Microsoft Ignite 2023 - "Windows App" revelead

Microsoft just announced at Ignite 2023 a new app called..."Windows app". This new app, still in preview, that you can get right now, is available for iOS, the web and Windows.

It enables users to connect to various types of Windows "machines" like Windows 365, Azure Virtual Desktop, Microsoft Dev Box, or a personal Remote Desktop PC.

At the moment, there's no much information about the app but screenshots in Windows Store shows PCs and also a list of apps, which may indicate that users will be able to launch apps remotely installed on other devices.

If you're curious about this new app, go ahead and installed it from the Windows Store:
Windows Store - Windows App

Powershell - Exchange Online - Shared Mailboxes - Enable automatic copy of sent items

 

When you create a shared mailbox in Exchange Online (EXO) by default the sent items will end up in your main mailbox sent items.

That's a bit annoying since if you want others, that have access to the shared mailbox, to see your replies, you'll need to manually copy, or create a rule for it.

But there's a solution, and you just need to follow these steps using PowerShell:

1. Connect to Exchange Online:
   Connect-ExchangeOnline -UserPrincipalName yourusername@upn.com
   
   
2. Next, if you what check the current status for sent items:
   Get-Mailbox sharedmailbox | select MessageCopyForSentAsEnabled
   
   
3. To enable automatic sent items copy:
   Set-Mailbox sharedmailbox -MessageCopyForSentAsEnabled $True

And you're done! :)

Windows 11 23H2 - How to enable/access Copilot in Europe

 

So, you've already using the new Windows 11 23H2 Feature Update and you notice that on of the most awaited features is nowhere to be found?
If your living in Europe, you can give many thanks to Digital Markets Act (DMA) for blocking it in EU.

Well, but this is technology so...there's always workarounds...here's one while we wait for DMA to unblock Copilot:

1. Create a shortcut (Right-click > New > Shortcut)
2. For the item location write down "microsoft-edge://?ux=copilot&tcp=1&source=taskbar" and click Next
3. Now type your preferred name for the shortcut, Copilot for example and click Finish

Now just try it out. Copilot will open exactly like other guys have outside EU.

If you want to have a nice Windows Copilot icon, just download this one:

Windows Copilot Icon

Windows 11 23H2 - How to force upgrade with Enterprise SKU

 
If you're using a Windows 11 Enterprise SKU, you may not automatically receive 23H2 update right now. Even if you enable the "Get the latest updates as soon as they're available" and then check for updates, the Feature Update may not be available today.

This was the easiest and fastest way to upgrade my machine from 22H2 to 23H2 and for obvious reasons it's fine for an isolated upgrade, and not for an enterprise-wide rollout. For that kind of scenario you should use Windows Update for Business; VLSC; etc.

So, just follow these steps:

1. Download Windows 11 Installation Assistant from here
2. Double-click, next, next next
3. Wait....
4. Done!

Don't be afraid because this will upgrade your Windows version and not wipe out your disk.

After the upgrade, open Windows update and install the latest quality update, which for the moment I'm writing this article is this one: 
2023-10 Cumulative Update Preview for Windows 11 Version 23H2 for x64-based Systems (KB5031455)

VBScript to R.I.P. Soon

 

It seems like that after 30 years, the good old favorite scripting language for sysadmins is going to rest in peace.

VBScript aka Visual Basic Script was introduced in 1996 and integrates active scripting into Windows environments, and communicates with host applications through Windows Script.This was one of the favorites scripting languages for system administrators.

Microsoft announced VBScript's deprecation October 9th on it's "Deprecated features for Windows Client" article following the September announcement of WordPad end of life.

So, the plan to retire VBScript starts with it being preinstalled via Features on Demand (FoD), and in the "near future" remove it from the OS and only available has a FoD.

It had a been a long and fantastic life for VBScript. For those that never tested PowerShell, now is time to really dig into it. 

Long live VBScript. :)

M365 Defender - Get Email Notifications for Incidents

 

Because nowadays you've to look for a lot of information, it's important that the information you really need, comes to you and not the other way around.

That's why I believe it's important to have the least possible endpoints where you get your information about your infrastructure. And if your giving support to more than one tenant this is even more important.

So, instead of going to Microsoft 365 Defender all the time, you can create email notifications for what you need, and receive everything in one place.

To do so, follow these steps:

1. Open Microsoft 365 Defender (https://security.microsoft.com)
2. Go to Settings > Email Notifications
3. And from there create a new rule or edit an existing one
4. Select which products you want to receive email notifications
5. Next select the recipients
6. Done! :)

Intune - Expedite Updates - Expedite Client Missing - Solved

 

One of the recent functionalities in Microsoft Intune, is the "Expedite Updates".
This allows you to "force" clients to receive Windows Updates as soon as possible. In addition to rely on Microsoft Windows Update service, it also relies on Microsoft Update Health Tools.

Microsoft Update Health Tools as a service called...Microsoft Update Health Service or "uhssvc".

After created the policy to update devices with latest Windows quality update, some devices were reporting "Expedite client missing". 

Although the most common issue is that the device don't really have Microsoft Update Health Tools installed correctly, and you can download it here: Update Health Tools, in this case I found how a different cause.

The Microsoft Update Health Service was Disabled. So it was has easy as enable and start the service and everything just started working right away.

Intune - Tamper Protection not Enabled - Solved!

 

So, for the last day I was trying to figure out why I couldn't enable Tamper Protection on some lab devices.

To enable Tamper Protection, you need the follow theses steps:

1. Open Intune Microsoft Intune admin center
2. Go to Endpoint Security > Antivirus
3. Edit or create a policy:
• Platform: WIndows 10, Windows 11, and Windows Server
• Profile: Windows Security Experience
4. From there set the option "TamperProtection (Device)" to "On"

But...for some reason, devices keep setting the option to "Off". After long time trying to understand this, I finally found the issue.

M365 Defender Settings takes precedence! 

What this means, is that you don't allow Tamper Protection in M365 Defender Advanced Features, you'll never be able to control it with Intune.

So, first and for most, enable Tamper Protection in Advanced Features, using these steps:

1. Open Microsoft 365 Defender Endpoints Advanced Features (or Settings > Endpoints > Advanced Features)
2. Enable "Tamper Protection" and "Save Preferences"

No you just need to wait some minutes to the option to be available and you can control it via Intune.

Windows 11 September 2023 Update (23H2) Available

Today, our next major #Windows11 update begins rolling out, with over 150 new features, new modernized apps, and Copilot on Windows! Learn more: https://t.co/aZONKZU59W pic.twitter.com/0YFSufSn6K

— Yusuf Mehdi (@yusuf_i_mehdi) September 26, 2023

With more than 150 new features, Microsoft Windows 11 22H3 is now available.

There's a lot going on with this new update, and here's the Microsoft's summary about the most notorious changes and news:
The most personal Windows 11 experience begins rolling out today | Windows Experience Blog

Obviously, AI its the most prominent feature, embedded everywhere in the system, but here are some that I think can really help and give the OS even more day to day added value:

• AI in Paint
• This one it's a cool one, and may give Paint a new live. You'll know be able to remove backgrounds directly from Paint
  
  
  
  
  
  
• Windows Backup
• The new tool will allow you to effortlessly bakcup your folders, apps, settings and credentials, and get them back when you reinstall or get a new computer.
  
  
• Passkeys
• This is a new evolution on Hello for Business. It's now integrated by default in the OS. Passkeys are the cross-platform future of secure sign-in management and eliminate the need for passwords. A passkey creates a unique, unguessable credential and allows you to sign in using your face, fingerprint or device PIN. On Windows 11, passkeys will work with Edge, Chrome, Firefox and other browsers.
  
  
  
• Mobile Application Management (MAM) for Windows
• After long time with MAM for Android and iOS, now it come to Windows where you can now allow your employees to user their personal Windows device but, with controlled access to company information.
  
  

 There's a lot more about Windows 11 23H2, so please don't forget to review the official Microsoft post.

M365 Copilot - Generally Available for Enterprise on November 1st

 

Although Microsoft announced Microsoft 365 Copilot last September 21st, for Enterprise the "revolution" of AI will come later this year. For Enterprise customers, Copilot will be generally available starting 1st November.

To know more about what Microsoft AI can do, take a look to their Microsoft 365 blog post where they talk about everything that is coming:

Announcing Microsoft 365 Copilot general availability and Microsoft 365 Chat | Microsoft 365 Blog

Panos Panay leaves Microsoft after 19 years

 

Iconic Panos Panay announced today that he's leaving Microsoft after 19 years.
The Microsoft veteran and passionate manager that was in charge for Surface, and more recently Windows client leaves the company has announced by Rajesh Jha, Microsoft's EVP of Experiences & Devices in an internal email this morning:

"After nearly 20 years at the company, Panos Panay has decided to leave Microsoft. Panos has had an incredible impact on our products and culture as well as the broader devices ecosystem. Under Panos’ leadership, the team created the iconic Surface brand with loved products. More recently, as the leader of Windows, the team has brought amazing services and experiences to hundreds of millions with Windows 11 on innovative devices including those from our OEM partners. He will be missed, and I am personally very grateful for his many contributions over the years. Please join me in wishing him well. 

Moving forward, we will double down on our strategy. These changes will be effective immediately with Panos’ help in the transition. 

Build silicon, systems and devices that span Windows, client and cloud for an AI world. This team will be led by Pavan Davuluri, who will report directly to me. Brett Ostrum, Nino Storniolo, Linda Averett, Ken Pan, Ralf Groene, Aidan Marcuss, Carlos Picoto, Stevie Bathiche, Robin Seiler, Ruben Caballero and Anuj Gosalia will move to report to Pavan with their teams intact. Windows planning and release management will continue to be in this team. Our commitment to Surface and MR remains unchanged.

Build experiences that blend web, services and Windows for an AI world. To this end, Shilpa Ranganathan, Jeff Johnson and Ali Akgun will directly report to Mikhail Parakhin and form a new Windows and Web Experiences Team, moving with their teams intact. 

Yusuf Mehdi will take on the responsibility of leading the Windows and Surface businesses with our OEM and Retail partners. In addition, Charles Simonyi, Terri Chudzik and Erin Kolb will join the E+D management teams and Ralf Groene and Mike Davidson will work together on the best alignment on design teams. We will set up time for an AMA in the coming days to answer questions. Let’s continue to stay focused on executing on our existing plans. Thank you for all that you do, and the impact that you have for our customers and partners. "

With all is passion and charismatic presentations, Panos made Windows cool again. Let's hope that who substitutes him can deliver the same feeling.

Intune - Switching MDM Authority from O365 to Intune

 

So for some strange reason, when you navigate to your Tenant Status Details, you notice that your MDM authority is Microsoft Office 365 instead of Microsoft Intune?

This can happen for a variety of reasons:

• You may have enabled "Basic security and mobility" a long time ago and you don't remember
• When you first time opened Intune you selected O365 as the MDM Autorithy
• etc.

Now...you have purchased a Microsoft 365 plan that have an Intune license and you want to change the MDM Authority to Microsoft Intune.

At least for me, the easiest way to do it asap, is like this:

1. Open the Intune for Education with a global admin (https://intuneeducation.portal.azure.com/)
2. Next go to "Tenant Settings" and from there select "Microsoft Intune" as the MDM Authority.

Quick and easy. And...you're done! :)

Exchange Online - Enable auditing for DiscoverySearchMailbox

In my last post, I've talked about how to identify and enable auditing for specific mailboxes.

One mailbox that you probably going to identify, it's the eDiscovery Mailbox. Usually it's "name" is something like "DiscoverySearchMailbox{alotofnumbers}@yourdomain.com".

For this one, my previous posted command does not work.
So, to be able to enable auditing for this mailbox, the easiest way that I found is this one:

And...you're done! :)

Exchange Online - Identify mailboxes with audit disabled

 

One of the Microsoft Secure Score recommendations is to ensure mailbox auditing for all users is enabled.
Although within the recommendation implementation there's a powershell command to do it organization wide, there's always the need to do it individually for resource mailboxes for example.

So, to enable auditing organization wide command is this one:

Now, to identify which mailboxes still aren't enabled, just run this command:

Finally, to enable auditing in that mailboxes, run this command for each one:

And you're done! :)

Autopilot - Manually register devices with automatic upload

 

This can be very useful for everyone that have a test lab where you want to register your virtual machine in Intune.

Here's the quick step on how to register your machine from the OOBE:

1. When you get to OOBE, press "Shift + F10" to open a command-prompt:
   
   
2. Now, all you need to do is run this commands:


3. After running the commands, you'll be prompt for valid credentials for adding the device to Intune.
   
   

And...you're done! The device information (hardware hash, etc.) gets registered and if you boot up your device again, you'll enter the autopilot process.

OneDrive Getting Customized Folder Colors

 

Microsoft announced that later this year, OneDrive will allow customizing folders color.
This has been a recurrent users request, that wanted to give different aspect to different types of content inside the folders.

You asked for ways to customize your OneDrive and were delivering. Later this year you’ll be able to change the colors of folders. pic.twitter.com/uGUNFiyd2L

— OneDrive (@onedrive) July 31, 2023

Personal and Enterprise Big Chat Dark Mode Available

 

In this week's update for Bing, Microsoft made generally available the option to use Bing Chat in Dark Mode. This update is available for both personal and enterprise versions of Microsoft's AI Chat.

To enable dark mode just follow these steps:

1. Open Bing Chat (bing.com/chat)
   
   
2. Then click the "hamburger" menu in the top right corner
   
   
3. In the Appearance, select "Dark" or "System Default" if you want it to adapt to your system preferences

Done! :)

Get Windows Information and Resources How You Want

 

Here's a nice Windows IT blog post of various ways to stay informed about Windows world.
From websites, blogs, X accounts, podcasts, it's a nice backed list of link to have Windows information the way it suits you best.

Take a look here:
Skilling snack: Windows information and resources for IT pros

New Microsoft Teams Preview - How to Enable

 

The new Microsoft Teams is coming and you can preview it right now!

Rolling out in September 2023 for new and existing installations of Microsoft 365 Apps for Windows, currently, users can install the new Teams by using the "Try the new Teams" switch in classic Teams or having administrators bulk deploy directly to the computers in theirs organization.

To enable the switch for specific users or groups, follow the instructions here:
Deploy the new Teams client using policies - Microsoft Teams | Microsoft Learn

If you want to bulk deploy in your organization, you should follow this instructions:
Bulk deploy the new Microsoft Teams desktop client - Microsoft Teams | Microsoft Learn

The option to opt-out will be available in early August 2023.

For a complete list of what's new and improved in the new Teams experience, here's the Microsoft Blog announcement:
Introducing the new Microsoft Teams, now in preview - Microsoft Community Hub

BitLocker - Recovery Keys from Company Portal

 
Generally available today, it's now possible to retrieve the BitLocker recovery keys of your devices, directly from the Company Portal.

To do so, you just need to follow these steps:

1. Open Company Portal ( in another device since you're locked up in your own...)
   Microsoft Company Portal
   
   
2. Next, in the "My Apps" menu select "My Account"
   
   
3. Now select "Manage Devices"
   
   
4. Click the device you want to recover and click "View BitLocker Keys"
   
   

And there you go!