Deploy CM Client to Windows 365 Cloud PC Azure AD Joined (no CMG)

Published Mar 14 2022 09:49 PM 3,141 Views
Microsoft

How to deploy CM Client to Windows 365 Cloud PC Azure AD Joined (no CMG) devices “without Cloud Management Gateway”?

 

If you’re here it means you’re tracking the main deck for Windows 365 Cloud PC Healthcare Series

 

This article is directly associated with Management Design options for Windows 365 Cloud PC (Intune and Co-Management), but solely focused on Windows 365 Cloud PC Architecture Design Provisioning OPTION 2 (Windows 365 Azure AD Joined + hosted in Customer Network).

 

OPTION 2 teach us about Windows 365 provisioning hosting design option for Cloud PCs and recommendations aligned for management of the device, primarily recommended to leverage Intune through Microsoft Endpoint Manager, your single-pane-of-glass for all your device management needs.

 

But, what if your MECM (Microsoft Endpoint Configuration Management) server “aka SCCM” PC management solution is well developed and there’s a need to continue to leverage the solution to manage Azure AD Joined Cloud PCs?

 

Many of our HLS customers leverage Microsoft Endpoint Configuration Manager as a PC management solution, with wider development on application delivery, device restrictions, PS scripts, reporting, etc... We often receive requests on “how can we manage Windows 365 Cloud PC Azure AD Joined with MECM servers, do we need a Cloud Management Gateway (CMG)?

 

“Azure AD Joined devices are considered internet-based devices because they don’t have a direct connection to an on-premises environment. CMG is leveraged to deliver that PC management needs from MECM servers to manage the Azure AD Joined devices, this gives line-of-sight to MECM on-prem environment” … You can read here for more information.

Tutorial - Enable co-management for internet devices - Configuration Manager | Microsoft Docs

 

Luckily, OPTION 2 has it benefits!

 

You could deploy CM clients to Windows 365 Cloud PC Azure AD Joined by MECM servers “without a Cloud Management Gateway (CMG)” by leveraging the existing Windows 365 OPNC connector (On-premises Network Connection) that could be tailored to give line-of-sight to your on-premises MECM environment.

 

jsifuentes_1-1647317016624.png

 

Let’s dive in!

 

 

Deploy CM Client to Windows 365 Cloud PC Azure AD Joined (no CMG)

 

In this business scenario we will deploy the CM client with Intune as a Win32 app to a Cloud PC Azure AD Joined, without a CMG (Cloud Management Gateway)

 

  • CMG is typically required for Azure AD Joined windows devices outside the network to push the CM client from SCCM
  • “OPTION 2” (Windows 365 Azure AD Joined + hosted in Customer Network) can leverage the OPNC connector
  • OPNC connector can be tailored to give line-of-sight to the on-premises environment (including DCs and SCCM servers)
  • With this option we can push the CM client from Intune without CMG

 

Available guidance!

Scoping the Azure AD Joined Cloud PCs through Microsoft Endpoint Configuration Manager "aka SCCM" is not a simple task, if you’re looking for documentation on how to achieve that, we have created this blog as a technical guidance for our HLS customers with existing (MECM) environments to help Deploy Co-Management Collections for Windows 365 Cloud PC, enjoy!

 

Build the Cloud PC Subnet Boundaries

 

  1. First, we need to capture the Cloud PC Subnet address

Azure Portal (https://portal.azure.com) > “Cloud PC” Virtual Network > “Cloud PC” Subnet

jsifuentes_2-1647317076966.png

 

  1. Now we go to MECM server to configure the Cloud PC subnet boundaries

Administration > Boundaries > Add the Cloud PC Subnet (e.g., based on my lab is 10.0.4.0)

jsifuentes_3-1647317076971.png

 

Chose the Deployment option for your CM client

There are multiple ways to deploy the CM client to a Windows Cloud PC, following scenario "OPTION 2" we will focus on two options to deliver the application to the Cloud PC device.

