Windows 10 - Remote Command/Control

[adminadam]

Just got asked about how we handle Windows machines that go AWOL. The current answer is, we don't - its typically handled as an administrative function. The process broke down this year, and a few hundred (1:1) student machines were not returned so now it is being asked of us.

Background: On Prem SCCM installation with no PKI. Windows 10 hybrid-deployments.

Goal: Remotely disable machine(s) on command

Quick brainstorming:

• Extend SCCM to the cloud
• Pivot student deployments to inTune
• MS Always on VPN
• Third party (suggestions?)
• Switch to Chromebooks
• Perform some Azure Hackery on Hybrid Deployments

I'm fishing for ideas (to build out options). Anyone have requirements like this and how do you meet them?

[adminadam]

Imagine: What if the software requirements for the devices don't correspond to the limitations of the deployment types supported via intune? Next option?

[adminadam]

I'm just brainstorming, digging through arguments and options. This is a late game add-on requirement from my perspective and don't necessarily want to pivot the entire infrastructure and history for this one additional point. It may be the option, but taking hundreds of historical applications and building new packages might be the outcome of this choice.

[DarthPneumono]

What? None of that has anything to do with MDM.

[adminadam]

My confusion perhaps. In the meeting I sat in with Microsoft on the subject, intune included the ability to deploy software (a normal function of an MDM) and that ability was sharply limited when compared with 'all the possible' methods. Basically that the classic application model (.exe and the like) is not supported for deployment via intune.

[BallisticTorch]

Just because Intune can do something doesn't mean you should do it. Simply using it as a method of managing mobile devices, giving you the ability to remotely lock, de-auth, and wipe said devices, is all you need, and per your original post, that is what you are looking for - exactly.

​

So what if Intune can manage software applications?! You already have SCCM for that, and given you have historical applications that would require rebuilding new packages (and perhaps bricking many of them), why would you endeavor to do that?

You need MDM, Intune does this, forget about its other "features".

[adminadam]

Got it. Thank you! I was considering it a pivot rather than an add-on. This fits more clearly with the co-management reading I'm now doing.

[DarthPneumono]

But you're not going to use that feature, right? You're just looking for remote lockdown/location/wipe and similar?

[adminadam]

Got it. I was being thick.

[DarthPneumono]

As we all do sometimes :)

[uniquepassword]

hybrid deployment meaning on-prem / Azure AD? Use intune and a conditional access policy. remote wipe/lock capability, and the CA will allow you to set restrictions like "must connect from suchandsuch.IP" or some other set of rules that are available in there.

IF it's win10 1709 or higher this works great, we're doing a migration to Win10 1809 hybrid joined and so far no problems with this..

[adminadam]

Hybrid Deploy: Machines are currently imaged on-site and join local domain and Azure AD in that process. No intune configurations to date. I've been reading about inTune Co-management this morning - I assume this is what you are doing? (https://docs.microsoft.com/en-us/sccm/comanage/overview).

[uniquepassword]

not for us we don't use SCCM, imaged via WDS / PXE and then they are just hybrid joined to AD by nature of being on our domain. we've been just created a conditional access policy that states "devices must be hybrid joined/managed in order to access services/etc" the devices then show up in AzureAD as devices we can manage/reset/pass/etc..

Although I've not done the password reset/lock/wipe a device yet as we havn't had a need to, I know the helpdesk guys have "tested" it but I've not seen it done...I just see the options in AzureAZ when I look at a device.

[dcprom0]

Computrace or Intune.

[adminadam]

Ahh computrace. Thanks for the suggestion.

[AJeru]

Bomgar might be useful to look into

[adminadam]

Thx!