named incorrectly, machines can be put into the wrong Active Directory OU, and the user might be assigned to the wrong machine. These kinds of mistakes (and I’m only touching the surface here) require manual remediation and in some cases, re-imaging the machine.

Modern management bases the image on the factory load of Windows 10, which means the first time an end user logs into a machine they provide their credentials and that machine is tailored to their particular work needs using Windows Setup combined with Provisioning Packages for customization and the use of Intune for performing the final customizations.

One of the most critical reasons to adopt the modern approach is to drive down the total cost of ownership.

Sounds great, right? Well, there’s a catch, you have to put aside everything you know about traditional management and leave your expectations at the door. Modern and traditional management methodologies are like night and day, hence treating them the same will set you up for failure.

The challenge that organizations face during the transition from traditional to modern methodologies comes from not evolving and managing their expectations. That is to say customers expect that their workflows, procedures, and protocols will continue to operate (without any further modifications) within a modern management framework. In my experience, this has never happened.

Rolling out a modern management framework requires simplicity. In order to transition a user with many dependencies to a modern management framework, you will need to commit significant planning and resources to make modern management a reality.

In my opinion, only those organizations that can identify simple use cases and can invest in implementing a modern management framework should embark on the journey.

To summarize the key difference, modern management strives to drive down the cost of ownership by packaging as few applications and customizations into the image as possible. The downside is that on the management side of things, provisioning users take on a few new approaches, and staff must learn new ways of managing applications, machines and images.

With that said, I can now turn to Intune’s new capability. Initially, MDM was an extremely small subset of Group Policy, which was frustrating for system administrators and the IT security department due to the lack of configuration capabilities available. There are ADMX backed Group Policies that can be delivered via MDM, but we are looking at only 367 settings opposed to 2500-3000 Group Policies.

More specifically, legacy software packages are not part of the Windows Store modern management vision. We could deliver Win32 applications via MDM in Intune, but all the files had to be within a single MSI file - a rare configuration with most complicated applications. It was time-consuming and cumbersome for many customers because there wasn’t much of a technology bridge between these two worlds and “creative” (i.e., fragile and risky) solutions began to creep into the picture.

With co-management, your device lives in between traditional and modern management practices, which helps you focus on just those technologies that apply to the device until it can fully cross over into a modern management state.

To get started, I recommend rolling out the following through Intune when it makes sense in your environment:

• Conditional access
• Software updates
• Compliance policies

Because they are easily managed through the cloud and should be the first workloads that you configure for exclusive management through Intune. With Microsoft’s announcement, the migration path for each machine now has three states:

1. Traditional management state
2. Co-management state
3. Modern management state

Unfortunately, in practice, I’ve found it difficult to find user populations where pure Intune management of Windows 10 meets the requirements of the Enterprise customer.

The trinity of Intune, Azure AD, and Windows 10 S represent a computing fabric that most closely resembles a pure form of modern management. The paradox that we face is that deploying such a configuration across an entire user base would be a suicide mission for most organizations.

If you haven’t been keeping track of Windows 10 S, there is no support for Win32 applications (marketed as a security strategy), but there is a modern application management use case which uses Universal Windows Platform or Desktop Bridges applications delivered through the Microsoft Store.

Enterprise customers are notoriously difficult to migrate because of the enormous amount of technical debt in the organization, which for the most part, resides with their applications. The consequence of this technical debt is that it will take these customers years to modernize their application base and be able to deliver their entire application portfolio through the Microsoft Store.

Until such time, organizations won’t be able to retire traditional imaging, management, and Active Directory methodologies. Depending on who I’ve talked to, a number of different migration timelines have been mentioned, regardless I believe that the journey is going to be a long one.

Co-management is a hugely welcome capability right now because the timeline for Microsoft to move Windows 7 and Windows 8 to end-of-life is fast approaching, and huge numbers of organizations are scrambling to prepare for that inevitability. The unfortunate reality for most of them is that to transition from traditional to modern management they will encounter a chasm between how they used to do things and how they will need to do things and Co-management offers the first bridging technology to help scaffold over that chasm.

