You are browsing the archive for 2012R2.

When deploying Windows Server 2012R2 using an Configmgr OSD Task Sequence, additional disks will be offline when the Task Sequence completes

12:25 pm in 2012R2, CM12, CM12 R2, CM12 R2 SP1, CM12 SP1, CM12 SP2, ConfigMgr 2012, configmgr 2012 R2, ConfigMgr 2012 R2 SP1, ConfigMgr 2012 SP1, OSD by Kenny Buntinx [MVP]


When using a Configuration Manager OSD Task Sequence to deploy Windows Server 2012 or Windows Server 2012 R2 to a server (VM) that contains disks that are not local (such as SAN Disk), when the Task Sequence completes, the additional disks may not come online and may show as offline. Specifically in the Disk Management, the additional disks will show offline with the message:

Disk is offline due to a policy set by an administrator

If you look at my VM, you will see I have 2 separate disks that I will need in a later phase to install the backup software to the D:\ partition, residing on the other vmdk.


To resolve the issue, for the WinPE phase, the steps from KB971436 need to be added to the Task Sequence. For deployments from Operating System Images, a registry key value will need to be updated with the correct SAN policy value as shown below:

Just after the step where you apply the image, create a “RunCommand line called :”load system hive” and execute :” reg load HKUtemp "%OSPART%\WindowsSystem32ConfigSystem"”


Just after the step where you apply the “RunCommand line called :”load system hive”, create a “RunCommand line called :”Change Default SAN policy” and execute :”reg add HKUtempControlSet001HKLMSystemCurrentControlSetServicespartmgrParameters /v SanPolicy /t REG_DWORD /d 1 /f”


Just after the step where you apply the “RunCommand line called :”Change Default SAN policy”, create a “RunCommand line called :”Unload system hive” and execute :”reg unload HKUTEMP”


Next phase is to make sure that no drives will remain offline and all drives will still have the right driveletters assigned . Run a command line with : diskpart /s diskpart.txt


The contents of the diskpart.txt can be determined by yourself . Here is an example


Hope it Helps ,

Kenny Buntinx

MVP enterprise Client Management

HCIDKIDT ever since CM12 R2 SP1 : Software update groups additional data available in the console

6:09 pm in 2012R2, CM12 R2, CM12 R2 SP1, CM12 SP2, SCCM 2012 R2, SCCM 2012 R2 SP1, Software updates by Kenny Buntinx [MVP]


Hello Folks ,

I didn’t realize that one of my personal wishes has been granted in CM12R2 sp1. I always wanted a quick overview at my software group on how much updates it contained , how many expired and to how many collection I deployed it too …and now it is reality . Good work PG !

Non R2 SP1 :


With R2 SP1 :



Hope it Helps ,

Kenny Buntinx

How to replace expired certificates on ADFS 3.0 the right way

1:44 pm in 2012R2, ADFS, ADFS 3.0, BYOD, certificates, Cloud, Enterprise Mobility Suite, Global Managed Service Account, IIS, Known Issue, Lab, Power Management, WAP, Web Application Proxy by Kenny Buntinx [MVP]


As with all IT equipment that is using certificates for enhanced security, there will be a time when the certificates expire and it will need to be replaced. Below you will find the procedure for ADFS 3.0 and the Web Application Proxy:

First step is to create a new CSR on one of you’re servers and request a renewal of the existing certificate ( in our case a * . After the request has been processed , download your certificate and import the certificate on the server where you created the CRS earlier. For ADFS / WAP it is very important you will have the private key exported with the certificate. You can only export the certificate with a private key on the sever where you previously created the CSR .Export with private keys to *.pfx and import on WAP + ADFS

If you do not do it as described above with and export of the private keys , you will face issues even if you did it exactly as described below as shown in the screenshot below :



Follow the procedure below , starting with the ADFS server:

  1. Log onto the ADFS server.
  2. Import the new (exported with private key) certificate to the server. Make sure this is added to the personal certificate store for the computer account.
  3. Find your thumbprint for the new certificate. Either use the GUI thru the MMC to see the details of the certificate or us powershell with Run Get-AdfsSslCertificate.. Take a copy of the thumbprint and ensure that the spaces are removed.
  4. Make sure that the service account that is running the ‘Active Directory Federation Services’ service is granted read access to the private key.
  5. Launch AD FS Management, expand ‘Service’ within the left pane and click ‘Certificates’ , then click ‘Set Service Communications Certificate



  1. Restart the ADFS services. However this is not enough. Changes made in  the GUI does not change the configuration based on the HTTP.sys. To complete the configuration change, run the following PowerShell command : Set-AdfsSslCertificate –Thumbprint <Thumbprintofyourcertificate>.
  2. Make sure to restart the server

Now you need to log onto the WAP server.

  1. Import the new (exported with private key) certificate to the server as in step 1. 
  2. Run the PowerShell commando for changing the certificate: Set-WebApplicationProxySslCedrtificate –Thumbprint <Thumbprintofyourcertificate>
  3. All of your publishing rules defined in the WAP need to be updated with the thumbprint of the new certificate. Use Powershell for  updating them with the new thumbprint. Run: Get-WebApplicationProxyApplication –Name “WebAppPublishingRuleName” | Set-WebApplicationProxyApplication –ExternalCertificateThumbprint “<Thumbprintofyourcertificate>”
  4. Restart the Web Application Proxy services to complete the configuration

Now you are done and you are a happy admin once more . Took me some time to figure it out .

Hope it Helps ,

Kenny Buntinx

MVP Enterprise Client Management

CM12 R2 TS after upgrade: Failed to resume task sequence (0x800700EA) error

2:15 pm in 2012R2, bootimages, capture, CM12, CM12 R2, CM12 SP1, ConfigMgr 2012, configmgr 2012 R2, ConfigMgr 2012 SP1, Cumulative Update, Deployment, OSD, SCCM 2012, sccm 2012 R2, SCCM 2012 R2, SCCM 2012 SP1, Task Sequence by Kenny Buntinx [MVP]


I upgraded one of my customers site from SP1 to R2 on a Monday morning and have hit a number of hurdles. I have discovered that my customers OSD Task sequences were not functioning correctly. Everything seems to go fine, until it reaches the Setup Windows and ConfigMgr, and then once that step is complete, it reboots and I’m left on the ctrl+alt+del screen, with the computer joined to domain but no additional steps performed.

The TS does end with an error “Failed to resume task sequence (0x800700EA) error” , as if the new client gets installed and it just ends the TS!

**** Remember **** –> Support for Windows PE 3.1 boot images above of Windows ADK 8.1 is there as feature when upgraded to R2 !! **** Remember ****

I looked at my boot images and it looked good, but frankly the x64 boot image didn’t upgrade well and stayed to version 6.2.x instead of 6.3.x. I had a script to manually update it , but it didn’t like it so it failed again.

Created a new bootimage (x64) from scratch , updated my TaskSequence  to use the new bootimage and *BAM* , it worked again

Hope it Helps ,

Kenny Buntinx

MVP enterprise Client Management  

ConfigMgr 2012 R2 & Windows Intune UDM : How to prevent an “End-User” can un-enroll his “Corporate” Windows Phone 8.1

8:30 pm in 2012R2, 8.1, Compliance Management, configmgr 2012 R2, intune, MDM, OMA-DM, OMA-URI, policy, sccm 2012 R2, UDM, Windows Intune, Windows Intune Extensions, windows inune, Windows Phone 8.1, Windws Intune, WP 8.1 by Kenny Buntinx [MVP]


Scenario :

Last week we had a discussion at a customer during a  Windows Intune UDM Proof of concept and the customer was willing to order about 3000 corporate owned Nokia Lumia 630 Windows Phones. He wanted us to provide the option when a ‘device owner’ in CM12 R2 is set to “corporate” , a user can’t un-enroll a “corporate” device and to prevent them from doing so , unless you are the ConfigMgr 2012 MDM admin.

As this seemed a logic request to me , we couldn’t do it out of the box with windows phone 8 or with Windows Intune. Missed opportunity , I would say. However with the launch of Windows Phone 8.1 at Build conference , there was a new set of OMA-DM management capabilities being added.

At this stage , the writing and the testing of the blog post  is being done with a developer edition of Windows Phone 8.1. I doubt that when being rolled out as RTM , these policies will be changed.

Solution to problem :

First of all , you will need to know what OMA-DM is . OMA-DM is an open standard that Apple – Android and Microsoft are using. All MDM solutions use the OMA-DM API to manage those devices. More information on OMA-DM can be found here .

Microsoft has released together with WP 8.1 , a comprehensive guide called ; ‘Windows Phone 8.1 MDM protocol documentation’ . You will need this guide as a reference to find all custom not-so-out-of-the-box OMA-URI’s. An OMA-URI can be seen as a registry setting or hive. You can download it here .

Panu Saukko , a good friend and fellow Enterprise Client Management MVP , pointed me in the right direction inside the document on how to reach the goal : Blocking a user from un-enrolling their device. Without the golden tip from Panu , we would never succeed as there is an Typo in the document.

Panu pointed out that according to the document, the OMA-URI should be according to page 133 & 143 inside the ‘Windows Phone 8.1 MDM protocol documentation’ :


Again there is a typo in that document , it should be


Now that we have found the error in the OMA-URI , Let’s show some magic with Compliance settings , Configuration Items and Configuration Baselines in CM 12 R2 :

Creating the ‘Configuration Item’ :

1. Go to “Asset & Compliance” , click on “Compliance Settings” , go to “Compliance Items” and create a New Configuration Item as shown below


2. Give the new Compliance item the following Name : ‘Deny WP8.1 MDM UnEnrollment’ and hit “next”


3. Select the checkbox : ‘Configure additional settings that are not in the default settings groups’ and click “next” to continue


4. In the next window that opens , click the ‘Add’ button.


5. Hit the “Create Setting” tab.


6. Now comes the interesting stuff .

    • Give it a Name
    • 1. Settings Type : OMA-URI
    • 2. Data Type : Integer
    • 3. OMA-URI : ./Vendor/MSFT/PolicyManager/My/Experience/AllowManualMDMUnenrollment


7. Highlight your recently created ‘Deny MDM Unenrollment’ and hit the ‘Select’ button


8. Now comes the interesting stuff again

    • 1. Rule Type : Value
    • 2. Data Type : 0 (0 = un-enroll not allowed / 1 =  enroll allowed)
    • 3. Set ‘Remediate noncompliant rules when supported’
    • 4. Set Noncompliance severity for reports to ‘Warning’ 


9. Click next to continue.


10. As this setting is only applicable for Windows Phone , we select only this platform and click ‘next’ to continue.


11. Click next to continue , until the end .


Once created , you will see something like this in the screenshot below . After creating the ‘Configuration Item’ , we are going to create and deploy the ‘Configuration Baseline’


Creating the ‘Configuration Baseline’ :

1. Now go to baselines and create a new ‘Configuration Baseline’


2. Give the ‘Configuration Baseline’ a name and click “Add” to add your ‘’Configuration Item’’


3. Search for your previously created ‘Configuration Item’ and click add.


4. Hit OK , to continue


5. Click ‘OK’ to continue


When created , you will see something similar in your console as show below in the screenshot :


Deployment of the ‘Configuration Baseline’ ONLY to the ‘Corporate Owned’ devices :

As we only wanted to prevent un-enrollment when a ‘device owner’ in CM12 R2 is set to “corporate” , we first need to create a collection that contains only devices set to corporate as shown below . Devices enrolled using the ConfigMgr 2012/Windows Intune UDM solution can be assigned to be either "Company" or "Personal" devices. Note that a device is automatically assigned to be Personal by default.



