Blog

Meet the Belgians at MMS DE !

MMS in general, if it’s now MMSMOA or MMSDE, one of the best conferences around for me to attend or speak!
The reason to be there is that their is no better community focused conference available where you could have a direct interaction during the sessions with MVP’s and Product team members. If you know uservoice, well then you have a lot of walking uservoice options as interaction with Product team people like David James (Director of Product Engineering) and that is just priceless!
We Belgians are greatly represented at MMS Desert edition :
  • Opening with MMS 2018 Desert Edition Welcome Reception – That will be hilarious
  • Monitoring Configmgr
  • Patch management with log analytics! Best of both worlds?  
  • Enterprise Mobility Suite Part 1 & 2
But if you really want to go deepdive on technical Configmgr, Modern Management or simply Belgian Beer questions, come to the Belgian Style Cabana sessions hosted on Tuesday , december 4th ! 
Furthermore there are 2 other belgian speakers ,Tom Degreef and Kim Oppalfens , both Enterprise Mobility MVP’s at MMS DE .
See the lineup of other gresat speakers here: https://de.mmsmoa.com/directory/speakers
Are you still doubting to come to the MMS Desert edition next week in December 2-4 with two full conference days? Don’t , if you want to learn a lot, meet up with the Belgian’s and do cabana sessions Belgian style! Register Now at https://mmsmoa.com/desertedition
Hope to meet you there!
Kenny Buntinx
MVP Enterprise Mobility

Hybrid Mobile Device Management (MDM) and why you should plan for migration now !

Hi ,

Microsoft recently  posted a service change announcement in the Office Message Center to customers using Hybrid Mobile Device Management (MDM). Maybe you are one of those type of customers that need to take action as you are using SCCM + Intune in hybrid mode and this impacts you .

MC146431 – Plan for Change: Move to Intune on Azure for your Mobile Device Management

Since launching on Azure over a year ago, Intune has added hundreds of new customer-requested and market-leading service capabilities, and now offers far more capabilities than those offered through hybrid Mobile Device Management (MDM). Intune on Azure provides a more integrated, streamlined administrative experience for your enterprise mobility needs.

As a result, we see that most Enterprise Mobility + Security (EMS) customers choose Intune on Azure over hybrid MDM. The number of customers using hybrid MDM continues to decrease as more customers move to the cloud. Therefore, on September 1, 2019, we will retire the hybrid MDM service offering.

Note: This change does not affect on-premises System Center Configuration Manager (ConfigMgr) or co-management for Windows 10 devices.

Please plan your migration to Intune on Azure for your MDM needs. OB-V-US has tools and other resources to help you with this migration.

Best Regards ,

Kenny Buntinx

Enterprise Mobility : In the land of NDES – Where one eye is King and you need to watch your CRL Delta files

I was doing a EMS POC and deployment of certificates on mobile devices was a requirement. So I needed to setup an NDES server with a separate Subordinate CA for MDM , NDES Server and SCCM Certificate Registration Point (CRP). Big deal I thought as I did it a already multiple times. At my customer we worked close with the server team and setup the infrastructure which was working fine at first sight.

After a reboot of the NDES server I was struggling to get the Network Device Enrollment Service (NDES) up and running again as it would throw me an error 500.

Image result for error 500 ndes

The event log of the NDES Server told me the following:

The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.
The Network Device Enrollment Service cannot be started (0x80070057). The parameter is incorrect.

When the service starts, it searches for two certificates that are used by the service :

1. The service searches in the machine MY store AND

2. The certificate must have the following extensions AND

For the Key Exchange certificate:

– ExtendedKeyUsage: “Certificate Request Agent”

– KeyUsage: Encryption (0x20)

For the enrollment agent certificate:

– ExtendedKeyUsage: “Certificate Request Agent”

– KeyUsage: Signature (0x80) 

3. The certificate must not be archived AND

4. The computer must have the private key for the certificate AND

5. The certificate must be issued by the same CA that the service is configured for AND

6. The certificate must have a valid chain AND

7. If there is more than one certificate for either of the certificates that meets the previous criteria, the service will select the most recent one (the latest that was issued)

Troubleshooting certificate issues will require you to enable the CryptoAPI 2.0 Event Logging :

The CryptoAPI 2.0 Diagnostics is a feature available from Windows Server 2008 that supports the trouble shooting of issues concerned with:

– Certificate Chain Validation

– Certificate Store Operations

– Signature Verification

Enable CAPI2 logging by opening the Event Viewer and navigating to the Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2 directory and expand it.  You should see a view named Operational.Next, right-click on the Operational view and click the Enable Log menu item.

Searching the right information under the capi2 operational log :

image

I was quite sure, that I was able to download the CRL (Certificate Revocation List) and I double checked that by browsing to the URL ‘.crl”>http://pki.xxx.be/CertEnroll/<NameOfYourSubCA>.crl’ and I was able to download the file. When digging deeper in the eventID’s , I found at EventID 42 , the following URL ‘.crl”>http://pki.xxx.be/CertEnroll/<NameOfYourSubCA+>.crl’ was shown. This means it was looking for the  availability of the Delta CRL, which was visible on the web site of my CRL:

image

When I finally tried to download this CRL Delta file, it failed. I remembered myself, that IIS is treating the + sign very differently in URL’s.

I needed to set the setting “Allow double escaping” in the web.config file as shown below :

clip_image002

After enabling this, NDES was able to retrieve the Delta CRL file and start the service gracefully.

So if your NDES Server is throwing “The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.”, do not only check your certificates on the Server, check also your CRLs and Delta CRLs!

Hope it Helps,

Kenny Buntinx

MVP Enterprise Mobility

images7T7SFLEG

Enough talk, let’s build
Something together.