A unique problem

At my CPLS, Auldhouse Computer Training, we have a huge blend of applications courses, and technical courses. With everything from Microsoft, Cisco, Citrix, VMWare, CompTIA, Pink Elephant, Linux and Unix, through to Office, Adobe Creative suite, the list goes on and on and on...

One problem that is faced by our Apps trainers, is teaching Outlook today, then tomorrow having to clean up the Outlook inboxes and rules etc. before the next course. This is a bit of a pain in the butt, and of course, it's not a useful use of time.  Honestly, some of the things that people from the work place send to each other, just because they are on a training course.... SHEESH!
 
Today, I whipped up a script that will take care of that, and I was really quite surprised at how simple it was.

The problem. Destroy and recreate all the mailboxes without destroying the AD User accounts, as they're used for many other NTFS permissions all over the show. If it wasn't for that, I'd just as happily delete the AD accounts, and import-csv to fix it. Easy. But alas, I need those SIDs to remain.

As a solution, I came up with the below.  Now, as with all problems, there are more than likely a million other ways, but this is fit for purpose and does the trick.

Essentially there are four steps:

1. Select all the users matching a criteria and disable their mailboxes
2. Clean the database to make sure the disabled boxes are now in the Disconnected Mailboxes container in Exchange
3. Wipe out all the disconnected mailboxes
4. Re-create the mailboxes, essentially doing the opposite of step 1

It looks a little like this:

get-user | where-object {$_.name -like "wlg*" } | disable-mailbox

clean-mailboxdatabase "Wellington Mailbox Database"

$(Get-MailboxStatistics -Database "Wellington Mailbox Database")|where{$_.disconnectreason -eq "disabled"} | foreach {remove-storemailbox -database $_.database -Identity $_.mailboxguid -mailboxstate disabled -Confirm:$false}

get-user | where-object {$_.name -like "wlg*"} | Enable-Mailbox

I am pretty tickled with this, as I am not an Exchange hound. I should add that this is all done on an older Exchange 2010 box. Why Exchange 2010? Just the way it is.....one day I'll get around to updating that. Then I could setup a nice wee template to stop the naughty words anyway!

Cheers,

Malc.

InTune and management of different phones

Hey there all,

So the past wee while has seen me tooling around with some cool things. I have been exploring my musings with InTune a whole lot more, and now I am the proud owner of a couple of different phones. One is an older Apple iPhone 4s, the other is a Samsung Galaxy 4.  iOS and Android! Me! A bona fide Windows Fan Boi.

What can I report?

Adding both the new guys to my InTune management was a piece of cake. Simply adding my domain's email account to the phones was a piece of cake.

After doing that, I started to mess around with the remote wipes, each was done and each of the phones was totally factory reset with little or no surprise.

Once I had that all nice and stabilised, it was time to get into the process of applying apps to each of the devices. This has perhaps been the bigger learning curve for now, and I am still having a play. I'll write more when I have this properly nailed down, but I have learnt that while all free apps in Google Play are free apps, it would appear to not be the same with the Apple Store. In fact, so far (admittedly without much deep investigation) the only app I have deployed was Age of Empire, a game!  AND in order to get the iOS device managed properly, I had to create and import some certificates into InTune to progress. Apparently, I also have to learn about wrapping some apps in App policies (.xml) in order to have them apply.

As for the 'droid, I now have all the necessary tools that I have for my world. Strava, FitBit, and Training Peaks are all loaded against my phone. Plus a few worky things too.

This little post is just a teaser for now, but I am thoroughly enjoying all that InTune can offer.  At this point though, I would add that my current feel is that anyone looking to refresh their phone fleet, with a mind to managing the devices through InTune MDM, I would lean towards Windows Phone and Android.

Cheers,

Malc.

A re-boot of the blog

Been a while since I posted things, and I know that now it is time to really kick myself into gear.

This was an interesting week in the classroom..... the first 3 days were SQL 2014 query writing, and the last two days of the week was a Crystal Reports course. These two topics are so very close to each other, and yet with enough differences that you can really make a mess of things if you don't have your wits about you!

