Configure the App-V client through a MDM Deployed GPO

Standard

In this blogpost, I want to describe how the new MDM Group Policy functionality can be used to configure your Windows 10 workstation. With the Windows 10 Creators Update we’ve the possibility to deploy and apply Group Policy objects through the MDM channel. This means that the policy configuration support in Windows 10 will be expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the Policy configuration service provider (CSP). In this blogpost, I want to use this new functionality to activate and configure the App-V client on a Windows 10 MDM Managed workstation.

Continue reading

Prevent a Azure AD MFA User Lockout

Standard

Within Azure Multi-Factor authentication, a user can configure multiple options for the 2nd factor authentication. Beside those options the user can also configure multiple numbers within Azure Multi-Factor authentication which can be used when doing the 2nd factor authentication. But in practice most users will only configure one phone number. When the user than loses his phone or access to his number the user cannot use Azure MFA anymore. The user cannot change his phone number because a 2nd factor authentication is needed to access this information. So, this means that the user is locked out of Azure MFA and the only solution in this scenario is to call the Helpdesk and change the phone number. But there is a solution which prevents a user MFA lockout. This can be achieved by simply configuring a phone number in the user his account in your Active Directory or Azure Active Directory.
Continue reading

Using Azure MFA cloud based protection with the RD Gateway

Standard

Last week Microsoft released Azure MFA cloud based protection from your on premise servers/devices. In this blogpost Microsoft announced this functionality and showed how this can be used with a VPN device. Before yesterday you had to install the Azure MFA server to provide MFA to RDS sessions through the RD Gateway. Since the MFA Server and the cloud based MFA were different systems with different settings for users this was not the most ideal situation. But with this new functionality we can use the cloud based MFA for the RD Gateway role. If you’re looking for a detailed description about how to setup the RD Gateway with the on premise MFA servers please check this blogpost.
Continue reading

New Job Challenge

Standard

Today is the day that I’m joining KPN Consulting as a Technical Consultant focusing on Remote Desktop Services and the Enterprise Mobility + Security Suite. In the past years I’ve done great projects for Inovativ but today I’m really excited about joining KPN Consulting and want to help customers of KPN Consulting with questions/challenges around the ‘Workplace of tomorrow’ of course within my focus area RDS and EM+S.

At KPN Consulting I will continue to share knowledge through my blog and when speaking on events. So stay tuned for more blogposts around Remote Desktop Services and the Enterprise Mobility + Security Suite. One last note which I want to make is the information which you will find on this blog is my personal opinion and not the opinion of my employer.

Creating a Storage Spaces Direct Performance Dashboard

Standard

In this blogpost I want to show you how you can easily create a PowerBI dashboard based on Storage Spaces Direct performance metrics. PowerBI is great in visualizing data and reports are easy to create. Before you can execute the steps in this blogpost you will need to create a PowerBI account on https://www.powerbi.com. I’ve tested the blogpost below with PowerBI Pro account but based on this page it should also work with a PowerBI free account. Looking to Storage Spaces Direct this blogpost is based on Windows Server 2016. I’ve not tested this on earlier versions and I expect that this is only working on 2016 and later. I’ve created this blogpost to monitor my S2D environment hosting the Remote Desktop Service User Profile Disks, so expect that this dashboard is focusing on delivering an overview for that purpose.
Continue reading

2017 MVP Award!!

Standard

On the 1st of January I received an awesome email. Microsoft presented me my second MVP award in the category: Enterprise Mobility. This is really a great start of 2017! I’m really proud and honored that my contributions are rewarded with a MVP Award. I will continue sharing my knowledge by presenting on events and blogging on this blog. The focus will remain the same: Remote Desktop Services and the Microsoft Workplace Solution (Enterprise Mobility + Security Suite and Windows 10).

Thanks again to Microsoft and you as a reader of my blog!

My Blog: 2016 in Review

Standard

This year started great with receiving my first MVP Award. I really like sharing my knowledge with the community! This year was also the year that Azure RemoteApp were retired by Microsoft, based on that decision the focus has become Remote Desktop Services and the Enterprise Mobility Suite. I want to share some statistics of this year with you. This blogpost will also be the last blogpost of this year!

Continue reading

AzureAD Conditional Access and RDS Session Hosts

Standard

The last couple of weeks I was thinking about could a RDS environment be used together with Device Based Conditional Access (CA) provided by AzureAD and Microsoft Intune. With AzureAD CA you can configure this based on the user, the device of the user, the application and the risk of the request. This blogpost only covers Device Based Conditional Access. When Conditional Access for Devices is configured the devices either need to be domain joined (AD and AzureAD) or compliant to the configured compliance policies. These policies need to be configured within Microsoft Intune or System Center Configuration Manager. This blogpost will focus specific on the use of RDS 2016 Session Hosts together with Conditional Access.
Continue reading

Sizing the RDS 2016 Connection Broker DB to Azure SQL Database

Standard

With Remote Desktop Services 2016 we can use Azure SQL Database for hosting your RD Connection Broker Database (RDCB). Back in the RDS 2012 days we had to either build a SQL Mirroring or SQL Always On solution to provide High Availability to the RD Connection Broker database. Both SQL HA solutions were expensive especially on Azure. As a best-practice SQL needed to have premium storage for hosting the data and log files. Now with RDS 2016 we can use Azure SQL database for the RD Connection Broker database, but how about sizing the Azure SQL database service. In Azure SQL database you cannot simply chose the number of CPU cores and Memory which you want to use. On the Azure SQL database platform the performance is measured by Database Transaction Units (DTU’s). In this blogpost I want to explian how you can collect some performance metrics from your existing SQL Server and size your Azure SQL database.
Continue reading

Deploy your HA RDS environment through an Azure ARM template

Standard

Last week I finally published my first Azure ARM template for deploying a RDS environment. This template was based on a Azure AD Domain Services environment and depends on the Azure AD Application Proxy for publishing the RD Web and RD Gateway role. The good news for this deployment was that no DMZ was necessary. The bad news was that the UPD channel of the RD gateway cannot be used. Today I will publish a template which is based on a existing Azure Active Directory (not specially Azure AD Domain Services) and on publishing the RD Web and RD Gateway roles in the DMZ for publishing the environment. This template is basically re-using 75% of the template and scripts of the Cloud Only Deployment.

Continue reading