Requirements

In order to download and install Windows 11 Insider Preview, there are a couple of requirements that need to be met before we can take that route. I’ll list that down here.

• You must be registered with the Windows Insider Program with your Microsoft account or work account in the Azure Active Directory (AAD)
• Running Windows 10 20H2 or Windows 10 21H1 build versions
• An Internet Connection to download from Windows Updates

Registering is free of charge and if you’re unsure how to do it, you can click here to register for the Windows Insider Program.

How To Download and Install Windows 11 Preview

Once you have confirmed registration for the Insider Program, let’s hop on the machine that you want to upgrade. In my case, I’m running Windows 10 20H2 so this example will based off of that.

• In Windows, go to Settings -> Update & Security -> Windows Insider Program
• If you get the error to turn on Diagnostic data, click the Diagnostic data link and enable Optional diagnostic data


 

• If the option is greyed out and you’re unable to select it, set HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\ AllowTelemetry to 3

• Otherwise, click on get started and sign in using a Microsoft account or an Azure AD account like we mentioned in the requirements section
• Once you successfully sign in, you’ll need to choose the DEV channel
• Finally, restart your machine to apply those settings

After the reboot, check back in the Security & Updates section of your machine. If you have pending updates, you might need to install those first but once those are complete (at least in my testing), the Windows 11 Insider Preview will be available to download and install.

Finally, after an hour of waiting the option to upgrade to Windows 11 Insider Preview was now available. 🙂

Some 20 minutes after the install reached 100%, I was finally able to login to my shiny new Windows 11 Operating System.

That’s it! Hopefully you found this article useful to download and install Windows 11, actually in this case we upgraded to Windows 11 but you get the point. Unfortunately there’s not a Windows 11 ISO file for download at the moment but I’m sure that will change some time in the future.

Again, this is the very early stages of this OS, so expect with 100% certainty that you will find some bugs.

The post How To Download and Install Windows 11 Preview appeared first on the Sysadmin Channel.

A break glass account is an account that is used for emergency purposes to gain access to a system or service that is not accessible under normal controls. You, as a systems administrator should not only document all of your break glass accounts but regularly audit those accounts to ensure that the correct people have access.

More importantly, the reason you need a break glass account is to bypass the controls put in place that are there to increase security.
 

What Roles Should Break Glass Accounts Have?

Typically any account that is used for emergency purposes needs to have the rights to be able to gain access to the system and revert any controls or lockouts that are in place. Nine times out of ten, I would recommend that the account have administrator rights to ensure you’re up and running as soon as possible. Furthermore, a break glass account is usually highly privileged and has the least amount of controls in place so it needs to be secured in a vault that very few people have access to.
 

How Many Emergency Accounts Should I Have?

Ideally you would want 1-2 emergency account per platform. Let’s take Microsoft’s Azure Active Directory for example. Although you can have many administrators or Global Admins, Microsoft recommends 2 break glass accounts for the M365 platform. The reason being is that you’ll want a backup to the backup just for good measure.

 
Lets say you deploy Multifactor Authentication and your policy is scoped to all users, you’ll want to have this break glass account excluded from that policy to ensure that you can still login if admins aren’t able to get in.

In this scenario, the Azure AD account would have Global Admin rights, it would be excluded from the MFA policy and finally, it would NOT be an on-premises account. Specifically, this Global Admin account should be an onmicrosoft.com account in the event your on-prem AD has issues.
 

How To Monitor Break Glass Accounts Sign-in And Audit Logs

Every platform is different so it will be nearly impossible to give an answer to anything really specific. However, if we use our example of Azure Active Directory (Azure AD), I can give you a general idea of what this would look like in a real world example. If you’re already using Azure AD that’s great! If you’re not, but you plan to migrate sooner than later we got you covered in our Exchange Migration YouTube Playlist.

As I mentioned, it is recommended that you monitor sign-in and audit log activity from emergency accounts. I would also highly recommend you trigger a notification to your administrators when there has been activity. How do I do this you ask? Here is a quick break down of what that looks like.