So anyway, what's been happening.  A whole lot, and I'll be turning this into a very regular posting from now on.
Here is the highlights package:

• Continuing running of the Wellington Windows Infrastructure and Azure Users Group
• Aquisition of a iPhone and Android for the furthering of my InTune learning
• Delivery of InTune user session to Singapore User Group
• Taking of, and learning SCCM
• Discovering new and exciting things in Azure and InTune
• Delivery of InTune session to CodeCamp Wellington

I'll fill in more details later, but in the next couple of weeks expect some writeups on the above, and new things to keep you interested.

Cheers,
Malc.

Ignite NZ 2015

Well, here we are. A new year, a new name, and a bunch of sessions for me to deliver!

It probably goes without saying that there has been a wee bit of pressure this time around preparing the sessions that I am delivering. It came to a total of 5 sessions which when I said yup, I guess I hadn't really thought about all the time involved to do a professional job. It's not just me I am representing. It's Auldhouse and Microsoft. 3 are exam crams, and present an interesting challenge in their own right, and 2 are the traditional "Break-Out" sessions.

Within the next couple of weeks I will publish the build guides for the demos that I used this week in both my solo AD-RMS session, conveniently linked here (so that you can access the PowerPoints) and also the joint session with the amazing Daniel Bowbyes (co-runner of the WWIAUG meet-up in Wellington).

In getting ready for each session, we presenters always go through the hoops and loops. Did I do enough? Did I do too much? Will that meet the session level? WHY IS THE CLOCK GOING SO FAST/SLOW! (depending on your state of mind, of course!) I think my weakness is wanting to know too much, and deliver it all as fast as I can.

Anyway, as a loose outline for now, here is how I built each of the Labs.

AD-RMS and Azure RMS

AD-RMS
In order for this to work, and for things to move smoothly, I went through the following steps (loosely)
Built 4 virtual machines. Two were Server 2012R2, two were Windows 10. The servers were configured as a DC and a member. I created a number of OUs, users, and security groups, as well as user accounts for the ADRMS service.  Oh, and let's not forget the SuperUsers group.
On the DC I also created a preference to map drives to all users for the a file share to place IRM protected content.
After that, I joined all the computers to the domain. I made sure that for Client 1 I had logged in two users from the Design group, and on the other client, two users who were not in Design.
I then pre-staged the ADRMS install on the member server, created the shares for the users and the certificates.
At that point, I then create a checkpoint for each VM and spent a good week going back and forth, rolling forward and back through the demos that I have written for Ignite, making sure that I knew where all the sticking points may or may not be.
Azure-RMS
For the Azure RMS, I have had to sort out that "Here's one I prepared earlier" solution. There is a good reason for this. Activating Azure RMS, and getting it to a state where it can be demonstrated would take far longer than the 15mins that I have for that part of the session. SO... before I demoed this, I have already activated RMS in my Office 365 subscription, and imported and run the necessary PowerShell scripts to make RMS work for my region (AP).
From there, I simply made a couple of emails out to myself at work, and sent them. One was Do Not Forward, one was Confidential - internal only.   Then it's onto my work email account to see the results (and I have a couple of those emails saved in my inbox, just in case)


Windows 10 + Azure AD + Intune

This was a doozy to prepare for, and while I think the steps will seem pretty minimal, believe you me, there was a lot of work in learning the technology before even starting this. AND there is a lot to learn, and like my baby, Office 365, this is an entirely greenfield developmental area and when the session was suggested, some of the technology hadn't yet been fully released.

