You're reading from Windows 11 for Enterprise Administrators - Second Edition

Product typeBook

Published inOct 2023

PublisherPackt

ISBN-139781804618592

Edition2nd Edition

Concepts

System Administration

Authors (5):

Manuel Singer

Jeff Stokes

Steve Miles

Thomas Lee

Richard Diver

View More author details

Device Management

You have learned about remote administration and jump server configuration for troubleshooting, deployment, and general work-use scenarios in the previous chapters. In this chapter, we’ll look at the new mobile device management (MDM) capabilities of Windows 10 and 11, discuss caveats of the Windows 10/11 Group Policy Object (GPO) processing, and have a deeper look at patching and servicing, including the deployment solutions of the needed quality and feature updates such as Windows Update for Business (WUfB), Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager (MECM) (aka System Center Configuration Manager, or SCCM), and third-party solutions.

In this chapter, the following topics will be covered:

Evolving business needs
MDM
Changes to GPOs in Windows 10/11
Servicing and patching
Update deployment solutions

Evolving business needs

According to Forrester Research, mobility is the new normal. Information workers will erase the boundary between enterprise and consumer technologies, and therefore mobility is certainly a defining vector in the evolution of the new business world. 56% of information workers send their first email before getting to the office, and 73% send their last email after leaving the office. 52% of information workers are using 3 or more devices for work.

Business needs are evolving with the new Industry 4.0, from employees working Monday to Friday, 9 to 5 toward a 24/7 blur of work and personal activity; from computers on a local area network (LAN) corporate network toward multiple devices, anytime, anywhere; and from on-premises applications and file hosting toward Software-as-a-Service (SaaS) applications and cloud-based file hosting.

With the onset of the pandemic in 2020, the world of work has changed for good. Working from home or remotely, a variety of video...

MDM

When discussing MDM, we need to look back in time to understand its origin and some of its limitations. Back in June 2002, the non-profit organization Open Mobile Alliance (OMA) was formed. OMA was merged with the Internet Protocol Smart Objects (IPSO) Alliance and rebranded to OMA SpecWorks (for more information, visit https://packt.link/LPlLG). The OMA Device Management (OMA DM) specification was originally designed for the management of mobile devices such as mobile phones, tablets, and personal digital assistants (PDAs). It was intended to provision and configure devices and enable software updates and fault management. There is a fixed set of OMA-DM protocol commands all vendors support. Currently, Windows 11 22H2 and higher supports MDM protocol version 14.0 (for more information, visit https://packt.link/raIgs).

MDM configuration objects are stored in a so-called OMA Uniform Resource Identifier (OMA URI) (for more information, visit https://packt.link/4VuZ4). You will...

Changes to GPOs in Windows 10/11

Besides the major changes to MDM management, there are also changes to the GPO processing of Windows 10/11, which were first introduced with Windows 10 and will be covered now. These changes begin with GPOs only applicable to certain stock-keeping units (SKUs), known issues when upgrading your central policy definition store, and known issues when editing new GPOs, including GPPs with the old Group Policy Management Console (GPMC).

Enterprise- and Education-only GPOs

There have been policies that apply only to Windows 10/11, but for the first time ever in Windows history, there are also now GPOs, since Windows 10, that apply to certain SKUs only. Several GPOs for customizing Windows 10/11 apply only to Windows 10/11 Enterprise and Education SKUs. At the time of writing this book, the following GPOs have such a restriction:

Configure Spotlight on the lock screen
Turn off all Windows Spotlight features
Turn off Microsoft consumer...

Servicing and patching

When we talk about changes to the way to service (or patch) Windows, it’s important to first understand how things worked with Windows 7 and Windows 8.1. Each month, Microsoft released somewhere between 1 and 20 individual fixes for each one: some security updates, and some non-security updates. Most of these patches were General Distribution Release (GDR), meaning available on Windows Update (WU), WSUS, and Windows Update Catalog. Some patches were released under Limited Distribution Release (LDR) (also formerly known as Quick Fix Engineering (QFE)). LDR packages contain other fixes that have not undergone such extensive testing and resolve issues that only a fraction of the millions of Windows users might ever encounter. These LDR patches need to be downloaded on separate KB pages or sometimes requested from Microsoft services.

Most organizations deploy security fixes right away. But the non-security fixes sometimes aren’t deployed at all,...

Summary

In this chapter, you learned about the new MDM capabilities and changes in GPO processing of Windows 10/11. In the servicing and update part, we discussed the different update delivery solutions and gave recommendations for building servicing rings to keep up with the fast Windows 10/11 release cadence. With the options presented, you should now be able to set all the necessary settings for successful and smooth patching, planning release rings, and optimizing patch traffic regardless of whether you are still on-prem or already modern with MDM/Azure AD. Please use, if possible, the presented possibilities for testing preview builds to be best prepared for new Windows versions.

In the next chapter, we will have a closer look at protecting enterprise data in bring your own device (BYOD) scenarios.