• Import or Install AzureAD Module
• The cmdlet Get-AzureADAuditSignInLogs can quickly gather those logs using Powershell
• The cmdlet Send-MailMessage can send an email to send you a notification, also using Powershell
• Setup a scheduled task to check on a regular basis

Get-AzureADAuditSignInLogs Example

Here is a quick example of what Get-AzureADAuditSignInLogs would look like.
 

#Connect to Azure Active Directory
Import-Module AzureAD
Connect-AzureAD -AccountId username@thesysadminchannel.com

#Get Date and then check for sign-ins after said date
$Date = (Get-Date).AddDays(-1).ToString("yyyy-MM-dd")
Get-AzureADAuditSignInLogs -Filter "UserPrincipalName  eq 'breakglass@thesysadminchannel.onmicrosoft.com' AND CreatedDateTime gt $Date" 

 
This short script block above will show the same information you’re used to seeing in the GUI.

Conclusion

At the end of the day you’ll need to ensure you have a backdoor to get into your platform and a break glass account is a perfect use case for it. I hope this article was informative for you and if there’s one take away from this article, that is… Subscribe to my Youtube Channel. Because why not. 🙂

The post Break Glass Account: What Is It And Why Do You Need It appeared first on the Sysadmin Channel.

You might have noticed your SCCM Software Update Point Syncronization Status has been failing over the course of the last couple of days. When I look at the SCCM console under Monitoring -> Software Update Point Syncronization Status I see that there is a Last Synchronization Error Code status Error 0X80131500.

When I look at the WSyncMgr.log I see that there are a whole lot of errors piling up. The errors are shown below.

Sync failed: UssInternalError: SoapException: Fault occurred~~at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall). Source: Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WsusSyncAction.WSyncAction.SyncWSUS

STATMSG: ID=6703 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_SYNC_MANAGER" SYS=PAC-SCCM01.AD.THESYSADMINCHANNEL.COM SITE=PAC PID=2388 TID=6712 GMTDATE=Thu Dec 06 06:02:27.002 2018 ISTR0="Microsoft.SystemsManagementServer.SoftwareUpdatesManagement.WsusSyncAction.WSyncAction.SyncWSUS" ISTR1="UssInternalError: SoapException: Fault occurred~~at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0

Sync failed. Will retry in 60 minutes

When I check the logs of within the WSUS console, I am getting the error:

SoapException: Fault occurred
at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetUpdateData(Cookie cookie, UpdateIdentity[] updateIds)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.WebserviceGetUpdateData(UpdateIdentity[] updateIds, List`1 allMetadata, List`1 allFileUrls, List`1& updatesWithSecureFileData, Boolean isForConfig)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.GetUpdateDataInChunksAndImport(List`1 neededUpdates, List`1 allMetadata, List`1 allFileUrls, Boolean isConfigData)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.GetAndSaveUpdateMetadata(List`1 updates)
   at Microsoft.UpdateServices.ServerSync.CatalogSyncAgentCore.ExecuteSyncProtocol(Boolean allowRe

Conclusion

There are a few threads on Reddit and on Microsoft Technet saying that this is an issue on Microsoft’s end. Other people with Premier Support have also confirmed that it’s a bug on their end. No ETA yet on a resolution.

The post SCCM: WSUS/SUP Failing to Sync with Windows Updates appeared first on the Sysadmin Channel.

With the recent release of Office 2019, people around the globe are looking to upgrade to the latest version to get a feel for the latest suite. If you’re looking to see what’s new, be sure to check out our What’s new with Microsoft Office 2019. Otherwise we can continue with the Step by Step Guide to Deploy Microsoft Office 2019. In order to continue, you will need to download the Office Deployment Kit directly from Microsoft. Once you have that, let’s move on.
Note: I have gotten errors when trying to use the above setup with a Volume license key. If you’re getting errors saying the channel is not correct, use the Setup_VolumeLicense.7z I downloaded from Volume License Service Center. For your safety and reassurance, I’ve included the SHA256 hash so you can make sure you’re not getting an untainted file.