Customers who need capabilities that are exclusive to Configuration Manager can carry them forward until they either no longer need the capability or wait until Intune makes sense to take over the capability by managing it via the cloud.

I hope this bridge between traditional and modern management will make the migration process easier for many of my customers. The point to keep in mind is that the migration path is not an all or nothing scenario, it is necessarily incremental and long in the tail.

Use empirical data (not marketing hype) to identify candidate user populations where modern management makes sense. In my experience, I’ve found the mobile information worker to be a stable and predictable candidate user group to start with. Once I have successfully migrated one user group, I proceed further down the modern management path as additional user populations are identified and vetted (i.e. not selected arbitrarily).

In the end, it is important to realize that migration isn’t just a management capability puzzle, it is also an application modernization strategy as well. Remember that you can also use desktop virtualization to deliver legacy applications to modern users as a bridging technology.

Above all, keep your eyes and ears open because modern management is a rapidly changing landscape, what didn’t work six months ago, may miraculously work today. If you have blocking issues, talk directly with your Microsoft reps and communicate feature requirements through the various user voice sites out there for the different Microsoft products.

There are a few juicy announcements that are coming down the pipe from Microsoft, so stay tuned to this blog for breaking news.

Pro Tip: Beware of the Aftermarket Video Cards with Secure Boot

If you have some older video cards in your environment, you might not realize until deployment time that some of your systems will fail to display video or Windows will simply not use the card at all. The root cause of the is due to older video cards not being Secure Boot compatible. To fix the issue, you have three paths that are all valid, but I believe have to be evaluated carefully.

The first option is to remove the video card that wasn't supplied by the hardware vendor of the motherboard and use the onboard video. In some cases, this might be satisfactory, but depending on your needs you may need to look at another option such as disabling Secure Boot in the BIOS. Disabling secure boot is cheap but will not protect your system against malware that infects the boot environment of your machine, so you have to question the value of such an approach in an enterprise environment.

A more expensive approach would be to modernize your hardware, this could be as simple as giving the user a new PC because at this point with Windows 10 most enterprise hardware that currently has Secure Boot capability. The other choice is to replace the display card, but before buying that display card, you should evaluate the cost of a new card on hardware with a limited remaining lifespan versus purchasing a new system.

If you need to upgrade many machines, it might make more long term value to get these systems out of your fleet rather than taking a reduced security posture or buying new hardware for a device that may only be in the fleet for another year. To make an informed decision use tools such as System Center Configuration Manager to determine the affected systems through hardware inventory data it can capture. To me, secure boot is a no brainer that enterprises should enable by default with Windows 10.

Come join us! Calgary Citrix User Group Local Kickoff Meeting

I've entered into a new venture into IT user group communities by helping form the Citrix User Group Community for Calgary headed by Rod MacCormack. We saw the need to get the local Citrix community reestablished so that Citrix professionals could get together and share their experiences while keeping updated on the latest trends with the technologies they work with on a day to day basis. Essentially our goal is to allow our user base to build their knowledge on Citrix and Citrix related products so they can better perform their job.

Now that we have finally got all the initial logistics out of the way our first event will take place at Craft Beer Market on Thursday, June 8. Our sponsor this round is Nutanix, and they will be present for a technical presentation on their latest offerings for VDI. Citrix will also be present to recap some of the announcements from Synergy. We will also have room for open table discussions so we can all get to know each other, share experiences, and of course ask questions!

We also have giveaways. food and refreshments so be sure to pop by.

Please join the Calgary Citrix User Group Community and register for the event over here: https://www.mycugc.org/page/calgary-jun8-2017?source=5

VirtualizationAdmin.com - Monthly Newsletter - April 2017

Since July I have been writing a newsletter for VirtualizationAdmin.com, and I figure it is about time I let's all my other social media readers know about it. I know, sometimes I suck at self-promotion, but I will post the summary each month to the blog going forward so if you don't subscribe you might check out the newsletter if there is a topic or two of interest. So let's kick things off with the intro to the April 2017 newsletter.

