Archive for the ‘Windows 10’ Tag

Step by Step Create a User P2S VPN using Azure Secured Virtual Hub and Azure Active Directory #SDWAN #Azure #Secure   Leave a comment

There are multiple ways on how to use a VPN and how to connect and use this. In this blog I use an Azure Virtual WAN Hub with associated security and routing policies configured by Azure Firewall Manager.

When connecting to your Virtual Hub over the IKEv2 protocol, you can use certificate-based authentication or RADIUS authentication. However, when you use the OpenVPN protocol, you can also use Azure Active Directory authentication.

I will use the open VPN with Azure Active Directory authentication. Remember this is only supported on Windows 10 as you will need the Azure VPN client from the microsoft store.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

For giving the vpn application the proper permissions, you need to register the application to your Azure AD first.

below is the default URL that can be used to trigger the registration, use the proper rights to create an enterprise App in you Azure AD

https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent

Sign in with the proper credentials

image

Using the wrong account will end up in

AADSTS50020: User account  from identity provider ‘live.com’ does not exist in tenant ‘Microsoft’ and cannot access the application ‘4b4′(Azure VPN) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

When Accepted the you will be redirected to the Azure portal.

image

In the Azure portal you can go to the Azure active directory and

Enterprise applications | All applications  and search for Azure VPN

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Now that the basics are in place, we can configure our Site to Site VPN profile the following information is needed.

Go to your Virtual Wan and select the user VPN configuration

imageimagehttps://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Create User VPN ##### I noticed during the writing of this blog post the screens may differ as the portal changed the layout#######

  • Configuration name – Enter the name you want to call your User VPN Configuration.
  • Tunnel type – Select OpenVPN.
  • Authentication method – Select Azure Active Directory.
  • Audience – Type in the Application ID of the Azure VPN Enterprise Application registered in your Azure AD tenant.
  • Issuerhttps://sts.windows.net/tenantID/
  • AAD Tenanthttps://login.microsoftonline.com/TenantID

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Select open VPN

go to the Azure Active Directory <> properties and grab the Tenant ID

image

image

Set the switch to yes and new fields will open.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

 

#the number is your tenant ID

image

Now that the VPN user profile is created we can configure the HUB

image

Now that the user vpn profile is created we can create the P2S VPN.  Select your hub

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Select the user VPN point to site VPN  select create

image

Creating a VPN gateway you need to select the just created User profile.  

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Select a proper IP subnet and if needed a DNS server for the workload into that network

Updating a hub can take 30 minutes or more.

image

Download User VPN profile as we need this on the Windows 10 client later.

Use the VPN profile to configure your clients.

  1. On the page for your Virtual WAN, click User VPN configurations.
  2. At the top of the page, click Download user VPN config.
  3. Once the file has finished creating, you can click the link to download it.
  4. Use the profile file to configure the VPN clients.

imageimage

To download the Azure VPN client on your windows 10 test device.

Use this link to download the Azure VPN Client.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011image

Open the VPN Client you can add a new VPN or import a Connection

image https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

For Importing the Connection we need the just downloaded zip file and extract this in the AzureVPN folder there is a XML that holds the vpn configuration.

image

image https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

 

If any thing goes wron with the import it is 99% your pbk file,

 

image

go to the following folder and delete the files – this will probably also remove your other vpn connections it you had any.

%userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk

C:\Users\admin\AppData\Local\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\LocalState

imageimage

Now that the Import worked and you are ready to connect to the VPN in Azure.

image

  Use your Azure AD credentials or your FIDO2 key

imageimage

 

image

  Now we are fully connected to the Secure Virtual WAN in Azure

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

It can take some time to see your connection in the portal

image

Showing the above it all is easy to setup this but I already see the questions yes but I need to do this on 5000 Windows 10 devices.  

Microsoft Endpoint Management is your best friend.

