Windows 10: Windows 10 - Hybrid Joined Machines - Intune Bitlocker

Sean Todd Sean.Todd · Apr 2, 2020

Goal: To deploy Bitlocker via Intune to both Hybrid Joined / AzureAD joined windows 10 devices.

Issue - Currently seeing errors for machines relating to password rotation in the configuration of most workstations.

Error:

-2016281112 Remediation failed

ERROR CODE
0x87d1fde8

ERROR DETAILS

Remediation failed

The encryption appears to be taking place, but the password rotation is failing. Any suggestions would be appreciated. I've googled for several days at this point.

:)

Brink · Apr 2, 2020

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@user) View on Twiiter

Brink · Apr 2, 2020

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

Peer_Sam · Apr 2, 2020

problem with bitlocker

Hi Roeslie,

Thank you for writing to Microsoft Community Forums.

We need some more details to help you find the solution to your problem.

Which edition of Windows 10 is installed on your surface machine?

Did you notice any changes on the computer recently?

When you say, you have a problem with your Surface machine about BitLocker key, do you mean that the surface machine asks you to enter the BitLocker key to allow you to sign into Windows?

Does the other computer ask you to enter the BitLocker key to allow you to access the files saved on it?

If you are being asked to enter a BitLocker key to sign into your surface machine and you don’t remember your BitLocker key, you can follow the instructions given in the link below to find the BitLocker recovery key.

Find my BitLocker recovery key

Please get back to us with the information requested above, so that we can suggest the appropriate troubleshooting steps.

Peer Samie

Microsoft Community-Moderator

Windows 10: Windows 10 - Hybrid Joined Machines - Intune Bitlocker

Windows 10 - Hybrid Joined Machines - Intune Bitlocker

Windows 10 - Hybrid Joined Machines - Intune Bitlocker

Windows 10 - Hybrid Joined Machines - Intune Bitlocker

Windows 10 - Hybrid Joined Machines - Intune Bitlocker - Similar Threads - Hybrid Joined Machines

Cloud Kerberos trust for hybrid domain join machines &WHFB

Cloud Kerberos trust for hybrid domain join machines &WHFB

Intune Bitlocker Key Unable to saved on Intune

Intune hybrid-device enrollment failure event 76

Intune hybrid-device enrollment failure event 76

Intune hybrid-device enrollment failure event 76

Intune Hybrid Join, MDM „None"by AD Devices but by AAD Devies „Intune"

Intune Hybrid Join, MDM „None"by AD Devices but by AAD Devies „Intune"

Intune Hybrid Join, MDM „None"by AD Devices but by AAD Devies „Intune"