 

LOB: Deploy the CM client as a LOB app

LOB delivers more simplicity for the application

You can define the application installation using "command-line arguments"

 

Win32: Deploy the CM client as a Win32 app

Win32 gives you more control of the application (install and uninstall)

You can add Return codes for a troubleshooting event

You can add Requirements for OS architecture

You can have Dependencies or Supersedence rules

You can have Detection Rules (custom and based of the MSI file)

 

Either approach is very much suitable to be aligned within your business use case (you only need one approach).

 

Deploy the CM client as a LOB app

 

1. Intune LOB App

 

From MEM console  https://endpoint.microsoft.com/ > Apps > Windows > Add a LOB app

 

jsifuentes_0-1649739528197.png

 

Select the MSI file for CM client

 

jsifuentes_1-1649739528204.png

 

App information named "Win10 - CM Client (MECM) LOB"

 

jsifuentes_2-1649739528207.png

 

Command-line arguments

 

INSTALL command: 

 

 

CCMSETUPCMD="/mp:mecm.contoso.com SMSSITECODE=MEC SMSMP=mecm.contoso.com DNSSUFFIX=contoso.com"

 

 

 

/mp <<<this is the FQDN of your SCCM server>>>

/SMSSITECODE <<<this is the SITE CODE of your SCCM server, it's 3 letters>>>

/SMSMP <<<this is the FQDN of your SCCM server>>>

/DNSSUFFIX <<<this is your local DOMAIN name>>>

 

Assign and Create the Win32 app to the Cloud PC device group where the CM client will be installed

Note: you should assign it AFTER the Cloud PC has completed provisioning

 

jsifuentes_3-1649739528209.png

 

Deploy the CM client as a Win32 app

 

1. Intune WIM file

 

Create a directory where you will package the script as an Intune WIM file

DIRECTORY = "C:\Users\jsifuentes\Downloads\IntuneWIMApps\Apps\CM Client"

Create two folders Source and Target

SOURCE = "C:\Users\jsifuentes\Downloads\IntuneWIMApps\Apps\CM Client\Source"

TARGET = "C:\Users\jsifuentes\Downloads\IntuneWIMApps\Apps\CM Client\Target"

Copy the CM Client MSI application to the Source folder from the SCCM server

PATH "C:\Program Files\Microsoft Configuration Manager\bin\i386\ccmsetup.msi"

APPLICATION = "ccmsetup.msi"

jsifuentes_4-1647317352933.png

Create a folder for the IntuneWinAppUtil tool

TOOLS = "C:\Users\jsifuentes\Downloads\IntuneWIMApps\Tools"

Download IntuneWinAppUtil and copy to the Tools folder

jsifuentes_5-1647317352936.png

From the folder run Terminal and execute the IntuneWinAppUtil tool

jsifuentes_6-1647317352938.png

Follow the prompts to copy the SOURCE, APPLICATION and TARGET

jsifuentes_7-1647317352940.png

jsifuentes_8-1647317352941.png

The new Intune WIM file will be created

jsifuentes_9-1647317352945.png

 

2. Intune Win32 app

 

From MEM console https://endpoint.microsoft.com/ > Apps > Windows > Add a Win32 App

jsifuentes_10-1647317581375.png

 

Select the WIM file we created

jsifuentes_11-1647317581382.png

 

App information named "Win10 - CM Client (MECM)"

jsifuentes_12-1647317581387.png

 

Program details

INSTALL command:

 

 

msiexec /i "ccmsetup.msi" /q CCMSETUPCMD="/mp:mecm.contoso.com SMSSITECODE=MEC SMSMP=mecm.contoso.com DNSSUFFIX=contoso.com"

 

 

 

UNINSTALL command:

 

 

msiexec /x "{CDF935DE-3234-4472-BE04-9CC468EC5E0D}" /q

 

 

 

/mp <<<this is the FQDN of your SCCM server>>>

/SMSSITECODE <<<this is the SITE CODE of your SCCM server, it's 3 letters>>>

/SMSMP <<<this is the FQDN of your SCCM server>>>

/DNSSUFFIX <<<this is your local DOMAIN name>>>

 

jsifuentes_13-1647317581390.png

Detection Rules

 