Deploy VPN with Microsoft Endpoint Management 

We create a Custom Template and do not select the VPN option as this is not for uploading the XML

image

image

In our Custom settings we add the Following settings

  • Name: Enter a name for the configuration.
  • Description: Optional description.
  • OMA-URI: ./User/Vendor/MSFT/VPNv2/demo01_hub-weu/azurevpnconfig.xml (this information can be found in the azurevpnconfig.xml file in the tag Name).
  • Data type: String (XML file).

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Now that this is done we can create some assign ments and test this on the pilot group

image

 

As you can see there are a few steps involved and are linked together

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted May 24, 2021 by Robert Smit [MVP] in Azure

Tagged with ,

Journal, a Microsoft Garage project #Windows10 #Journal #Garage #Wimvp #WindowsInsiders @MSFTGarage   Leave a comment

What is the Journal app ? it is a Windows  10 app helping people who love to journal to evolve their ideas and express themselves quickly with the power of their digital pen.

Description

Journal, a Microsoft Garage project, is an app for Windows that invites people who love to journal to pick up their digital pen, express themselves quickly, and evolve their ideas. Of all the different methods of device interaction, digital ink is unique in the speed and degree of natural expression and in aiding memory. With Journal, disparate ideas can be connected, drawings can be sketched, annotations can be freely inserted, information can be located with search, and you can easily connect your ink across other apps to grow your best ideas. Journal provides an ink-first solution that delivers new AI, intuitive gestures, and connected experiences for Microsoft 365 for work and school (subscription required, sold separately) . It’s designed for people who thrive when writing out their ideas, notes, and sketches. The Microsoft Garage is an outlet for experimental projects for you to try. Learn more at https://garage.microsoft.com

https://garage.microsoft.com

Download the Journal tool from the Store

https://garage.microsoft.com

There is a quick introduction play guide.

Features

  • An ink-first experience for those who write with a digital pen
  • A page-based canvas for easy scrolling, optimized for tablet and 2-in-1 devices
  • New intuitive Ink Gestures that don’t require mode switches
  • Drag and drop your content between pages, or to your favorite applications
  • Microsoft 365 Integration to access your Calendar for faster meeting notes (Subscription required, sold separately)
  • Import and markup PDF documents and images
  • Search using keywords or filters

https://garage.microsoft.com

What’s new in this version

Improved ability to open journals from Documents folders stored on networks – Fixed issue with sending email for M365 Work and School users – Improvements to Scratch Out – Improvements for signing in with Microsoft 365 Work or School account – General bug and performance tweaks with ink AI, undo, and opening/closing journals

image

Try it out https://aka.ms/TryJRNL
Learn more https://aka.ms/JRNLblog

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted February 25, 2021 by Robert Smit [MVP] in Windows 10

Tagged with

Windows 10 tips and tricks #windows10 #ITPRO #Assist #keyboard #tricks   Leave a comment

Now days I hardly see Windows 7 or older in the wild anymore. It’s all Windows 10 but in that I see all builds around from 1511 to the latest build. And I must say a lot is changed and it is almost hard to keep up with all the new stuff. If you are part of the Windows insiders you can already test the next version or update. this time it is just a short blog post about some handy windows 10 tricks and tips

The current Windows 10 versions can be found here

image

Me personally I’m a mouse fan or command line I hardly use the Windows key +   guess my left hand is to lazy but once you use the Windows key + X  or R  P L it is super handy.  and yes the most used short cut is probably ctrl+a ,ctrl+c ,ctrl+v

But did you know there is a big list there is a key for almost everything Cool

Take a look at this site for your shortcut

Keyboard shortcuts in Windows

and if you need help you can always ask someone you know did you know there is a quick assist option in Windows 10

 image 

Quick assist is a simple tool to view the screen and help the other and view the issue they have

 

image

So how to start with this in the windows menu type quick or assist you will see the app.

windows quick assist

When opening there are two options give or receive support.