#Setup_VolumeLicense.7z SHA256 Hash

Get-FileHash C:\Setup_VolumeLicense.7z | fl

Algorithm : SHA256
Hash      : 9964C03B4D146D7E03BC2B67EA1405F07A3A2EDF526BAFED911417511056B69F
Path      : C:\Setup_VolumeLicense.7z

Office 2019 Config.XML Sample

After you’ve extracted the setup and config files you’ll want to copy the following lines into a new config (or replace one of the pre-existing ones). These options illustrate a 64bit version of Office along with the source files being downloaded and deployed from a file server. This config file will also remove all previous MSI versions from your system, and it is strongly recommended that all previous versions should be removed to avoid any inconsistencies.

<Configuration>
	<Add SourcePath="\\PAC-FS01\Apps\Office2019\Source" OfficeClientEdition="64" Channel="PerpetualVL2019">
		<Product ID="ProPlus2019Volume" PIDKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX" >
			<Language ID="en-us" />
		</Product>
		<Product ID="ProofingTools">
			<Language ID="en-us" />
		</Product>
	</Add>

	<RemoveMSI All="True" />
	<Display Level="None" AcceptEULA="TRUE" />
	<Property Name="AUTOACTIVATE" Value="1" />
</Configuration>

Download Office 2019 Source Files

In order to deploy the latest office suite, you will need to download the source files to a central location (source location is added in the config-64.xml sample above.) In order to download the source files, open an administrative command prompt and type in the following:

Z:\Office2019\Deploy>setup.exe /download config-x64.xml

The .xml file is the one with the code above. In my setup I have also mapped a drive to the Office2019 location on my PAC-FS01 file server.

Deploy Microsoft Office 2019 using SCCM and PSADT Video Demo

Once you have the source files downloaded the next step is to deploy the software. If you’re doing a one off deployment, the command used to deploy it is going to be:

Z:\Office2019\Deploy>setup.exe /configure config-x64.xml.

However, the point of this article is to show you how to mass deploy it to users across your organization. The below video will go over the SCCM portion of the install.

So that’s how you would Deploy Microsoft Office 2019 using SCCM and Powershell App Deployment Toolkit. If you liked the video, be sure check out our YouTube Channel for more awesome sysadmin related content. And if you’re looking to further your Powershell or SCCM knowledge, be sure to check out Learn Powershell In a Month Of Lunches Book for Powershell and Learn SCCM in a Month of Lunches Book for System Center Configuration Manager.

Source File Downloads

As mentioned in the video, here is the complete zip for all the source files. (3GB install source files are not included and will need to be downloaded from Microsoft)

theSysadminChannel-Office2019.7z

The post Deploy Microsoft Office 2019 using SCCM | Step by Step Guide appeared first on the Sysadmin Channel.

How To Install Windows 10 Version 1803

• Download the MediaCreationTool1803 if you want to create an ISO of the build. – Alternatively, you can use the Windows 10 Upgrade Assistant which we will be using here.
• Run the Windows Upgrade.exe you just downloaded and click Upgrade now.

• Click Next to confirm the Windows 10 Upgrade Compatibility test.

• Now the PC is off to the races and installing Windows 10 version 1803 – April 2018 Update. This is going to take roughly 45 minutes to an hour depending on the speed of your computer. The computer will also reboot multiple times in the process so you can step away and drink a cup of coffee if needed.

• You will be presented with the final screen letting you know that you have successfully upgraded to Windows 10 version 1803.

• One final look in the Settings -> About, you should see that you are in fact on Windows 10 Version 1803 – April 2018 Update.

Video of How To Install Windows 10 version 1803

Great Deals on Lab Equipment

The post How To Install Windows 10 Version 1803 – April 2018 Update appeared first on the Sysadmin Channel.