Anoop C Nair is Microsoft MVP from 2015 onwards for consecutive 10 years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is Blogger, Speaker, and Local User Group Community leader. His main focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career etc...
Let’s discuss the SCCM ConfigMgr Current Branch Backup Recovery Options | Configuration Manager | Endpoint Manager. This post contains a collection of video tutorials that I created last year to help you better understand the backup and recovery process of the SCCM ConfigMgr Current Branch (CB).
As part of the website revamp, I checked whether the posts were okay, and this series of SCCM/ConfigMgr CB backup and recovery posts came to my attention. SCCM ConfigMgr Current Branch Backup Recovery Options?
These videos should give you an overview of the entire backup and recovery process, with different scenarios, such as restoring with a full native SCCM ConfigMgr CB backup.
Also, backup and restore only using SQL backup, etc..CD.LATEST folder is another big change in the backup and recovery process if you compare SCCM 2012 and SCCM CB. I wish that none of us (SCCM Admins) should be in a situation where we must restore our site from backup! But be ready for the worst case.
How to Recover or Restore the SCCM CB Primary Server using SQL Database Backup
In this video, I’ll show you how to restore your SCCM CB 1606 primary server, especially if you’re using Intune Hybrid, using an SQL database backup. The key is that you don’t need a full backup of SCCM CB to get your primary server back up and running.
SCCM ConfigMgr Current Branch Backup Recovery Options – Video 1
The following are the posts you can refer to for each scenario. I’m still planning to create the last couple of videos in this series, which will cover the backup and restore of the SCCM/ConfigMgr CB CAS server either from native SCCM backup or from SQL backup.
How to Plan Backup and Recovery for SCCM ConfigMgr CB
SCCM ConfigMgr Current Branch Backup Recovery Options | Configuration Manager | Endpoint Manager? This post contains a collection of video tutorials that I created last year to help you better understand the backup and recovery process of the SCCM ConfigMgr Current Branch (CB).
As part of the website revamp, I checked whether the posts were okay, and this series of SCCM/ConfigMgr CB backup and recovery posts came to my attention.
CD.LATEST?
These videos should give you an overview of the entire backup and recovery process, with different scenarios, like restoring with a full native SCCM ConfigMgr CB backup, backup and restore only using SQL backup, etc. The CD.LATEST folder is another big change in the backup and recovery process if you compare SCCM 2012 and SCCM CB.
I wish we (SCCM Admins) would never be in a situation where we must restore our site from backup, but be ready for the worst case.
The following are the posts you can refer to for each scenario. I’m still planning to create the last couple of videos in this series, which will cover the backup and restore of the SCCM/ConfigMgr CB CAS server either from native SCCM backup or from SQL backup.
How to Plan Backup and Recovery for SCCM ConfigMgr CB
How to Restore or Recover SCCM ConfigMgr CB Standalone Primary Server
This video tutorial explains restoring or recovering an SCCM/ConfigMgr CB standalone primary server. Some prerequisites are needed to ensure a smooth and successful recovery of your SCCM/ConfigMgr CB standalone primary server. It helps maintain consistency and compatibility with your existing setup.
How to Recover SCCM CB Primary Server Using SQL Database Backup
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the SCCM Online Service Connection Point Details – 2 Options. Microsoft released a new SCCM Current Branch version, SCCM CB 1610. If you are running SCCM CB 1511, 1602, or 1606, you can directly upgrade to SCCM CB 1610. This post and video provide more details about SCCM ConfigMgr CB Updates in Console and Upgrade.
SCCM Upgrade Process The ConfigMgr CB upgrade process via updates and servicing channel is very straightforward if you have an ONLINE service connection point mode.
If you are running an offline service connection point mode, you must perform manual ways to get the latest SCCM CB 1610 updates available in your SCCM CB console.
This post provides all the details about the SCCM Online Service Connection Point Details—2 Options. For SCCM CB infra with an online service connection point, the SCCM CB 1610 update will automatically appear in the console once Microsoft has released this for “slow ring“.
Now (18th Nov 2016), Microsoft released SCCM CB 1610 updates only for the “fast ring,” which can be enabled only by running a PowerShell script provided in the following link.
SCCM Online Service Connection Point Details – 2 Options – Fig.1
SCCM Servicing Flowchart
Let’s discuss the SCCM Servicing Flowchart. The screenshot helps you show the updates and servicing download process. The flow chart documentation is here.
Updates and Servicing Download Process
Service Connection Point
Hierarchy Manager
The hierarchy Manager checks the applicability of the package
Is the package applicable?
DMP Downloader downloads the payload and redist files
The hierarchy Manager checks the applicability of the package
SCCM Online Service Connection Point Details – 2 Options – Table 1
SCCM Online Service Connection Point Details – 2 Options – Fig.2
How Did I Upgrade ConfigMgr SCCM CB 1602 to 1606
This is a 1-minute video that tells you how to start the SCCM CB 1610 upgrade process once the updates are available in the CM CB console. I have already covered the end-to-end SCCM CB upgrade process in a videohere (even though that is about the CM 1606 upgrade, the process is similar).
SCCM Online Service Connection Point Details – 2 Options – Video 1
Start the Upgrade Process from the Console
I’m sharing the video tutorial about upgrading the SCCM ConfigMgr CB 1610 console. Before initiating the SCCM ConfigMgr CB console upgrade process, you must complete all the reset activities for site system roles (sitecomp.log gives you more ideas). Otherwise, there could be more chances of failures during the SCCM CB console upgrade.
SCCM Console Upgrade
Let’s discuss the SCCM Console Upgrade. The below section shows the SCCM Console Upgrade details.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch. SCCM ConfigMgr’s current branch (CB) XXXX was released last Friday (18th Nov 2016).
SCCM CB YYYY has many features, and the upgrade process via updates and servicing channels is straightforward. You are done with the SCCM CB 1610 upgrade with just a couple of clicks.
You can directly upgrade your SCCM CB 1511 server to 1610. You do not need to go through all the other upgrades (1602 /1606) available in your SCCM CB console. The blog post with more details is availablehere.
This post will share a comparison video of SCCM CB 1606 and 1610 features. The features discussed in the video below are essential for upcoming changes to SCCM ConfigMgr CB.
The video tutorial below explains how I Upgraded ConfigMgr SCCM CB 1602 to 1606.
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch – Video 1
Feature Comparison Between SCCM ConfigMgr CB Versions
The configuration and compliance policy updates are critical if you use a hybrid SCCM CB version to manage mobile devices and domain-joined machines. I think the SCCM team invested loads of time in improving the features of their product.
Feature Comparison Between SCCM ConfigMgr CB Versions
SCCM ConfigMgr 1606 and 1610
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch – Table 1
Feature Comparison Between SCCM ConfigMgr CB Versions | Configuration Manager Current Branch – Fig.1
Feature Comparison Between SCCM ConfigMgr CB Versions
SCCM CB is moving away from old-fashioned boundary-setting, such as fast and slow boundaries. Rather, investing more in current and neighbor boundary groups. This will help to evolve the product further in upcoming versions.
A version of SCCM 1610 feature comparison includes Boundary groups
current and neighbor boundary groups, Improvements on Windows Store for business,
Content size filter in Software update ADR and monitoring of loads of components have been updated,
And new dashboards have been included.
List of Feature Comparison Between SCCM ConfigMgr CB Versions
New Features as part of SCCM CB 1610 updates and servicing. Boundary Changes – Improvements for boundary groups – current boundary group vs neighbor boundary groups.
Improvements Windows Store for Business – Modify the client secret key and delete a subscription to the store from the SCCM Console.
Cloud management gateway for managing Internet-based clients – Cloud management gateway provides a simple way to manage Configuration Manager clients on the Internet.
Immediate Policy sync for MDM channel Intune-enrolled devices.
Configuration policies – New policies included in SCCM CB 1610 – Android (23), iOS (4), Mac (4), Windows 10 desktop and mobile (37), Windows 10 Team (7), Windows 8.1 (11), and Windows Phone 8.1 (3).
The Windows 10 Edition Upgrade Policy can be applied for SCCM CB 1610. It is now available for Intune and SCCM clients.
Client Agent—Client Peer Cache helps you manage content deployment to clients in remote locations. Peer Cache is a built-in SCCM solution that allows clients to share content directly from their local cache. To share content, enable the Configuration Manager client in full OS. Yes.
Customizable Branding is also included in the SCCM CB 1610.
The enforcement grace period is an excellent feature of SCCM CB 1610.
Another nice feature included in SCCM CB 1610 Software Update ADR is Content Size.
Monitoring – Compliance policies Dashboard and Client Data Source Dashboard.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Let’s discuss the Intune Starter Kit, a Helping Hand for IT pros who want to learn Intune. Loads of people requested a starter kit for Intune, as I have one for the SCCM 2012 starter kit, and the SCCM 2012 starter kit page was handy for the community (I think that is why people are requesting the Intune Starter Kit).
This post will mainly concentrate on Intune standalone (not Intune Hybrid and Office 365 Intune MDM). In most cases, there is no need/very minimal need for on-prem infrastructure if you go with Intune standalone and all the other cloud components like Azure Active Directory, Office 365, etc. I’ll keep adding new things to this page. This is just starting 😉
I started working with Intune in the latter part of 2012, and Microsoft Intune has evolved a lot over the years. In 2013, I started a post called “Microsoft Intune Wiki” (most of the links are outdated, but it’s worth going through if you want to see how Intune was).
We already have a Facebook group for Intune Professionals. If you would like to join the Facebook community of Intune Professionals, click here
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
What is Microsoft Intune?– Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune
Intune is Microsoft’s enterprise mobility management (EMM) solution. The EMM provider helps manage mobile devices, network settings, and other mobile services and settings. Microsoft Intune combines Device, Application, Information Protection, Endpoint Protection (antivirus software), and Security/Configuration policy management solution (SaaS) facilitated by Microsoft in the Cloud.
Additionally, Intune has features where admins can create a “Conditional Access” policy to get access to company resources. Only Intune will provide access to company or corporate resources (corporate mail, SharePoint, etc.) if the devices meet those conditions.
Previously, I mentioned Microsoft Intune as a lighter version of SCCM or ConfigMgrin the cloud. However, I don’t want to make it so simple this time. Intune architecture is entirely cloud-based and agile. To get a more detailed idea about Intune (Yes, this video is old and outdated in some parts as Intune evolved along with Microsoft’s Enterprise Mobility and Security (EMS).
I’m going to explain this in a slightly different way. Let me know if this is confusing. We can manage devices with an Intune client agent and arguably without one. For example, Intune company portal application(s) in different app stores like Google Playand Apple Store are Intune client agents.
So, when you install the Intune company portal onto your Android or iOS devices, you are doing agent-based management. Also, the Microsoft Intune client MSI can be downloaded once you have a valid Intune subscription. You can download and install it on Windows machines that you want to manage.
I have an old post (published in Dec 2012) here to help you understand the basics of Intune MSI agent installation. Once you install the Intune MSI agent on Windows machines, Intune will “fully manage” those machines.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.1
So, what is arguably agent-less Intune management? Within Windows 10, we have a “build—Native” MDM agent as part of the operating system. We can enrol Windows 10 devices in Intune using the “in build—Native” MDM agent. In this scenario, we must use the Intune company portal to install applications like a shopping cart.
So, the Intune company portal does not act as an Intune agent in native MDM enrolment scenarios. Native MDM-managed devices are arguably NOT fully managed devices (at this point). I’m sure this will change sooner or later. The Windows 10 in-built MDM agent can enrol your Windows 10 devices in any other MDM management software, such as VMware Airwatch, Mobileiron, etc.
Enrolled via the Intune company portal.
Enrolled via Installation of Intune MSI client.
Enrolled via Windows 10 1607 and above in build Azure AD join and MDM enrolment.
MAM without MDM enrolment.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.2
How Do you Get an Intune Account and Start Working/Testing with Intune?
Download the Microsoft EMS step-by-step guide from here. This guide will help you get a free trial version of Office 365, Azure AD, and Intune subscription. If you already have an Azure AD (Azure AD premium) subscription, things are straightforward, as I posted in the blog here.
Suppose you don’t have an Azure AD subscription. It is better to start with anEnterprise Mobility Suite (EMS)trial account, an Azure Free Trial Account (an Azure trial account is already created as an EMS trial account), and an Office 365 free trial subscription. Creating a NEW outlook.com account and getting ready with credit card details to activate the Azure trial subscription is better for getting these trail accounts.
Getting a trial version of Azure AD, Office 365, and Intune is very straightforward if you have never done this same process with your credit card and mobile number. Azure AD and Office 365 are prerequisites for Intune if you want to test all its features.
Note: Intune can also be signed up separately from here. If you want to test only Intune now, this is the way to go.
How to Start using Microsoft Intune Console
Once you have completed the subscription steps, you can log in to the Microsoft Intune (http://manage.microsoft.com/) portal (Silverlight is necessary for the Intune console to work). Internet Explorer with the Silverlight plugin is the best internet browser for the Intune console.
However, the Intune console will work on any internet browser that can add Silverlight as a plugin. It might even work without the Silverlight plugin, and I would love to see this soon.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.3
How Do you Select the MDM Authority from the Intune Console?
MDM authority and management options are significant to me. Please note that you won’t be able to change it once you set MDM (Mobile Device Management) authority to Intune in the following place at the Intune console.
To change Intune MDM authority, you must raise a ticket with CSS or a service request via the Intune/Office 365 portal. So be very careful when you click on any links on the following page at the Intune console.
What Types of Management Authority Do We have for Intune?
Microsoft Intune
Configuration Manager (SCCM)
Office 365 (lightweight Intune)
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Table 1
Quick question: Do I need to re-enrol devices if the MDM authority is changed from o365 MDM to Intune MDM? It works without re-enrolment of devices; it is just a compliance check, and everything looks okay on the device. I heard it’s supported, as both use Intune for MDM.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.4
How to Start Managing Windows/iOS /Android Devices with Intune?
Managing Windows devices is very straightforward. Yes, Windows 10 management is very straightforward; earlier, we needed side loading and key SEP certificates to manage/deploy apps for Windows and Windows Phone devices.
Most of these certificates and sideloading essential requirements have been removed for most scenarios. Managing Android devices is also very straightforward. It takes 10 minutes to sync your Windows Store for Business and Microsoft Intune. More details are provided in the post “Integrate Windows Store for Business” here.
If you want to install store apps without using a Microsoft account, read the blog post “How to Add Apps to Business Store and Install Intune Company Portal without Using MS Account” here.
However, iOS\MAC OS device management has certificate requirements, and we need to go to the Apple portal, upload your cert for the tenant, and get the certificate for your Intune tenant.
The process for SCCM CB is explained in the following video, but the process is similar for Intune. More details here Microsoft document specifically for Intune.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Video 1
How Do I Deploy MSI Applications to Windows PCs using Intune?
Like SCCM, Intune can also deploy different applications to other devices. The types of applications that Intune supports now are EXE, MSI (Windows Installer and Windows Installer through MDM), APK, IPA, XAP, and APPX—APPXBUNDLE for Windows app package and Windows Phone app package. We can make software or applications available to devices via three methods.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.5
1. Software Installer – select the type of software you want to install
2. External Link – this can be used for deploying the applications in the Google Store via deep linking
3. Managed iOS apps from Apps Store – this can be used to deploy the apps in the Apple Store via the deep linking method
Creating policies in Intune is another crucial step in configuring and managing devices through Intune. The following is the list of policies you can create and deploy via Intune.
Configuration Policies
Compliance Policies
Dynamics CRM Online Conditional Access Policy
Exchange Online Conditional Access Policy
Exchange On-premises Conditional Access Policy
SharePoint Online Conditional Access Policy
Skype for Business Online Conditional Access Policy
MAM Application Policy
MAM Browser Policy
What is the difference between the Intune Configuration and Intune Compliance Policy? You can see similar settings in compliance and configuration policies in some cases. So, what is the exact difference? Compliance policy works with conditional access policies; however, configuration policies are independent of conditional access. Compliance policies can deploy ONLY to USERS, whereas Configuration policies can be deployed to Devices and Users.
The Following Video will Explain How to Create and Deploy Intune Compliance Policies from the Console.
Compliance policy won’t force the device to change its configuration; rather, it will wait until the device enters the compliance stage to provide access to company resources like mail/SharePoint (in case a Conditional access policy is set). The configuration policy forces the device or user to change the configuration setting mentioned in the policy (which is arguably not true in all scenarios).
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Video 2
What are MAM (Mobile Application Management) Policies?
Mobile Application Management policies are application-specific policies you can set up via Intune. What is the difference between configuration, Compliance policies, and MAM policies? Configuration and Compliance policies are for the entire device. It applies to everything on the device. MAM policies will be used only for the application with which it’s associated.
Intune Starter Kit a Helping Hand for the ITPros who wanted to Learn Intune – Fig.6
What is MAM without MDM enrolment (MAM WE – MAM Less MDM)?
This is another policy type in Intune. What is the difference between MAM with MDM enrolment and MAM without MDM enrolment? These are Mobile Application Management policies without enrolling in Intune. They help secure corporate data using BYOD/personal devices to access corporate mail, SharePoint, etc.
Why is the Intune option visible in the Azure portal (https://portal.azure.com/)? This is good news for SCCM/Intune admins. We are getting new features in Intune. This time, it’s Intune MAM (Mobile Application Management) without MDM enrolment.
For complete mobile device management, we must use the original Intune portal (https://manage.microsoft.com). Forums and other communities regularly asked whether Intune could coexist with MDM products like Airwatch or Mobile Iron.
How Do You Manually Add Users to the Intune Console?
How do you add users to the Intune console and provide permissions to users in the Intune console? We don’t have to do this when Intune Silverlight console is migrated to the Azure portal??
Before you try to provide service administrator access (limited roles available in Intune Silverlight console Full Access, Read-Only access, or Helpdesk—Group Node access) to users in Intune, you should make sure the administrator or server administrator user is already available in the Intune administrator console. More info here.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
Are You Having an Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr?
Are you having issues with Windows Information Protection (WIP, previously known as “Enterprise Data Protection – EDP” policies configured through the SCCM ConfigMgr CB 1606 production version?
If so, I was one of you. I’m talking about the issue I faced while deploying the WIP policy via the Windows 10 MDM channel. I will try to explain the problem which I had with WIP CI (for the specific scenario which I tested):-
When you open WIP CI, try to check whether everything is okay or not and exit out of CI with/without making any changes. Some values in CI XML will automatically change, breaking the entire CI.
Windows Information Protection WIP– Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr
I’ve embedded a video below explaining this bug/issue. If you are new to WIP/EDP and want to know how to create, deploy, and test WIP with Windows 10, look at my previous post and video here.
The good news is that Microsoft’s new rollup update (KB3186654)most probably fixed this issue. I have done extensive testing with Windows Information Protection (WIP) policies/CIs after installing the new rollup on the SCCM CB 1606 server, and the results are very promising.
Name
Type
New Windows 10 WIP
General
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr – Table 1
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr – Fig.1
How to Create – Deploy WIP EDP Using SCCM CB 1606 and End-user experience of WIP
I tried creating new WIP CIs, editing the existing WIP CIs, etc. All the scenarios I tested worked well for me. I tested this with Windows 10 1607 build numbers 14393.00 and 14393.82 (via MDM channel). Are You Having an Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr Endpoint Protection?
Are You Having Issue with Windows 10 WIP EDP SCCM CB Configuration Manager ConfigMgr – Video 1
Sample of the correct WIP CI with correct ConstantValue
Let’s discuss the Sample of the correct WIP CI with the correct ConstantValue. The below section helps you show the sample of the correct WIP CI with the correct ConstantValue.
We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.