 

windows quick assist

So contact the person that will help you and he need to open quick assist and  open  assist another person

image

The assiter need to login with a microsoft passport.

The number is for the receiver.

windows quick assistwindows quick assist

 

On the helper sider there is a question view or full access ?

windows quick assist When approved the show can start windows quick assist

 

below an overview on helper and receiver.

windows quick assist

Closing the quick assist program will disconnect the session or press stop.

Quick tool no install needed and super handy  and the above steps are just showing the connection but if you have a high secure desktop you might need some extra settings.

 

 

 

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted February 5, 2021 by Robert Smit [MVP] in Windows 10

Tagged with

Step by Step Azure NAT Gateway – Static Outbound Public IP address #ANG #NAT #WVD #Azure #Security #Cloud #MVPBuzz #AzOps #ITPRO #VirtualNetworks #PowerShell   Leave a comment

There a several ways on using an external IP in Azure, What method to use is up to you. Remember there is no good or wrong but only different opinions or insights on how to use it.

Public IP addresses allow Internet resources to communicate inbound to Azure resources. Public IP addresses also enable Azure resources to communicate outbound to Internet and public-facing Azure services with an IP address assigned to the resource. The address is dedicated to the resource, until it is unassigned by you. If a public IP address is not assigned to a resource, the resource can still communicate outbound to the Internet, but Azure dynamically assigns an available IP address that is not dedicated to the resource.

Some of the resources you can associate a public IP address resource with are:

  • Virtual machine network interfaces
  • Internet-facing load balancers
  • VPN gateways
  • Application gateways
  • Azure Firewall
  • NAT Gateway

Matching SKUs must be used for load balancer and public IP resources. You can’t have a mixture of basic SKU resources and standard SKU resources. You can’t attach standalone virtual machines, virtual machines in an availability set resource, or a virtual machine scale set resources to both SKUs simultaneously.

Virtual Network NAT (network address translation) simplifies outbound-only Internet connectivity for virtual networks. When configured on a subnet, all outbound connectivity uses your specified static public IP addresses. Outbound connectivity is possible without load balancer or public IP addresses directly attached to virtual machines. NAT is fully managed and highly resilient.

image

So this is only for the Outbound connection. why not use the Resource group IP this is also “static” ? using this IP means that al VM’s must be in the same resource group and when the resource group changed the IP is also changing.

image

NAT is compatible with standard SKU public IP address resources or public IP prefix resources or a combination of both. You can use a public IP prefix directly or distribute the public IP addresses of the prefix across multiple NAT gateway resources. NAT will groom all traffic to the range of IP addresses of the prefix. Any IP whitelisting of your deployments is now easy.

So How to implement this. a step by step guide. GUI and powershell Looking at my demo setup, There are 2 vm’s both in a different Resource group.

Setting up the NAT gateway is done by 3 tabs to fill in the name and what vnet to use

https://robertsmit.wordpress.com/

We add a new NAT gateway.

image

We create a new resource group and choose NAT gateway name.

The Timeout we leave this on 4 min for now.

image

We configure an external IP and with a standard SKU. Basic is not supported.

image

the next step is choose the External outbound IP pool minimal is 2 and max is 256. this is not needed but only if you want to have a pool of External IP’s else it just go the one external ip

image

you can select max 2 prefixes

image

Configure which subnets of a virtual network should use this NAT gateway. Subnets with Basic load balancers or virtual machines that are using a Basic public IP are not compatible and cannot be used.
Note: While you do not have to complete this step to create a NAT gateway, the NAT gateway will not be functional until you have added at least one subnet. You can also add and reconfigure which subnets are included after creating the NAT gateway.

image

in the last step we tag the NAT gateway to a subnet. When checking the VM’s on this subnet for the outbound IP ( remember the VM does not need a public IP on the network card)

image

Here I have 2 VM’s getting both an IP from the prefix

imageimage

If there is only a small prefix then both machines will get the same external outbound IP

imageimage

With this time flow it recycles the External IP, depending on the scope and usage.

image

So in just a few steps you can use a useful gateway for all your outbound traffic.

