Powershell Script to Create SCCM Collections Based on Device Models

In an environment that SysAdmins doesn't have any idea about how many number of device models exists, managing device drivers will be a cumbersome task.

Following is a Powershell script to create collections based on device models that already inventoried by SCCM.

Resolve "Client certificate: None" Issue in a SCCM Client

Few days ago in a project that I involve in to replace a customer's existing SCCM CB infrastructure with a completely new one, I faced this "Client certificate: None" issue in a couple of computers. In their environment there are 2 Stand Alone Primary Site Servers with different site codes; existing and new one. Site is configured to use HTTP or HTTPS.

I was using a script to change the clients' site code and management point from existing to new one. While most clients that I tested changed its site assignment without issue, couple of Windows 10 version 1607 clients had this issue.

Reset Expired Domain Administrator Password in Azure DC

Today I had to face this issue of expired Domain Administrator password in a DC hosted in Azure IaaS. This is my SCCM lab environment which has a single DC and completely resides in Azure. The worst thing happened to me was, expired passwords of;

1. Local Admin account which I created at the time of creating the DC VM and also the Domain Admin.
2. Other only Domain Admin account.
3. SCCM Administrator account.

at the same time.

Enable Multifactor Logon Policy with Windows Hello

Windows Hello came as a technology to replace password based authentication with biometrics and PIN. Even though initially Microsoft said that this satisfies the multi factor authentication requirements, it was doubtful. They initially stated that PIN or biometrics is local to the specific device. So as per Microsoft, 1st authentication factor is the device, 2nd authentication factor is PIN or fingerprint or facial recognition. And there was no capability to use both PIN and fingerprint or PIN and facial recognition.

Now, with Windows 10 Fall Creators Update (version 1709) it is possible to do above.

Configure BitLocker on Intune Enrolled Windows 10 Devices

BitLocker can be managed in several ways in the enterprise. GPOs, MBAM, ConfigMgr are the most common methods. But what if you don't have Microsoft EA to bring in MBAM or you have Windows 10 Professional devices? And you have mobile Windows 10 devices that does not joined to ADDS. To overcome above issues, there's a possibility to manage BitLocker through Microsoft Intune and Azure AD. But to keep in mind this method does not provide funtionality as MBAM. In the end of this post I will describe limitations of this method.

Following are the steps to configure BitLocker through Intune and AAD. I have tested this on a Azure AD joined Windows 10 (1703) machine that directly enrolled in Intune as MDM.