Awkward Introductions & Windows Hello

You know that feeling when you meet someone new and it just starts off a little awkward? You are then thinking to yourself it sure would be nice if I can start over. Well, this sometimes happens when you set up Windows Hello. IF you want to say goodbye to windows hello and start over, enter this command into powershell.

certutil -deletehellocontainer

My New Friends for Windows Hello for Business

I just wanted to list a couple sites that have recently been very helpful for me in regards to the Windows Hello for Business configuration in Intune. The first one is Nicklas Ahlberg with Rockenroll.tech. https://www.rockenroll.tech/2024/06/17/windows-11-whfb-disablepostlogonprovisioning/ Create a new custom Windows configuration profile Add a new row: Name: W11 – DisablePostLogonProvisioning OMA-URI: ./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning ❗(replace {TenantId}with your TenantId). Data type: Boolean Value: True The next new friend is dannyda.com. This link will give you fun command lines to use for changing WHfB behavior. https://dannyda.com/2020/01/14/how-to-enable-disable-windows-hello-windows-hello-for-business-via-group-policy-registry-command-prompt-cmd/

The Wizarding World of PowerShell Calendar Permissions

1. Open the PowerShells and connect to the Exchanges:
   Install-Module -Name ExchangeOnlineManagement
2. Log into the Exchanges:
   Connect-ExchangeOnline -UserPrincipalName <your_username>
3. Take a look at who has access to a calendar:
   Get-MailboxFolderPermission -Identity "Snoop@Dogg.com:\calendar"
4. Give permissions to Martha:
   Add-MailboxFolderPermission -Identity "Snoop@Dogg.com" -User "martha@Dogg.com" -AccessRights Reviewer
5. When you finish, don't forget to close the session:
   Get-PSSession | Remove-PSSession

 Extra Credit:  If you would like to see what rights Martha has to every account in your M365 tenet you can use the command below.  This will take a long time if you have a lot of accounts.

Get-Mailbox | ForEach-Object {Write-Host "Processing mailbox: $($_.PrimarySmtpAddress)" Get-MailboxFolderPermission -Identity "$($_.PrimarySmtpAddress):\calendar" | Where-Object {$_.User -like "martha@Dogg.com"} | Select-Object Identity, User, AccessRights

Microsoft Entra hybrid device pending

Failure to launch?  You can't unsee some things.  That Terry Bradshaw scene in the forementioned movie still haunts me.

This part is from Microsoft...

Resolve Microsoft Entra hybrid devices in pending state

During the initial phase of the hybrid join process, the device state is expected to be pending until the registration process is complete.

A device may remain in a pending state for the following reasons that an admin can address:

Microsoft Entra Connect device synchronization changes

Problems could occur if a change made in Microsoft Entra Connect caused the device ID to be out of sync with the machine. Validate Microsoft Entra Connect is functioning as expected and there was no recent configuration changes.

Required Microsoft endpoints may be blocked by network

Devices must be able to communicate successfully with the following Microsoft endpoints:

• https://enterpriseregistration.windows.net
• https://login.microsoftonline.com
• https://device.login.microsoftonline.com
• https://autologon.microsoftazuread-sso.com (If you use or plan to use seamless SSO)
• Your organization's Security Token Service (STS) (For federated domains)

After confirming the above scenarios aren't contributing to the pending state, run the following command ”dsregcmd /leave” in an elevated command prompt and restart the device to attempt to rejoin the machine. Changes may take up to an hour to show in Microsoft Entra.

If the issue is persistent after following the steps above,  for further assistance.

Step 1: Remove Stale Intune Enrollment Artifacts

Run these steps as local admin on the device.

1️⃣ Delete the EnterpriseMgmt scheduled tasks

Task Scheduler →
Task Scheduler Library →
Microsoft →
Windows →
EnterpriseMgmt

• You’ll see one folder with a long GUID
• Delete ALL tasks inside that folder
• Do NOT delete the EnterpriseMgmt root

2️⃣ Delete the matching enrollment registry key

Open Registry Editor and go to HKLM\SOFTWARE\Microsoft\Enrollments

Look for a GUID key that matches the one under EnterpriseMgmt

Confirm it contains a UPN value

Delete that GUID key

Step 2: Refresh Policy and Trigger Re‑Enrollment 

Open a command prompt and enter
gpupdate /force
shutdown /r /t 0

Am I too old to view the software installed on a remote computater?

Yall, I couldn't remember how to stealthy, geeky, and command liney check to see what was on a remote computer.  I thought I had a post about it but I could not find it.  So, here's an easy way to get your geek on.

Get-CimInstance -Class Win32_Product -Computer YoReplaceWithRemoteComputerName | where vendor -eq 'YoReplaceWithVendorName' | select Name,Version

If Peter Parker were to manage the Googles - GAM

 

GAM is an open source command line tool for making changes to objects in the Google Admin console. It is thoroughly documented at the Github Wiki. The options available for use with GAM are displayed in specific sections on the right-hand side of the GAM Wiki.

I always quote Peter Parker's Uncle Ben when discussing a tool like this.  
"With great power comes great responsibility" 
GAM is a powerful tool, and it could be easy to break a lot of stuff rapidly.  Google support may not be super forgiving if you tell them you deleted all your user accounts while using GAM.

If you need help, this page should be your next click.

Directory Commands

In my case, I needed a way to suspend a little over 1700 accounts that had been improperly processed for a few years.  Below is the command I used to suspend all the user accounts in the Inactive Students organizational unit.  Please note suspend 0 will make accounts active and suspended 1 will suspend the account.

gam ou "/Inactive Students" update user suspended 1

I should say, I'm not really sure what GAM stands for.  I assume it is Google Admin Manage(r) or something like that.  I couldn't find it listed anywhere.  

M365: I guess it's time to hybrid join

 Well, they finally pushed us to hybrid join all our clients to Microsoft Endpoint (otherwise known as intune).  It is actually really cool and made me excited about Microsoft again.  

You can do cool stuff like

• Finally, ditch WSUS servers in favor of Windows Update Rings (WUR)😍
• Deploy software packages and configuration profiles while the client is offsite
  
  Instructions to hybrid
  

Windows Updates Got The 0x80248007 Blues

Does your winders updates have the 0x80248007 blues?

1. Hold down the Winders Key and Press R. Type services.msc and enter.  If you are running as a standard user (you not be running with admin privileges), I like to run a command prompt by right click run as administrator.  Then you can type services.msc into the command prompt to run services.msc with elevated privileges. 

2. In the Services window, find the Windows Update and right-click it to select Stop.

3. Using the File Explorer or command prompt, navigate to the partition or drive where Windows is installed. Find the following path.  Usually this will be the C:\SoftwareDistrobution\DataStore

4. Delete everything in the DataStore folder.

5. Now go to C:\SoftwareDistrobution\Download and delete everything. 

6. You can now go back to services.msc and start the Windows Update service.

7. Find Windows Update or Automatic Updates, right-click it and select Start from the context menu.

Now you should be able to check for updates again to be sure everything is working.

Powershazzille Exchange Folder Size

From the Lazy Admin.  Cool dude Connect to Exchange Online with PowerShell - The Best Method (lazyadmin.nl)

1.  Launch an elevated PowerShell window

2.  Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
        a. Say Y

3.  Install-Module -Name PowerShellGet -Force
        a. Say Y

4.  Install-Module -Name ExchangeOnlineManagement -Force

5.  Update-Module -Name ExchangeOnlineManagement

6.  Connect-ExchangeOnline -UserPrincipalName john@contoso.com

Now that you are connected you can run the next command to get the folder size information.  Replace username with the user you want to look up.

7.  Get-MailboxFolderStatistics username | Select Name,FolderSize,ItemsInFolder

When you finish, don't forget to disconnect

8.  Disconnect-ExchangeOnline

Installing .mis and .exe packages with Intune

1.       Go to this link and download the converter.  If you want more instructions, click here.

2.       After downloading the IntuneWinAppUtil.exe, you may want to move it over to an easy to find folder on your computer.

3.       Run IntuneWinAppUtil.exe and follow the prompts.  The file will ask you for the following.

a.       Folder location of your source .msi or .exe

b.       The filename of the .msi or .exe

c.       The destination of the new .intunewin file we are creating

4.       Now you can head on over to endpoint.microsoft.com>Apps>Windows

a.       Click Add

b.       Select the app type Windows app (Win32)

c.       Select the .intunewin file you created earlier

d.       Fill out all the important information.  I like to be sure and add a logo image to make it easier for end users if you are going to allow them to select it in the company portal.

e.       Install command: if you converted a MSI the field should already be populated.  If you converted an exe file, you would use the setup.exe /s command in the

f.        The quest for the uninstaller

                                                               i.      You will need to run this powershell script to find the uninstaller identifying number.

                                                             ii.      get-wmiobject Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

                                                           iii.      Now you will need to put the msiexec.exe /x {unique identifying number from step 1} /qb command in the uninstall command in your Intune Win32 Application

M365: Whitelisting Stuff Against My Better Judgment

 Well, there are a few options on M365 when looking for where mail flow is hanging up.  I've never been really sure why you have to add it in multiple places.  Probably has something to do with the service it hits first in the mail flow.

• Sometimes it helps to add a mail flow rule "admin.exchange.micros>Mail flow>Rules"
•  Add a new rule but just remember to enable it.  
• Another option is to take a look at the SPAM filter "Security.microsoft.com>Email & collaboration>Policies & rules>Anti-Spam policies>Anti-spam inbound policy (Default)"
• Policies & rules > Threat Policies >Preset security policies.  Select the policy you want and then walk through the wizard until you get to the Impersonation protection section.  Then you will eventually come across the trusted senders and domains feature.