Building this in Powershell is also easy. I use a semi automatic script as I want to choose my network. but you can change this to a fixed network if you want.

remember this will need the az.network latest module. in the old modules there is no get-AzNatGateway command. without this the posh is not working.

First we have some parameters

# Set the variables for the NAT Gateway.
$rg = ‘rg-rsm-natgw001’
$Location = ‘Westeurope’
$sku = ‘Standard’
$PublicIpname = ‘pup-rsm-natgw001’
$Publicprefixname = ‘pxp-rsm-natgw001’
$NatGatewayname=’gwn-rsm-natgateway001′

#create Rsource group
New-AzResourceGroup -Name $rg -Location $Location 

image

First we make some external IP and or a range.

#create Standard SKUP public IP
$publicIP = New-AzPublicIpAddress -Name $PublicIpname -ResourceGroupName $rg -AllocationMethod Static -Location $Location -Sku $sku
$publicIP | Select-Object Name, ResourceGroupName, IpAddress, IdleTimeoutInMinutes, ProvisioningState

https://robertsmit.wordpress.com

With the Zone attribute you can create zone redundancy, but this is not needed for this resource.

#create  IP prefix ( how many IP’s are needed)
$publicIPPrefix = New-AzPublicIpPrefix -Name $Publicprefixname -ResourceGroupName $rg -Location $Location -PrefixLength 29

$publicIPPrefix | Select-Object Name, IPPrefix, PrefixLength, ProvisioningState

image

You can skip this if you want only one external IP.

Next is creating the gateway.


#Create NAT gateway
$natGateway = New-AzNatGateway -Name $NatGatewayname -ResourceGroupName $rg -PublicIpAddress $publicIP -PublicIpPrefix $publicIPPrefix -Location $Location -Sku $sku -IdleTimeoutInMinutes 4
$natGateway  | Select-Object Name, ResourceGroupName, IdleTimeoutInMinutes , SKuText | Format-table -autosize –wrap

image

Now that the Gateway is created we can add a subnet to this. I used a point an click so that I can choose the network and subnet. but you can also use a variable to do this.

$virtualNetwork = Get-AzVirtualNetwork | Out-GridView -PassThru -Title "Pick the vnet that will be used for the NAT gateway"

https://robertsmit.wordpress.com

$NATSubnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $virtualNetwork | Out-GridView -PassThru -Title "Pick the Subnet that will be used for the NAT gateway"

image

$NATSubnet.NatGateway = $natGateway
$virtualNetwork | Set-AzVirtualNetwork

The network is chosen and the subnet is selected.

In the Azure portal you can see the result.

https://robertsmit.wordpress.com

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

 

Posted June 2, 2020 by Robert Smit [MVP] in Azure

Tagged with , ,

Installing tenant attach with Microsoft Endpoint Configuration Manager Update 2002 #MEMCM #MEMAC #ConfigMgr   Leave a comment

At MSIgnite 2019 was announced that SCCM is now MEMCM and that Intune and MEMCM can be managed in one portal. With the update 2002 this option is finally there.  Microsoft Endpoint Manager is an integrated solution for managing all of your devices. Microsoft brings together Configuration Manager and Intune into a single console called Microsoft Endpoint Manager admin center.

Where to start with Microsoft Endpoint Configuration Manager for this update.