Now that that is done , create a ‘Device collection’ that is only containing resources that are ‘Company’ devices. To do that , use the following query where ‘System Resource – Device Owner’ is set to ‘1’ for ‘Company’ . Value 2 is “personal”


Now deploy your ‘Compliance baseline – Deny wp8.1 UnEnrollment’ to the collection called ‘All Mobile Devices set as Corporate Owned Devices

The END Result ? :

As the policies come down from Configuration Manager 2012 R2 with Windows Intune on the WP8.1 device and the user tries to un-enroll , following message is shown :



Hope it  Helps ,

Kenny Buntinx

Enterprise Client Management MVP

OSD Capture fails on a HP Gen8 Hyper-V cluster

12:12 pm in 2012R2, capture, CM12, CM12 R2, CM12 SP1, hyper-V, OSD, SCCM 2012, sccm 2012 R2, SCCM 2012 R2, SCCM 2012 SP1 by Kenny Buntinx [MVP]


I’ve seen lots of people saying to use VMs to create images and my customer decided to do it using Hyper-V as they see the Hyper-V scenario as possible replacement for Vmware. We did it on Hyper-V 2012 R2.

However, I am having a problem capturing the image with the Build & Capture Task Sequence. I have the VM (running Windows 7 x64 Enterprise) . The VM ran through Sysprep and rebooted into WinPE, but then the problem starts. I checked the Captures folder to see if it started creating the WIM file,  only written 1KB and then fails with “Exiting with return code 0x80004005”. That’s right, 1 freaky’ KB.

I do have the Legacy Network adapter installed so I can perform PXE boots on the VMs that I have created.

This was the first time I’ve worked with Hyper-V 2012 R2 so I wasn’t sure what to expect as I had experiences with Hyper-V 2008 R2 and 2012 . I’ve looked at all the threads that mention "Hyper-V’ but none have said they are having any problems.

I’ll have tried a few things to see what happens, and to figure out what was wrong here. Finally we found out the issue :

We immediately thought at networking issues and not to a share or permission issue as we could write a file of 1kb.

1.When the VM started in Winpe to start capturing the image , we checked for an IP (F8 command prompt) . We saw the correct IP , but suddenly 5 seconds later , it changed back to an auto assign IP , short term APIPA (Automatic Private IP Addressing) . That was weird and we blamed it to the Networking team Smile . ( for once we thought we had a reason as the DHCP server was a linux box )

2. After ruling out the network ( giving it a fixed ip , MAC reservation ) , we start to search a little deeper . Maybe it was the Hyper-V cluster or the virtual switch ?

3. To rule out any virtual switch issues , we started to create a VM on the Hyper-V Host itself and BINGO ! The creation of the WIM file succeeded .

4. To make sure it was the Hyper-V cluster , we created a VM and tried it again . Same problem, The VM ran through Sysprep and rebooted into WinPE, but then the problem starts. I checked the Captures folder to see if it started creating the WIM file,  only written 1KB and then fails with “Exiting with return code 0x80004005”. That’s right, 1 freaky’ KB.  .

The solution:

Ok , The problem is related to the Hyper-V cluster . After a little investigation , we discovered that people had reported issues with networking drops on HP Generation 8 hardware. I’ve got answer with my connectivity issue.

Our case is the same as described on the blog:

As a workaround , disabling VMQ works . More info what VMQ does :

The issue has been reported to HP support. We are awaiting feedback . In the meanwhile we will try this hotfix It seems that after patching our cluster nodes with the hotfix, we haven’t had a VM guest lose network connectivity for over 24 hours. It was happening quit regularly with several VM’s that are sending/recieving lots of network traffic . If you haven’t applied this hotfix and you are experience this issue and/or others with your virtual switches, do it before opening a case at HP

Hope it Helps ,

Kenny Buntinx

MVP enterprise Client Management .