Technical field notes on Windows, Intune, Autopilot, Azure and endpoint management.https://mauvtek.com/https://mauvtek.com/home/azure-always-on-vpn-using-entra-certs/https://mauvtek.com/home/azure-always-on-vpn-using-entra-certs/So Some time back I was asked by a friend if a Always on VPN was possible using azure but not having a CA or Certificate Authority, and well Azure and Entra have everything we need built in, so I came up with this article, hope it makes your life easier!Sat, 15 Feb 2025 21:30:57 GMThttps://mauvtek.com/home/windows-autopatch-customize-windows-update-settings/https://mauvtek.com/home/windows-autopatch-customize-windows-update-settings/Well to start off this is an AMZING DAY for Windows Autopatch, today the Autopatch Team has released into Public Preview the ability to Customize Windows Update Settings in the Autopatch UX. This is a huge step forward for Admins and I know a highly requested feature for many current Autopatch customers. So let's dive Thu, 09 Mar 2023 07:14:19 GMThttps://mauvtek.com/home/dvr1fsjak70menrrkcbalu3hhr1kxg/https://mauvtek.com/home/dvr1fsjak70menrrkcbalu3hhr1kxg/So some stuff from my Past! No we aren't in a therapy session! I thought I would bring some stuff I have built for customers in the past, this one was a script to validate DNS records and perform an update if needed.Tue, 24 Jan 2023 04:53:54 GMThttps://mauvtek.com/home/so-its-autopatch-expedited-releases/https://mauvtek.com/home/so-its-autopatch-expedited-releases/So wanted to take a few minutes to talk about Expedited release in Windows Autopatch. This is a function that flies a little under the radar as it's not something we use very often but when we need it, WE NEED IT!Thu, 19 Jan 2023 04:07:12 GMThttps://mauvtek.com/home/windows-autopatch-overview-authentications-and-more/https://mauvtek.com/home/windows-autopatch-overview-authentications-and-more/Wed, 28 Dec 2022 01:02:40 GMThttps://mauvtek.com/home/ad-to-aad-join-via-configuration-manager-task-sequence/https://mauvtek.com/home/ad-to-aad-join-via-configuration-manager-task-sequence/So talking about the Task sequence built to facilitate AD to Hybrid Azure AD join I started with a task sequence because let's face it majority of on-premise enterprise environments are running SCCM and leveraging Task Sequences and Task Sequences are just an elegant way to execute what I was looking for.Fri, 13 May 2022 05:24:48 GMThttps://mauvtek.com/home/azure-ad-join-provisioning-package/https://mauvtek.com/home/azure-ad-join-provisioning-package/Creating a Provisioning Package is a supported method to provide an unattended method to Join a device to Azure AD, as you have probably noticed if you have spent time looking into options there aren't many supported options other than manually with in windows or through a process like Autopilot.Fri, 13 May 2022 05:24:31 GMThttps://mauvtek.com/home/active-directory-join-to-azure-ad-join/https://mauvtek.com/home/active-directory-join-to-azure-ad-join/So this is an interesting topic and one I have to be clear This is not a Microsoft supported process today (Though all the steps on their own are supported). We are pushing for Microsoft to provide a formally supported method but until then this might do. Internally we more commonly refer to this process as Hybrid to AFri, 13 May 2022 05:24:22 GMThttps://mauvtek.com/home/b1yxd9fy1plnuvbq0u8i30e72wjctb/https://mauvtek.com/home/b1yxd9fy1plnuvbq0u8i30e72wjctb/Here are some links bringing together some of the major resources used to build a foundational Enteprises build.Tue, 03 May 2022 04:20:03 GMThttps://mauvtek.com/home/office-edge-and-one-drive-settings-for-the-enterprise/https://mauvtek.com/home/office-edge-and-one-drive-settings-for-the-enterprise/So I have been asked about how to get those standard apps ready on most enterprise builds. These are simple, not to complicated not getting to crazy. Many admins make the mistake if there is a configuration I must configure it! This will lead to a world of pain, years of deploying Microsoft products has taught me to taFri, 15 Apr 2022 22:52:20 