The rest of the chapter is locked

You have been reading a chapter from

Windows 11 for Enterprise Administrators - Second Edition

Published in: Oct 2023Publisher: PacktISBN-13: 9781804618592

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at €14.99/month. Cancel anytime

Authors (5)

Manuel Singer

Manuel Singer works as a Senior Premier Field Engineer for Windows Client at Microsoft and is based in Germany. He has more than 10 years of experience in system management and deployment using Microsoft technologies. He specializes in client enterprise design, deployment, performance, reliability, and Microsoft devices. Manuel works with local and international top customers from the private and public sector to provide professional technical and technological support.
Read more about Manuel Singer

Jeff Stokes

Jeff Stokes is a Windows / Microsoft Engineer currently employed at Microsoft. He specializes in Operating System Health, Reliability, and Performance. He is skilled in Windows Deployment with MDT (Microsoft Deployment Toolkit) and has exceptional skills in VDI (Virtual Desktop) and performance analysis. He is an active writer and blogger and loves technology.
Read more about Jeff Stokes

Steve Miles

Steve Miles is a Microsoft security and Azure/hybrid MVP and MCT with over 20 years of experience in security, networking, storage, end user computing, and cloud solutions. His current focus is on securing, protecting, and managing identities, Windows clients, and Windows server workloads in hybrid and multi-cloud platform environments. His first Microsoft certification was on Windows NT and he is an MCP, MCITP, MCSA, and MCSE for Windows and many other Microsoft products. He also holds multiple Microsoft Fundamentals, Associate, Expert, and Specialty certifications in Azure security, identity, network, M365, and D365. He also holds multiple security, networking vendor, and other public cloud provider certifications.
Read more about Steve Miles

Thomas Lee

Thomas Lee is a consultant/trainer/writer based in the UK and has been in the IT business since the late 1960s. After graduating from Carnegie Mellon University, Thomas joined ComShare where he was a systems programmer building the Commander II time-sharing operating system, a forerunner of today's cloud computing paradigm. In the mid-1970s, he moved to ICL to work on the VME/K operating system. After a sabbatical in 1980/81, he joined Accenture, leaving in 1988 to run his own consulting and training business, which is still active today. Thomas holds numerous Microsoft certifications, including MCSE (one of the first in the world) and later versions, MCT (25 years), and was awarded Microsoft's MVP award 17 times.
Read more about Thomas Lee

Richard Diver

Richard Diver is a senior technical business strategy manager for the Microsoft Security Solutions group, focused on developing security partners. Based in Chicago, Richard works with advanced security and compliance partners to help them build solutions across the entire Microsoft platform, including Microsoft Sentinel, Microsoft Defender, Microsoft 365 security solutions, and many more. Prior to Microsoft, Richard worked in multiple industries and for several Microsoft partners to architect and implement cloud security solutions for a wide variety of customers around the world. Any spare time he gets is usually spent with his family.
Read more about Richard Diver

Personalised recommendations for you

Based on your interests and search pattern

Designing and Implementing Microsoft Azure Networking Solutions

Designing and Implementing Microsoft Azure Networking Solutions Exam Ref AZ-700 is an all-encompassing guide to the AZ-700 exam and contains all the information you need to succeed in the world of virtual networking with Azure. With this book, you will be fully prepared for the exam and the world of cloud networking.

BookAug 2023524 pages

Microsoft 365 Security, Compliance, and Identity Administration

The Microsoft 365 Security, Compliance, and Identity Administration is a comprehensive guide that helps you employ Microsoft 365's robust suite of features and empowers you to optimize your administrative tasks.

BookAug 2023630 pages

Zero Trust Overview and Playbook Introduction

Get started on Zero Trust with this step-by-step playbook and learn everything you need to know for a successful Zero Trust journey with tailored guidance for every role, covering strategy, operations, architecture, implementation, and measuring success. This book will become an indispensable reference for everyone in your organization.

BookOct 2023240 pages

The Self-Taught Cloud Computing Engineer

This self-study book helps you master multiple clouds, including AWS, Azure, and GCP, and serves as a roadmap to becoming a certified cloud computing expert. The book will guide you to develop a professional cloud career by helping you build a broad cloud knowledge base, developing hands-on cloud computing skills, and getting cloud certified.

BookSep 2023472 pages

Technology Operating Models for Cloud and Edge

This book will help you build and create ownership of a technology operating model, as well as connect your leadership with engineering and operations, keeping your internal and external customers in mind. It provides practical tips on why, where, and how to make the cloud and edge platform paradigm sing for you, your team, and your organization.

BookAug 2023228 pages

Azure Architecture Explained

Azure is the preferred platform to build mission-critical and secure apps. This book provides comprehensive coverage of essential Azure products, services, and solutions vital for every solution architect's success. Elevate your knowledge and master the critical components of Azure to excel in your role with Azure Architecture Explained.

BookSep 2023446 pages

Pentesting Active Directory and Windows-based Infrastructure

This practical guide helps you explore the pentesting of Microsoft infrastructure in detail, and enhances your offensive skillset by showing you the different ways to perform security assessment. This book will help blue teamers and IT engineers get up to speed with possible security issues they may encounter in their Windows environments.

BookNov 2023360 pages

Practical Ansible

In Practical Ansible, you'll work with the latest release of Ansible and learn to solve complex issues quickly with the help of task-oriented scenarios. You'll start by installing and configuring Ansible to automate monotonous and repetitive IT tasks and get to grips with concepts such as playbooks, inventories, plugins, collections, and network modules.

BookSep 2023420 pages

Windows 11 for Enterprise Administrators

Microsoft’s launch of Windows 11 is a step toward satisfying the enterprise administrator’s needs for better management and enhanced user experience customization. This book provides the enterprise administrator with the knowledge needed to fully utilize the advanced feature set of Windows 11 Enterprise.

BookOct 2023286 pages

The Linux DevOps Handbook

This book is for software and IT professionals seeking knowledge on Linux systems and DevOps practices. This book will provide you with guidance and tools to learn and gain proficiency in managing Linux-based infrastructures and knowledge of DevOps.

BookNov 2023428 pages2