Microsoft Desktop Optimization Pack GPO Administrative Templates (#MDOP)

These MDOP Group Policy Templates delivers .admx and .adml templates to manage policy across the enterprise for the following MDOP technologies:

  • App-V 5.0
  • App-V 5.0 SP1
  • App-V 5.0 SP2
  • App-V 5.0 SP3
  • MBAM 1.0
  • MBAM 1.0 R1
  • MBAM 2.0
  • MBAM 2.0 SP1
  • MBAM 2.5
  • UE-V 1.0
  • UE-V 1.0 SP1
  • UE-V 2.0
  • UE-V 2.1

Instructions to deploy MDOP administrative templates at

More information at

Follow me on Twitter  @jparekh_tech and

Setup Windows Hello with Intel RealSense 3D Camera F200

Quick video to show you how easy it is to setup Windows Hello with the right supported camera.  For this, I am using the Intel RealSense 3D Camera available direct from Intel.  PC manufacturers like Dell have already announced their laptops will have this technology built in specific for the Windows Hello as shown here.

For more information on Windows Hello, please visit:

To read more or order the camera from Intel, go to:

Windows 10 Enterprise with Software Assurance

As I mentioned in a previous post, with the Windows 10 launch, MDOP is now included as an SA benefit, and is no longer a separate add-on.  This post explains Windows 10 Enterprise features with Software Assurance

Windows 10 Enterprise edition includes:

  • Granular UX Control, in which IT is able to customize and lock down the user experience of a Windows device for task-workers, kiosks, IoT/ embedded type functions using device management policies.
  • Pass the Hash Mitigations: The ability to store derived credentials (i.e.: NTLM hashes and Kerberos tickets) and the process that manages them (i.e.: Local Security Authority Subsystem Service (LSASS)), in a Hyper-V protected environment that is called a “Virtual Secure Mode (VSM)”. The VSM provides hardware based isolation and protection of derived credentials and prevents them from being stolen or misused even in the event that the Windows kernel is fully compromised. This capability prevents Pass the Hash (PtH) attacks which enable an attacker to impersonate a user on the network.
  • Device Guard: Device Guard locks down the device such that it can only run trustworthy executable code (e.g.: .exe, .dll) which means that they are signed by a trusted authority.  Device Guard can be used in combination with AppLocker, which is also included in the Enterprise Edition. In this case Applocker can be used to define which apps from a vendor who’s signature has been added to the trust list can be run on a device.

Below graphic shows the benefit of the Enterprise SKU along with Software Assurance.


Windows 10 Works with Existing Infrastructure

Deploying and managing Windows 10 in your business does not mean upgrading your client management infrastructure.  Use your existing SCCM and Windows Server investments to deploy and manage the new Windows 10, which has now been officially released.  See the matrix below for compatibility information.  Also note, a new version of System Center Configuration Manager is in the works which will offer new capabilities related to Windows 10 features but is not needed to get Windows 10 out to your users today!


Twitter: @jparekh_tech

Microsoft Desktop Optimization Pack (MDOP) now included in Software Assurance with Windows 10

Software Assurance now includes the full features and capabilities of MDOP.  MDOP is a set of products to help with virtualization, management and restore capabilities.  With the Windows 10 launch, MDOP is now included as an SA benefit, and is no longer a separate add-on.

For more information about MDOP, go to

Enroll Windows 10 Enterprise Preview to Hybrid ConfigMgr + Microsoft Intune

The following are quick steps to enroll the Microsoft Windows 10 Insiders Preview (as of build 10130) to Microsoft Intune in a hybrid environment with Microsoft System Center 2012 R2 SP1 Configuration Manager (SCCM).

This assume you have already configured Microsoft Intune into your SCCM environment.

  1. In the SCCM console, navigate to Administration -> Overview -> Cloud Services -> Microsoft Intune Subscriptions.
  2. On the top ribbon bar, click the Configure Platforms button. Click Windows in the drop down

  3. From the Microsoft Intune Subscription Properties, click the Enable Windows enrollment.

  1. Log onto your Windows 10 desktop, go to Settings and choose Network and Internet

  2. Click on Accounts and then Work access. On the Connect to work or school section, click the + Connect

  3. Enter your work email address that are Intune enabled (an account that has synchronization between your on-premise Active Directory and Windows Azure Active Directory). After you click continue, you will be sent to the Microsoft site to authenticate.

  4. Once done, you see the connected account on the main section.

  5. In the SCCM console, you will now be able to see your newly enrolled device as a Mobile device. You will be able to deploy applicable compliance policies just like any other mobile devices in your organization.


Hybrid – Intune Mobile Application Management and Conditional Access for Outlook blog NOTE

As most have seen the blog announcing the Intune Mobile Application Management and Conditional Access for Outlook.  At the very bottom, there is a Note about the hybrid customers (SCCM) availability that seems to be missed by few folks when they update to SP1.

Note: These features are currently available in Intune standalone (cloud only) and will be made available to hybrid customers by July 2 as part of an upcoming Intune service update.

Configuration Manager Collection Query for Android Devices

Quick query to dynamically identify Android devices in Configuration Manager 2012 R2

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_DEVICE_OSINFORMATION on SMS_G_System_DEVICE_OSINFORMATION.ResourceId = SMS_R_System.ResourceId where SMS_G_System_DEVICE_OSINFORMATION.Platform like “%Android%”