Installing tenant attach with Microsoft Endpoint Configuration Manager Update 2002

http://endpoint.microsoft.com/

When opening the Microsoft Endpoint Configuration Manager console the update is not there. this is the update is released in Rings and I want to download this update from the fast ring. When starting this make sure your servers are healthy and are patched. If you run a tight virus scanner on the MEMCM then you may need to disable this during the install

Installing tenant attach with Microsoft Endpoint Configuration Manager Update 2002

 

Microsoft Endpoint Configuration Manager

 

As the update is rolled out globally in the coming weeks, it will be automatically downloaded, and you’ll be notified when it’s ready to install from the “Updates and Servicing” node in your Configuration Manager console. If you can’t wait to try these new features, see these instructions on how to use the PowerShell script to ensure that you are in the first wave of customers getting the update. By running this script, you’ll see the update available in your console right away. 

https://download.microsoft.com/download/7/c/4/7c48f2c7-f433-414b-a901-753a61c7956d/EnableEarlyUpdateRing2002.exe

Microsoft Endpoint Configuration Manager

After downloading and extracting the file we have a PowerShell script

image

Running this Powershell script in Admin Mode. With the Server name and I do a verbose to see a bit more output.

C:\EnableEarlyUpdateRing2002> .\EnableEarlyUpdateRing2002.ps1 -siteServer mvpsccm17 -Verbose

Microsoft Endpoint Configuration Manager

C:\EnableEarlyUpdateRing2002> .\EnableEarlyUpdateRing2002.ps1 -siteServer mvpsccm17 –Verbose

Now that the Script has run the Update services will trigger the fast ring to get the update

image

Press check for updates and do a refresh.

Microsoft Endpoint Configuration Manager

The Microsoft Endpoint Configuration Manager update 2002 is now available for download.

Microsoft Endpoint Configuration Manager

imageimage

Now that the Update is downloaded we can trigger the Install.

Microsoft Endpoint Configuration Manager

This Process is a Next Next Close wizard and the only choice you need to make is run the agent in a test collection or strait into production

imageMicrosoft Endpoint Configuration Manager

Here you have the option to test this update in an isolated Collection.

image

In this case I go strait into the production as this is my demo lab server

imageMicrosoft Endpoint Configuration Manager

I Accept and my end date of the SA.

Microsoft Endpoint Configuration Manager Microsoft Endpoint Configuration Manager

Well this was a pretty strait forward process now in the back ground Microsoft Endpoint Configuration Manager is updating the servers.

image

The progress can be followed in the log files when go to status the logs will be opened.

image

when the preparations are done Microsoft Endpoint Configuration Manager will start the installation. This can take some time so be patient. Don’t do a sudden reboot etc.

image

If you had a pending reboot the installation will fail, Reboot the server first then do the update.

image

Or check the Task Manger when the update is finished.

image

When the Update is Finished and opening the Microsoft Endpoint Configuration Manager Admin Console The update of the console is triggered and need to install.

 image

image

image

The update is installed. and we can configure Co-Management

imageimage

The default setting for device upload is All my devices managed by Microsoft Endpoint Configuration Manager. If needed, you can limit upload to a single device collection.

image I choose Allimage

imageimageimageimageimage

Now that the installation is finished we can see the connector.

image

You can verify this in the Azure AD there is an app registration called ConfigMgrSvc

image

 

  1. Open CMGatewaySyncUploadWorker.log from <ConfigMgr install directory>\Logs.
  2. The next sync time is noted by log entries similar to Next run time will be at approximately: 04/02/2020 11:45:05

image

  1. For device uploads, look for log entries similar to Batching N records. N is the number of devices uploaded to the cloud.
  2. The upload occurs every 15 minutes for changes. Once changes are uploaded, it may take an additional 5 to 10 minutes for client changes to appear in Microsoft Endpoint Manager admin center. http://endpoint.microsoft.com/

In a browser, navigate to http://endpoint.microsoft.com/  or https://aka.ms/memac

below You see only MEMAC

image

When the Machines are Hybrid AD joined you can see both devices. the sync take some time.

image

This is the start to manage the devices from MEMAC. In the next blog I’ll show you more on the management.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

  • Twitter

  • RSS Azure and Microsoft Windows Server Blog

  • %d bloggers like this: