Categories
Digital Transformation Intune Tips & Tricks

Recovery in a world without OSD

One of the big issues I hear people talk about when it comes to utilizing an image- and OSD less approach is “What if the hard drive breaks and we need to reinstall the machine?”. This is based on that assumption that we need to create a custom image with the drivers and such for recovery purpose. Disks do break, so this is a real problem.

However…

You probably bought that computer from one of the big computer manufacturers out there meaning that they thought of this.

In this article I will post many bold and naive statements, which you might not agree with. I understand that, but we also need to challenge how we have done things for the last 15 years. I’m not saying this is the whole truth, but I want to challenge the way you operate!

Disk failure

What happens when a consumer computer breaks down? Your typical home user does not have a Windows Deployment Services server running in their home network.

Most of the big manufacturers provides you with a new, fresh image created for your computer from their website, often using their recovery tool. The process to obtain the recovery image is a bit different based on which manufacturer, but it’s an uncomplicated way to recover a broken machine without the need to creating custom images.

Making use of what has already been created (and probably covered by the support commitment) should make sense. If someone else that we know and trust already created this, why shouldn’t we utilize it?

At least Microsoft, Lenovo, Dell and HP offers this service in one way or another.

A second option to this, but less ideal, is to use a generic Windows 10 image downloaded from Microsoft (or your Microsoft Volume Licensing Service Centre). The device will be missing all drivers to start with, but that is usually addressed using either the Windows Update feature or the driver update tool for that particular vendor (which you should consider using anyways to keep your drivers up to date on all your machines).

Resetting the device

If you for some reason need to reset a computer, there is no need to use an external media source to re-install Windows 10. This is built into the operating system, just like on your phone.

In Windows 10, instead of injecting your custom image, you simply reset the computer. Depending on where you are coming at it from, you might have to do it in different approaches.

Microsoft have documented this process very well here, so I won’t dig into it further on a how-to level.

Conclusion

I’m going to make a bold statement that many of you might not agree with. But operating systems deployment and creating custom images are a thing of the past. It will still be around for years to come since change does not happen overnight, and most companies have invested heavily in this. But it will start to fade away as more and more companies dare to trust the OEMs that their images are good enough. This will not solve data-loss at all, but it will bring the device back up and running which is often just as important for the user. Creating a custom image is an artform, but soon that artform needs to evolve into something else. There is a shift happening and we need to find other approaches to the old problems when we use new tools.

Today, this will not fit all scenarios. But if you look at the big picture, this could probably cover 80-90% of your user-base. Heck, you could have your users replace disks them self and then recover the operating system (imagine that!).

I’ve tried this with several different types of machines and manufacturers, and it works really well. You can even reset a custom image using the built-in reset feature. The result, however, can be a bit strange if you have removed a lot of the built-in apps etc. But the machine will still work and the user might not notice (especially if you make sure to deploy the needed apps to the end-user using Intune).

Combine this with the power of Office 365 and the cloud for storing your documents and work and you will have a pretty sweet setup where the device isn’t that important anymore.

Do explore the different possibilities in using standardized recovery media, but I’m not saying it will solve all your problems but it will take away some headache and hours spent on creating and maintaining custom images.

Categories
Intune Tips & Tricks

Silent Bitlocker in Windows Autopilot

When enrolling devices through Windows Autopilot and using Intune enabling Bitlocker without user interaction can be a little bit of a hassle since the default behavior is to ask the end-user to encrypt the device in runtime.

This pop-up can easily confuse end-users and the device is not really “ready to use” once the Enrollment Status Page (ESP) has closed.

There are several different solutions for this, where running a PowerShell-scrip as a Win32 app during enrollment is the most common one.

BUT I’ve found a way to skip this, but it does have some distinct limitations (except for all other Bitlocker requirements):

  • Use Intune for device management
  • Device can only be joined to the Azure AD
  • Running Windows 10 1809 or later
  • No third-party disk encryption services can be used

So how do you configure this?

In Microsoft Intune, go to Endpoint Security > Disk encryption and create a new profile:

Select “Windows 10 and later” as platform and choose the Bitlocker profile, then click create. Give your profile a name based on your naming convention and click next.

To enforce Bitlocker during enrollment, you need to

  • Set “Enable full disk encryption for OS and fixed drives” to Yes
  • Set “Hide prompt about third-party encryption” to Yes
  • Set “Allow standard users to enable encryption during Autopilot” to Yes

A heads up on these settings though, if you are using any third-party encryption, you might break the machine and you will have to re-install the machine. So be careful if applying to existing machines.

Then set your preferred settings for Bitlocker on OS and fixed drives, this is what I am running in this lab setup. One good setting to use is “Require device to back up recovery information to Azure AD” to ensure that you have the recovery information available for the machine. These settings might vary based on your organizational needs and requirements.

Click next until you end up on “Assignments” and select your targeted device group.

Click next and review your settings before hitting “Create” on the Review + Create page.

And that’s it! Your devices will now silently encrypt using Bitlocker during Autopilot enrollment.

Categories
Microsoft 365 Tips & Tricks

Make better looking PowerPoint presentations

Okay, so this isn’t a new feature in PowerPoint but it doesn’t make is less useful! (And I don’t think everyone knows about it).

There is a feature in PowerPoint called Design Ideas which helps you create better looking slides. It will give you several suggestions based on the content of you slide, like if you have bullet points you can show them in a more visually attractive way.

What I also really like, is that it will adapt to the template I user, like this one created with a corporate template. It will match the color scheme and not go to crazy with its suggestions.

The feature is called Design Ideas and you need to enable it in the ribbon. I use it quite frequently to make the PPTs a little more fun.

If you are not using a template, it will list some suggestions for you with more creative ideas then if you are using a corporate template.

What is your best PowerPoint tip? Share it in the comments!

Bonus…

However, sometimes you get weird suggestions like this GIF of water I got on a new slide. I´m guessing this is NOT what Microsoft meant by fluid framework…

Categories
Tips & Tricks

Making use of Windows features

(Originally published on LinkedIn)

Have you noticed that Windows 10 has a lot of built in features, some of them which are really good?

In this article my idea is to shed some light of two small ones which might not be known to everyone. These can be useful in an enterprise perspective and might even replace some other applications that you might have bought separate licenses for.

It might require that you be on Windows 10 1903 or higher.

Clipboard history (Win + V)

Ingen alternativ text angiven för den här bilden

In the Windows 10 1809 release there was an improvement to the clipboard feature in Windows. You no longer need to go back and find that text or picture again that you copied earlier. By enabling and using Windows button + v you can retrieve old data that you have copied. You can also set it to synchronise between devices.

Screen Snip (Win + shift + s)

Did you know that there is an improved Snipping tool in Windows 10 called Screen Snip? This can be used to take screen shots or screen snippets and add annotations if needed. It’s easy to use. You can either find it in the pen icon in the task bar or use the shortcut windows button + shift + s. You can then select to either take a snippet, window or full screen shot.

If you want, you can also through Settings > Ease of Access > Keyboard set the Print Screen button to activate this instead.

Ingen alternativ text angiven för den här bilden