Hello and welcome to the next edition of the VirtualizationAdmin.com newsletter. I’ve picked a couple of topics in the news this month by looking at some new developments at FSLogix where they have a solution focused on Office365 users. VMware has an upgrade out for customers that add some enhancements to their server virtualization platform. After the articles of the month, I will look at hypervisor security since I think there is some work to be done in this area.

Read more at: http://www.virtualizationadmin.com/newsletters/monthly-newsletter/virtualizationadmin-com-monthly-newsletter-april-2017-16510.html

Azure Global Bootcamp with the Calgary Microsoft User Group

April 22, 2017, the Calgary Microsoft User Group held its first Azure Global Bootcamp event by holding a hands-on event about creating virtual machines. We had a well-attended event having over 30 people in the room.

The focus was about deploying Windows and Linux virtual machines in Azure using different management methods. We started off with the Azure Portal then moved into the Azure CLI and eventually Powershell to show the different ways that Azure can be managed.

We plan to hold more hands-on Azure events as they are very popular with the group. We'd like to thank our sponsors that helped make this event a success and contribute to ensuring that we can do future events!

AMTRA Solutions
Microsoft
Opsgility
myget
SentryOne
Jet Brains
CloudMonix
SentryOne
ServiceBus360

Windows 10 Creators Update (1703) Available for Download!

The Windows 10 Creators Update has hit current branch but will not be available via Windows Update until April 11, 2017. What this means for customers/enthusiasts that want to start using this release of Windows 10 they need to go out to the Windows 10 download site to get the latest release. This installation is driven by the upgrade assistant where you can create media or perform the in-place upgrade to Windows 10 1703.

For enterprise customers and developers, the ISO media for Windows 10 1703 can be found on your volume licensing site or MSDN. If you are building Windows images for deployment be sure to update your ADK environment to 1703 as well hosted over in the hardware developer center. There has been some news about potential issues with the new ADK so review the following blog articles by MVP Mikael Nystrom:




OS Deployment – Installing ADK 1703 on Windows Server 2016 could fail
https://deploymentbunny.com/2017/04/06/os-deployment-installing-adk-1703-on-windows-server-2016-fails/

OSD – App-V tools are missing in ADK 1703 when being installed on Windows Server 2016 (sometimes)
https://deploymentbunny.com/2017/04/06/osd-app-v-tools-are-missing-in-adk-1703-when-being-installed-on-windows-server-2016/

Need to know what is new with 1607 for IT Pros?
No problem, Microsoft has published documentation over here.
https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1703

New Windows 10 IoT Core Images Available!

Today Microsoft has released a set of images for running Windows 10 IoT core on the Rasberry PI, DragonBoard, and MinnowBoard MAX. The announcement had me interested in what the capabilities of the platform would be since I usually end up managing devices through Configuration Manager and/or Intune.

First, let's start off with what this version of Windows is meant for. The Windows 10 IoT Core edition is the smallest footprint of Windows 10 available for devices. If you look at the infographic below, you can see that Windows 10 IoT comes in many flavors with different levels of functionality. Essentially the Windows 10 IoT Core version of Windows 10 is intended for single purpose use cases. There is no Windows shell and no command prompt, but you do get the ability to run Universal Windows Platform applications. Win32 applications are still supported, but they will not output to the console.

Many may wonder what is the point to running Windows under such limited circumstances, but I believe there are some very valid use cases that should be considered. There obviously is the hobbyist market, and though Linux is currently the dominant platform, some developers may feel more comfortable using a pure Microsoft stack to build out their custom creations. The other side is the business market where you want an IoT device that leverages existing developer expertise in the Microsoft stack and has integration into Intune or System Center Configuration Manager to provide updates and management of these devices.

When I first started looking IoT, I saw management and security taking a back seat, but as I've witnessed in the news, this lack of care and feeding has created security and operational issues. IoT was overlooked at being too basic and non-business critical to be on the radar for many organizations but now that these devices are being infected with malware, spyware and participating in BotNets all of a sudden the need for management has become a clear requirement for not just businesses but consumers as well.

It will be interesting to see where the smallest of the Windows 10 IoT editions finds itself in the marketplace but I am hesitant to write it off as a hobbyist product because of the integrated management, the ability to continue using Visual Studio and integrate your solution with Azure's IoT Suite. If you are looking for the latest releases of IoT core I've put a set of links below so you can start downloading them right away!

Rasberry Pi 2 & 3
https://www.microsoft.com/en-us/download/details.aspx?id=55029&WT.mc_id=rss_windows_allproducts

DragonBoard
https://www.microsoft.com/en-us/download/details.aspx?id=55027&WT.mc_id=rss_windows_allproducts

MinnowBoard MAX
https://www.microsoft.com/en-us/download/details.aspx?id=55026&WT.mc_id=rss_windows_allproducts

MVPDays Western Canada

Alan Rafuse, Crystal and Dave

Recently I finished the latest tour of MVPDays in Western Canada and it was a great time reuniting with fellow MVPs and IT professionals. In case you haven't been to an MVPDays event yet you should keep track of the dates, news and speaking opportunities via the MVPDays official Twitter account @MVPDAYS. This conference has been the brainchild of local MVP Dave Kawula and his wife Cristal who is a Veeam Vanguard. Both of them have worked tirelessly to put together these community events featuring Microsoft MVPs talking about some of the hottest technology out there.

The event was originally put together to fill the void that was left when TechDays Canada was no longer being put on by Microsoft Canada. Dave felt that these sorts of events were very important to the community and started with a round of events in Western Canada. Soon MVPDays expanded to Central Canada and the USA featuring more MVPs from across Canada and the USA. I've been personally amazed at the dedication and enthusiasm of everyone involved especially Dave and Crystal has this can sometimes feel like a thankless job.

Speaker preparation the night before in Vancouver

I've been glad to be a part of most of these events as I believe it is important to have more technical events that are independently run rather than being driven by a large software vendor. The big conferences are important, but I find these more intimate conferences offer a unique opportunity to speakers and the attendees where the conversations are more open and less driven by product-specific messaging. The idea isn't so much vendor bashing but to have honest conversations about what works and what doesn't plus who is the interesting underdog in the market that might be blazing a new path in the world of information technology.

You can check out the website www.mvpdays.com to see some of the past speakers plus the past and future dates. The speakers are important, but more importantly, I am going to list off hopefully a complete list of past and present sponsors because without them events such as this wouldn’t happen. Events like this need volunteers, sponsors and most importantly organizers that do it for the IT community.

Sponsors:

Veeam
Microsoft
Exagrid
TriCon Elite
RSVC LLC
IGEL
Workspot
Nimble Storage

Gridstore (now HyperGrid)
Unidesk
5nine Software
Nutanix
Nexsan
HPE by Avnet

Cisco

If you would like MVPDays in your area and think you can get at least 200 people to commit to attending then contact the MVPDays team, the contact form is at the bottom of the MVPDays.com website.

Curious About Modern VDI?

For the latest set of MVPDays events in Western Canada, I had the opportunity to speak about VDI. The MVPDays team was really on the ball this time around to record some of the presentations, so I had the opportunity to have my video posted to Microsoft's Channel 9. It was a great time to reconnect with fellow MVPs and customers in Calgary, Edmonton, and Vancouver. Hope to do it again next year.

The session looks at how new hardware, software and the cloud is changing the world of VDI. Many smaller organizations have found traditional VDI to be too complex and expensive to adopt while enterprises have struggled to manage it. In this session, I have an overview of some of the modern challenges facing VDI and the options you have to overcome it.


I will review some of the latest trends in hardware to create easy to deploy VDI environments on-premises and look at how the cloud is simplifying the design and operation of VDI. I also explore other technologies at the software level that manage the VDI environment from the hypervisor all the way up to the user data. It has been a long journey for VDI, but I believe we finally see cost effective solutions that make a stronger case for organizations to phase out traditional desktop computing devices.

App-V 5.2 Client on Windows Enterprise 1607

In this video, I show how to enable the App-V client and load an App-V sequence side by side with an older version of the same application that is installed traditionally. I explore the differences between an App-V application and the locally installed version so you can see how the App-V client redirects the registry and file system to allow two versions of the same application to exist side by side.