So here's how it went.
I bought a domain. www.malcyjmct.nz
I then added that to my Office 365 subscription.
After that, I then imported the malcyjmct.nz domain as a custom domain to Azure AD
From there, I setup a trial of Azure AD Premium to get the ability to add InTune
After that, it was a matter of twisting a few nuts and bolts to finesse it all to work together. Once that was done, it was onto the setup with the laptop, kindly loaned to Daniel and I by HP. And it is an amazing piece of kit! I installed Windows 10 Pro, and then rolled in ALL the updates. Without that effort, that initial AAD join HAS taken over an hour to progress to "Welcome to Windows, we hope you enjoy your stay." That was perhaps one of the biggest lessons learnt.
A few (ready MANY) joins, disjoins, joins, disjoins, demos, fails, demos, fails, foibles and quirks later, a smooth process has been ironed out. Essentially, a complete reset of the PC (and I have learnt that Sysprep isn't the tool for the job) and deletion of the computer account from Azure, and we're away.
SSO comes as a part of the build and start, so that is a HUGE relief, and at that stage, the certificates and user accounts all show in the right place.
I have learnt to expect a latency of between 20 and 40 minutes for this demo, meaning that I have built a SECOND laptop, that will stay constantly joined to the Azure AD. I have also installed a couple of additional pieces of software there, including the Azure Remote agent, meaning that I can demo a remote restart, and a remote device scan etc.
OK, once that was all sorted, I then created three distinctly different types of InTune policy, in order to high level demonstrate the capabilities of Azure. They are as follows:
A standard config policy to tweak Internet Explorer
A WiFi policy, which needed to importing of an XML file generated by netsh
An OMA-URI (Open Mobile Alliance Uniform Resource Identifier) policy to lock down AutoPlay
From there on in, it was a matter of demonstrating, from starting the "out of the box" laptop, through to joining it to Azure AD, accepting the incoming phone call, and then creating the pin for our new laptop.  Incidentally, that whole piece takes about 5-10 minutes, but is pretty bloody smooth to be fair.

Anyway, that is a brain dump for now. It's about 10:30pm the Monday night before Ignite launches, and I am ready for sleep now.

I will post something a little bit more detailed in the next week or so for those that need a bit more detail.

Thanks for reading, and please look forward to more posts in the very near future!

Cheers,

Malc.

An intro to the blog.

 












Howdy all,



So I am Malcolm, usually called Malc (or other less savoury things), I am a Microsoft Certified Trainer, employed for the past 9 or so years by Auldhouse Computer Training Ltd.

I have a number of certs under my belt, and will update those as I go. My qualifications and interests in IT are quite varied, but always rock on back to a bit of a data bent.

With regards to the training I deliver, I believe the best results come from having a bit of fun while you train, and never be afraid to try something for the first time in front of a class.  It goes to show that things can work (or can go horribly wrong) in a "sterile" training lab environment, just as well as they can in the real world.

The idea behind this blog is to share some ideas and thoughts on what I do, be somewhat reflective on the previous week, or weeks courses that I have delivered, and hopefully give people a good laugh along the way.

Where I pick things up from other blogs and sites I'll link those too.  Knowledge shared means lightened workloads to me, and allows for greater progress in all things.

A few highlights, good for a chuckle, from the past few months.

• Sept 2013 - TechEd Exam Cram sessions delivered.  70-410, 70-411, 70-412
• Nov 2013 - Office 365 course, during which I demonstrated the Exchange Online feature of remote wiping data on a phone. I used my phone, and not knowing what to expect I assumed that I would simply remove the Office 365 connection to my phone. Next thing you know, my entire phone factory reset! Lesson learned, and a good laugh for the course.
• Dec 2013 - Microsoft Office 365 Road Show with Paul Bowkett of Microsoft. It was a hoot, and such a great guy to co-present with! We had a blast, and if you attended any of our sessions in Wellington, Auckland or Christchurch, THANKS! Paul's blog is here.
• Jan 2014 - Reset all Auldhouse Wellington classrooms, re cabled etc. Mint
• Jan 2014 - Decided to do a live Fail Over Cluster hot shut down with our classroom servers to demonstrate to a class just how effective it is.  Did a 5sec power button shutdown on cluster node 1, then brought it up again.  It took a second reboot, but life was peachy.  The class thought I was nuts to do it in our live environment, but the truth is, if you can't test DR while servers are under load (which wasn't too bad since only 3 courses that first week) then when can you? Ha!  

This week started with a Crystal Reports 2 day course, and Microsoft Course 6293 for the last three days. 

Well, that's all for now.  As the year winds on, and new things are found out and discovered, I'll be here writing my take on it.

Cheers,
Malc.