User Profile
forderud_ge
Copper Contributor
Joined 6 years ago
User Widgets
Recent Discussions
Company Portal without login?
I'm working on a project where I want to make certain SW applications optionally available to groups of Windows 10/11 computers through InTune. I understand that I then need to use Company Portal, since the InTune Management Extension (IME) only delivers required SW applications and not optional apps. My problem then is that Company Portal seem to require manual user-login on first startup. This is problematic, since the computers are running in "kiosk"-mode with auto-login to a custom application. This means end-users doesn't have the password to their windows account. User context should furthermore be unnecessary, since all apps are assigned to groups of computers, and not users. The IME service is able to deliver SW apps without any manual user-login, so it should be technically feasible for Company Portal to do the same. QUESTION: Is it possible to start Company Portal without having to log in on the first startup, like the IME service?Re: InTune management extension SecureChannelFailure (Could not create SSL/TLS secure channel)
SSL package inspection was temporarily disabled for "manage.microsoft.com" and "*.manage.microsoft.com" during testing. However, InTune management extension still reported the same "SecureChannelFailure" in the log and failed to report "Discovered apps" back to the server.Re: InTune management extension SecureChannelFailure (Could not create SSL/TLS secure channel)
I'm experiencing some issues with disabling of SSL package inspection to get rid of "SecureChannelFailure" errors from InTune management extension. Are you sure that "manage.microsoft.com" is the only endpoint where SSL inspection isn't supported, or does the limitation also apply to subdomains (*.manage.microsoft.com) and/or other domains mentioned on https://docs.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints ?Re: InTune management extension SecureChannelFailure (Could not create SSL/TLS secure channel)
I've already verified that InTune management extension seem to work fine when deploying from a public network. I'm therefore quite sure that this problem is tied to proxy and/or SSL inspection restrictions on the company network in question. This still leaves me with the problem of more accurately pin-pointing the concrete problem. I'll need to know exactly what/how the management extension is failing in order to submit a change request for the company network infrastructure setup. Preferable with a minimal reproducer. Is this something you can help me with?Re: InTune management extension SecureChannelFailure (Could not create SSL/TLS secure channel)
Thanks for the tip Harm. I have a feeling that my problems are related to the "The inspection of SSL traffic is not supported to 'manage.microsoft.com' endpoint." note, since the network in question uses a custom root certificate to inspect SSL traffic. Is there a way to verify that assumption by enabling more verbose logging or similar?InTune management extension SecureChannelFailure (Could not create SSL/TLS secure channel)
I'm experiencing networking problem when Microsoft Endpoint manager is trying to deploy InTune management extension from https://endpoint.microsoft.com/ to a Win10 device within a company network. Extract from C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log: <![LOG[starting impersonation, session id = 2]LOG]!><time="10:12:27.0961922" date="4-16-2022" component="IntuneManagementExtension" context="" type="1" thread="4" file=""> <![LOG[ After impersonation: DESKTOP-SEFFEL8\AdminAccount]LOG]!><time="10:12:27.0961922" date="4-16-2022" component="IntuneManagementExtension" context="" type="1" thread="4" file=""> ... <![LOG[Current proxy is http://company-proxy-url/]LOG]!><time="10:12:27.0961922" date="4-16-2022" component="IntuneManagementExtension" context="" type="1" thread="4" file=""> ... <![LOG[[IsWebExceptionRetryable] web exception status = SecureChannelFailure]LOG]!><time="10:12:27.2368570" date="4-16-2022" component="IntuneManagementExtension" context="" type="1" thread="4" file=""> <![LOG[WebException occurs, and it's not retryable exception, exception is System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel. at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context) at System.Net.HttpWebRequest.GetRequestStream() at Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.EmsServiceBase.<SendWebRequestWithProxy>d__20.MoveNext()]LOG]!><time="10:12:27.2368570" date="4-16-2022" component="IntuneManagementExtension" context="" type="3" thread="4" file=""> The network in question relies on a "AutoConfigURL" registry setting for proxy auto-configuration script and a custom root certificate added to "Trusted Root Certificate Authorities" in certificate manager. I've already configured these settings for all interactive users and internet connectivity is tested to work from Microsoft Edge and C# code using System.Net.WebRequest and System.Net.HttpClient to access HTTPS content. The Win10 device is listed as connected on https://endpoint.microsoft.com/ , so the connectivity problem seem to be limited to just the InTune management extension. IntuneManagementExtension.log furthermore indicate that the agent is able to impersonate the logged-in admin account and use the correct proxy server, so I'm struggling to understand the reason for the networking problems. Computer details: Windows 10 IoT LTSC 2021 (x64). InTune management extension 1.53.204.0.