Option1:

Use the existing MSI rule that gets automatically populated from the MSI client package

MSI product code = {CDF935DE-3234-4472-BE04-9CC468EC5E0D}

 

jsifuentes_14-1647317581394.png

 

Option2:

Create a detection PS script and save the file as "CMclientDetectionScript.ps1":

 

 

Get-WmiObject Win32_Product | Where-Object {$_.Name -eq “Configuration Manager Client”}

 

 

 

Save the PS script to the folder SOURCE

jsifuentes_15-1647317581394.png

 

Upload the PS script to Intune Detection rule, keep the defaults

jsifuentes_16-1647317581398.png

 

Option3:

Create a detection path to validate if the CM client was previously installed

PATH = C:\Windows\ccmsetup

FILE = ccmsetup.exe

jsifuentes_17-1647317581400.png

 

Assign and Create the Win32 app to the Cloud PC device group where the CM client will be installed

Note: you should assign it AFTER the Cloud PC has completed provisioning

jsifuentes_18-1647317581406.png

 

Logs

Important logs location under the Cloud PC device to help troubleshoot

C:\Windows\CCMsetup\Logs

C:\Windows\CCM\Logs\ClientLocation.log

C:\Windows\CCM\Logs\LocationServices.log

 

jsifuentes_19-1647317581409.png

jsifuentes_20-1647317581420.png

 

Discover CM Client manual installs

 

The MECM server won't automatically approve the CM client installation, you'll have to manually approve it (create a collection "Not Approved" to make it easier to find them)

 

1. Create a Collection “Not Approved”

To help find the Azure AD Joined CPCs after you install the CM client

 

Assets and Compliance > Device Collections > create collection named "Not Approved" > Limit collection to "All Systems"

jsifuentes_0-1647318359414.png

 

Create query for "Look up Not Approved clients" > Edit query > Show query language:

 

 

 

 

 

select SYSTEM.ResourceID,SYSTEM.ResourceType,SYSTEM.Name,SYSTEM.SMSUniqueIdentifier,SYSTEM.ResourceDomainORWorkgroup,SYSTEM.Client from SMS_R_System as system join SMS_FullCollectionMembership as collection on system.ResourceID = collection.ResourceID where collection.IsApproved=0

 

 

 

 

 

<<<collection.IsApproved=0 = the value 0 represents all computers where the CM client has not been approved yet>>>

jsifuentes_1-1647318359420.png

 

Add columns "Approved" and "Domain" to help identify them

jsifuentes_2-1647318359426.png

 

2. Approve the CM client

 

The CM client will be missing some of the MECM configuration actions until you approve the installation

jsifuentes_3-1647318359434.png

 

After Approve, the device will pick up the missing actions from MECM server

jsifuentes_4-1647318359435.png

jsifuentes_5-1647318359440.png

jsifuentes_6-1647318359448.png

 

From MEM portal, the device will change from (Intune) to (Co-Managed)

jsifuentes_7-1647318359455.png

 

Now you will notice the Co-Management workloads are enabled for the Co-Managed Azure AD Joined Cloud PC device

jsifuentes_8-1647318359467.png

 

Resources

 

If you want to learn more about deploying the CM client based on different business scenarios to allow the MECM (Microsoft Endpoint Configuration Manager) “aka SCCM” server to manage Azure AD Windows devices (Hybrid Domain Joined or Azure Domain Joined), please see the articles below.

 

Deploy clients to Windows - Configuration Manager | Microsoft Docs

Client installation parameters and properties - Configuration Manager | Microsoft Docs

 

 

Bookmark this link for Windows 365 Cloud PC Series: https://aka.ms/HLSWindows365

 

Thanks for visiting – Juan Sifuentes LinkedIn

 

Version history
Last update:
‎May 17 2022 11:37 AM
Updated by: