Device Management

You have learned about remote administration and jump server configuration for troubleshooting, deployment, and general work use scenarios in the previous chapters. In this chapter, we'll look at at the new Mobile device management (MDM) capabilities of Windows 10, discuss caveats of the Windows 10 GPO processing and have a deeper look at patching and servicing including the deployment solutions of the needed quality and feature updates like Windows Update (for Business), WSUS, SCCM and third-party solutions.

The following topics will be covered:

• Mobile device management
• Changes to GPOs in Windows 10
• Update deployment solutions
• Patching and servicing

Evolving business needs

According to Forrester Research, mobility is the new normal. Information workers will erase the boundary between enterprise and consumer technologies and therefore mobility is certainly a defining vector in the evolution of the new business world. 56% of information workers send their first email before getting to the office, and 73% send their last email after leaving the office. 52% of information workers are using three or more devices for work.

Business needs are evolving with the new Industry 4.0 from employees working Monday to Friday, 9 to 5 toward a 24/7 blur of work and personal activity; from computers on a LAN corporate network toward multiple devices, any time, anywhere; and from on-premises applications and file hosting towards Software as a Service (SaaS) applications and cloud based file hosting.

So also, old-school methods of managing computers...

Mobile device management

When discussing MDM, we need to look back in time to understand its origin and some of its limitations. Back in June 2002, the non-profit organization Open Mobile Alliance (OMA) formed (for more information visit http://openmobilealliance.org/about-omawas). The OMA Device Management (OMA DM) specification was originally designed for the management of mobile devices like mobile phones, tablets, and PDAs (for more information visit http://openmobilealliance.org/about-oma/work-program/device-management). It was intended to provision and configure devices and enable software updates and fault management. There is a fixed set of OMA DM protocol commands all vendors support. Currently, Windows 10 1607 and higher supports MDM protocol version 6.0 (for more information visit https://msdn.microsoft.com/en-us/library/dn392112.aspx).

MDM configuration objects are...

Changes to GPOs in Windows 10

Besides the major changes to MDM management, there are also changes to the GPO processing of Windows 10, which will be covered now. These changes begin with GPOs only applicable to certain SKUs, known issues when upgrading your central policy definition store, and known issues when editing new GPOs, including Group Policy Preferences (GPPs) with the old Group Policy Management Console (GPMC) console.

Enterprise/Education - only GPOs

There have been policies that apply only to Windows 10, but for the first time ever in Windows history, now there are also GPOs that apply to certain Stock Keeping Units (SKUs) only. Several GPOs for customizing Windows 10 apply only to Windows 10 Enterprise and Education...

Servicing and patching

When we talk about changes to the way to service (or patch) Windows, it's important to first understand how things worked with Windows 7 and Windows 8.1. Each month, Microsoft released somewhere between 1 and 20 individual fixes for each one: some security updates, some non-security updates. Most of these patches were General Distribution Release (GDR), meaning available on WU, WSUS, and Windows Update Catalog. Some patches where released under Limited Distribution Release (LDR) (also formerly known as Quick Fix Engineering (QFE)). LDR packages contain other fixes that have not undergone testing as extensive, and resolve issues that only a fraction of the millions of Windows users might ever encounter. These LDR patches need to be downloaded on separate KB pages or sometimes requested from Microsoft services.

Most organizations deploy the security fixes...

Summary

In this chapter, you learned about the new MDM capabilities and changes in GPO processing of Windows 10. In the servicing and update part we discussed the different update delivery solutions and gave recommendations for building servicing rings to keep up with the fast Windows 10 release cadence. In the next chapter, we will have a closer look at protecting Enterprise data in BYOD scenarios.