GMThttps://mauvtek.com/home/device-configurations-or-settings-catalog-for-the-enterprise/https://mauvtek.com/home/device-configurations-or-settings-catalog-for-the-enterprise/In my time deploying enterprise ready windows builds around the world I have seen some pretty consistent configurations, which take us down a deep deep HOLE! of Group Policy.Group policy is a familiar tool to everyone in the windows management / admin space. For years we have bet our device security and reliability on Fri, 15 Apr 2022 19:58:35 GMThttps://mauvtek.com/home/xgx2goclxv2czxokq960w3mtd9m91f/https://mauvtek.com/home/xgx2goclxv2czxokq960w3mtd9m91f/So I have had quite a few customers ask me about what I set when configuring autopilot profiles and why? For the sake of the post I will focus on Azure AD join mainly because Hybrid is a nightmare of complexity and I have found very few cases where Hybrid was the better choice, I always encourage start with Azure AD joFri, 15 Apr 2022 02:49:23 GMThttps://mauvtek.com/home/so-yet-another-bit-locker-blog-post/https://mauvtek.com/home/so-yet-another-bit-locker-blog-post/Bit locker is not a new technology it has been around for many years, and I remember the day of deploying MBAM for enterprises, and fighting with TPM preparation scripts and logic as well as firmware configurations before the technology was really standardized.Tue, 29 Mar 2022 03:18:51 GMThttps://mauvtek.com/home/so-we-are-still-talking-dns-suffix-for-azure-ad-join-devices/https://mauvtek.com/home/so-we-are-still-talking-dns-suffix-for-azure-ad-join-devices/So this was something which came up a few months back with a customer, we realized in many organizations DNS Search suffix is set by AD Group Policy or the DHCP scope using options. But when deploying an Azure AD join device without line of sight we may not get search suffix and after connecting VPN UNC paths and some Tue, 29 Mar 2022 00:45:06 GMThttps://mauvtek.com/home/onedrive-more-than-just-known-folder-redirection/https://mauvtek.com/home/onedrive-more-than-just-known-folder-redirection/So a few years ago yes I said a few years ago, I had a customer ask if it were possible to Redirect more than just Desktop, Documents, and Pictures in OneDrive which is included natively in Known folder redirection? Interesting thought they, like many organizations have been using folder redirection of various folders Mon, 28 Mar 2022 04:32:38 GMThttps://mauvtek.com/home/veaws9z6pkyg4vuh8898vgaihskn0k/https://mauvtek.com/home/veaws9z6pkyg4vuh8898vgaihskn0k/So let's start by talking about certificated now certificates have been around an extremely long time and are not a new concept in most Enterprises today. In the past we would use services like NDES (Network Device Enrollment Service). For a great blog on NDES and how to deploy check out Jeff Gilberts Blog Link. For thMon, 28 Mar 2022 03:56:50 GMThttps://mauvtek.com/home/digging-into-autopilot-diagnostics-page/https://mauvtek.com/home/digging-into-autopilot-diagnostics-page/So l want to take some time to talk about a new Public Preview Feature call Windows Autopilot Diagnostics. This feature is replacing the existing get-autopilotgdiagnostics.ps1 script developed by the Autopilot Feature team. Diagnostics is critical to developing a successful Hybrid Azure AD join when troubleshooting ODJWed, 29 Sep 2021 04:26:00 GMThttps://mauvtek.com/home/windows-11-autopilot-oobe-esp-updates/https://mauvtek.com/home/windows-11-autopilot-oobe-esp-updates/Now it's time to check out the ESP on Windows 11 through an Autopilot Deployment. In my environment I'm running on a Hyper-V VM so Network is already there so first boot goes straight into updates as expected. Nice fresh UI for windows 11.Tue, 28 Sep 2021 15:51:51 GMThttps://mauvtek.com/home/windows-11-new-oobe-experience/https://mauvtek.com/home/windows-11-new-oobe-experience/So I spent some time playing with Windows 11 Autopilot today and really liked the new out of box experience. And with that we have a new autopilot ESP as well. Here are my thoughts…Tue, 28 Sep 2021 05:37:37 GMThttps://mauvtek.com/home/intune-trusted-site-who-cares/https://mauvtek.com/home/intune-trusted-site-who-cares/So trusted site is an important part of any enterprise environment. This policy controls the user experience, when accessing certain website allowing pass through authentication or SSO. Also allowing certain security controls to be bypassed for trusted sites such as Active X and various resource mappings. I'm not goingMon, 27 Sep 2021 23:30:17 GMThttps://mauvtek.com/home/what-about-autopilot-device-groups/https://mauvtek.com/home/what-about-autopilot-device-groups/So one critical part of any successful Autopilot process is targeting, we need a way of pointing our Autopilot Devices to the correct profiles. Now I always try to keep these down to a single profile for traditional AAD or even Hybrid if you have no choice, but you may want to dabble in auto deploy scenarios which willMon, 27 Sep 2021 19:45:01 GMThttps://mauvtek.com/home/onedrive-for-business-auto-registration-old-school/https://mauvtek.com/home/onedrive-for-business-auto-registration-old-school/So this is something I wrote quite some time ago, many folks configure OneDrive using the Administrative Templates in Intune, but old habits Die Hard. Below you will learn how to build a One Drive Profile to Auto Configure OneDrive under the current Logged on user using a Custom CSP and ADMX ingestion, very slick ProceTue, 17 Aug 2021 03:32:44 GMThttps://mauvtek.com/home/intune-configuring-windows-enrollment/https://mauvtek.com/home/intune-configuring-windows-enrollment/There are a lot of guides out there for Microsoft Intune, this one is going to be focused at Windows Management primarily around Azure AD Join, replacing much of the on-premise functionality to provide a Modern approach to Windows Management.I always start at the Windows Enrollment you can find this section under DevicTue, 17 Aug 2021 03:29:05 GMThttps://mauvtek.com/home/configuring-windows-enrolment-status-page-esp/https://mauvtek.com/home/configuring-windows-enrolment-status-page-esp/The ESP gives use the ability to hold the user as a designated screen, until our configurations are complete then allow the user access to their desktop once all configurations are complete. Below is an example on how I configure this with customers.Tue, 17 Aug 2021 03:28:20 GMThttps://mauvtek.com/home/whats-this-mobility-stuff-in-azure-active-directory/https://mauvtek.com/home/whats-this-mobility-stuff-in-azure-active-directory/So a common misconfiguration I see is how customers configure the Mobility (MDM and MAM) in the Azure Resource Manager Portal. Where Azure AD join will still operate without this being configured, you will have inconsistent results leveraging Intune or other 3rd party MDM if this is not configured correctly.Fri, 13 Aug 2021 03:24:25 GMThttps://mauvtek.com/home/ensuring-your-tenant-is-ready-for-azure-ad-join/https://mauvtek.com/home/ensuring-your-tenant-is-ready-for-azure-ad-join/So I have been asked a few times to walk through a customer's environment ensuring everything is in place for Azure AD join Scenarios. Most Azure AD Tenants come pre-configured for Azure AD Join, but Here are a few of the configurations to what out for and why they are important.Thu, 12 Aug 2021 01:40:46 GMThttps://mauvtek.com/home/always-start-with-azure-ad-join/https://mauvtek.com/home/always-start-with-azure-ad-join/So this has been an interesting debate for the past few years as I have worked with various customer working towards a modern approach to Windows 10. Whether modern means Hybrid or Full Azure AD Join. In this Blog I will talk about rational of Azure AD vs Hybrid and in future Blogs on how I achieve an Enterprise Ready Wed, 11 Aug 2021 23:25:35 GMThttps://mauvtek.com/home/6f1qiunrh6hj658kbbmtqr0y46dizy/https://mauvtek.com/home/6f1qiunrh6hj658kbbmtqr0y46dizy/I have spent the last 5 years as a Microsoft Customer Engineer working with organization around the globe adopt a MODERN approach to windows Deployment and Management. During this time I interacted with over 100 different companies and environments making this journey. This Blog will be the outcomes of much of that expFri, 16 Jul 2021 03:46:39 GMT