Contributor
Contributor

DEM Teams - MFA - login every time

Jump to solution

We have been using the per-machine installer version of Teams and DEM to capture the settings. However we have never successfully been able to capture the user logins so the user has to log in each time they open a new non-persistent session.

For Teams we use Duo MFA push to log in.

If we capture the whole profile the settings persist so somewhere we are missing a setting to capture in DEM.

Any suggestions would be welcome here as I am at my wits end with this program.

Current DEM settings are as follows ( we do not use DirectFlex):

[IncludeFolderTrees]

<LocalAppData>\Microsoft\IdentityCache

<LocalAppData>\Microsoft\Teams

<LocalAppData>\Microsoft\TeamsMeetingAddin

<LocalAppData>\Microsoft\TeamsPresenceAddin

<LocalAppData>\SquirrelTemp

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

<AppData>\Microsoft\Teams

<AppData>\Microsoft Teams

<AppData>\Teams

[IncludeRegistryTrees]

HKCU\Software\Microsoft\Office\Teams

[ExcludeFolderTrees]

<AppData>\Teams\logs

<AppData>\Microsoft Teams\logs

<AppData>\Microsoft\Teams\media-stack

<AppData>\Microsoft\Teams\Service Worker

<AppData>\Microsoft\Teams\Application Cache

<AppData>\Microsoft\Teams\Cache

<AppData>\Microsoft\Teams\tmp

<AppData>\Microsoft\Teams\meeting-addin\Cache

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\Temp

[ExcludeFiles]

<AppData>\Microsoft\Teams\*.txt

<AppData>\Microsoft\Teams\lockfile

<LocalAppData>\SquirrelTemp\SquirrelSetup.log

0 Kudos
1 Solution

Accepted Solutions
Expert
Expert

Hi harlee​,

I suspect the following marked (red) item to be the reason.

[ExcludeFolderTrees]

<AppData>\Teams\logs

<AppData>\Microsoft Teams\logs

<AppData>\Microsoft\Teams\media-stack

<AppData>\Microsoft\Teams\Service Worker

<AppData>\Microsoft\Teams\Application Cache

<AppData>\Microsoft\Teams\Cache

<AppData>\Microsoft\Teams\tmp

<AppData>\Microsoft\Teams\meeting-addin\Cache

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\Temp

Can you put a hashtag (#) at beginning of that line to exclude this (line turns green) and double check using a clean profile? Don't forget to save the config file before checking Smiley Wink.

#<AppData>\Microsoft\Teams\Cache


\\ Ivan
---
Twitter: @ivandemes
Blog: https://www.ivandemes.com

View solution in original post

33 Replies
Expert
Expert

Hi harlee​,

I suspect the following marked (red) item to be the reason.

[ExcludeFolderTrees]

<AppData>\Teams\logs

<AppData>\Microsoft Teams\logs

<AppData>\Microsoft\Teams\media-stack

<AppData>\Microsoft\Teams\Service Worker

<AppData>\Microsoft\Teams\Application Cache

<AppData>\Microsoft\Teams\Cache

<AppData>\Microsoft\Teams\tmp

<AppData>\Microsoft\Teams\meeting-addin\Cache

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\Temp

Can you put a hashtag (#) at beginning of that line to exclude this (line turns green) and double check using a clean profile? Don't forget to save the config file before checking Smiley Wink.

#<AppData>\Microsoft\Teams\Cache


\\ Ivan
---
Twitter: @ivandemes
Blog: https://www.ivandemes.com

View solution in original post

Contributor
Contributor

Thank you ijdemes this seems to have fixed the issue now.

0 Kudos
Enthusiast
Enthusiast

@ijdemes 

So, including the Cache (<AppData>\Microsoft\Teams\Cache) folder in UEM is "required" to prevent login prompts for Teams. Is that correct?

That is such a HUGE folder to load in UEM.  Does ALL of the Cache directory need to be included?  Importing such a large folder in UEM will increase login times. 

0 Kudos
Enthusiast
Enthusiast

I agree with you @RachelW , the cache folder can get really big. This is why I choose to use FSLogix in stead of DEM for saving he profile.

I use DEM only for saving some Windows settings and pushing ADMX based settings, shortcuts, drive mappings, reg keys, FTA's, Printer mappings, ... This way I keep logon time to a minimum (<30s)

0 Kudos
Enthusiast
Enthusiast

@Lieven ,

Wow! <30 for login times?! That would be amazing.

I am not familiar with FSLogix.  How does that work? Where can I find information on it? AND it DOES work with DEM - so you can use DEM and FSLogix?

0 Kudos
Enthusiast
Enthusiast
Enthusiast
Enthusiast

@ijdemes,

So, I included the Cache directory in my Teams Flex config file and even though I did not get prompted when Teams first launched, I did get prompted after I had been working on the desktop for a while and attempted to use Teams...??

0 Kudos
Contributor
Contributor

Now that the logins are being captured I found another issue where the Office plugin setting does not persist across logins.

- Register Teams as the chat app for Office - this setting is unticked every time I log off and in again.

 

 

0 Kudos
Enthusiast
Enthusiast

@ijdemes ,

So today I was prompted for my password when Teams automatically started after logging into my Windows 10 desktop. This is NOT happening on our Windows 7 desktop.

0 Kudos
Enthusiast
Enthusiast

@harlee ,

"Register Teams as the chat app for Office - " What does this mean?  And how do you do this?

0 Kudos
Contributor
Contributor

@RachelW

In Teams under settings there is an option to select "Register Teams as the chat app for Office". Once you have selected this Outlook will use Teams for meetings and also display presence of users in mail threads.

0 Kudos
Expert
Expert

Hi @RachelW ,

 

Sorry for the late response, but as mentioned earlier on, it's about excluding the cache location instead of including it.

 

As @Lieven mentioned, FSLogix is doing its work for Teams caching and stuff really well. Same goes for Outlook cache (OST) and OneDrive.


\\ Ivan
---
Twitter: @ivandemes
Blog: https://www.ivandemes.com
0 Kudos
Enthusiast
Enthusiast

@harlee 

That option "Register Teams as the chat app for Office" is already set in Teams

0 Kudos
Enthusiast
Enthusiast

Hi @ijdemes ,

So does FSLogix get installed a server or just the images?

I must have missed that from the article you sent.

0 Kudos
Enthusiast
Enthusiast

Hi @Lieven ,

I am reading through the documentation you created but would you be able to tell me a couple of things:

1) Can we run FSLogix WITH DEM/UEM?  I read something in the documentation on Profile Container that says it is installed and configured after stopping use of other solutions used to manage remote profiles.  SO, I would assume that means UEM/DEM...? Please help me understand what this means?

2) Are we able to create the file shares on our UEM server?

Thank you.

0 Kudos
Enthusiast
Enthusiast

Hi @RachelW ,

You can certainly run FSLogix in combination with DEM. I use FSlogix for all profile related things and DEM for mapping printers, assigning shortcuts, setting registry keys, applying ADMX settings, ....

For FSLogix is does not matter where the file shares are located. So yes, they can be on the same server where you store the DEM folders. Just be aware to calculate the space needed. By default the FSlogix VHD files can grow up to 30 GB.

Personally I use 4 different shares:

  • Share 1 = Redirected folders (My documents, My Music, desktop, favorites, ...)
  • Share 2 = DEM share
  • Share 3 = FSlogix profile share
  • Share 4 = FSlogix Office share

I hope this helps.

Regards,

Lieven

0 Kudos
Enthusiast
Enthusiast

Hi @Lieven 

OK so here is what I did.

1) Installed FSLogix Apps on my image
2) Created a share on my server for the FSLogix Office share
3) Setup and configured Office Container to redirect Teams (at this point) on my image
4) Disabled Teams Config in UEM

Created a snapshot and republished to my desktop.  Logged in the first time to the desktop and was prompted to enter my credentials in Teams (Username was already filled in, clicked Continue and typed in pasword). Teams started ok.

Logged out of my desktop, waited a few minutes for it to delete and then logged in again.  This teams did NOT autostart which we want it to.  When I double clicked on the Teams icon on the desktop, I was prompted to enter my password.

So no change with Teams except now I am back to square one - Teams doesn't autostart.  I am sure I missed something.

0 Kudos
Enthusiast
Enthusiast

@RachelW 

You're almost there.

One of the important things with MS Teams in VDI environments is the way you install it. Make sure you do a "per-machine installation" of MS Teams. This can be done in the following way:

msiexec /i Teams_Windows_x64.msi /lv C:\Windows\Temp\Teams_install.log ALLUSER=1 ALLUSERS=1 /qb /norestart

To ensure MS Teams starts up automatically at logon make sure the below registry exists:

REG ADD HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v Teams /t REG_SZ /d "C:\Program Files (x86)\Microsoft\Teams\current\Teams.exe" /f

The fact that you are prompted for your password the first time you startup teams is "normal". There is a bug in teams where SSO does not seem to work. If anybody finds a solution I am interested in knowing it.

To keep the FSLogix profile container small, I am also excluding some MS Teams (and other) folders from the FSLogix profile container by using the below FSLogix redirections.xml file

<?xml version=”1.0? encoding=”UTF-8??>

<FrxProfileFolderRedirection ExcludeCommonFolders=”###VALUE###”>

<Excludes>
<Exclude Copy="0">$Recycle.Bin</Exclude>
<Exclude Copy="0">AppData\Local\Google</Exclude>
<Exclude Copy="0">AppData\Local\SquirrelTemp</Exclude>
<Exclude Copy="0">AppData\Local\OneDrive\cache</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\OneNote\16.0\cache</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Office\SolutionPackages</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Office\16.0\Lync\Tracing</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Teams\Current\Locales</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Teams\Packages\SquirrelTemp</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Teams\current\resources\locales</Exclude>
<Exclude Copy="0">AppData\Local\Apps\2.0</Exclude>
</Excludes>

</FrxProfileFolderRedirection>

 

Regards,

Lieven

0 Kudos
Enthusiast
Enthusiast

Hi @Lieven,

1) I did in fact install Teams using that command (msiexec /i Teams_Windows_x64.msi /lv C:\Windows\Temp\Teams_install.log ALLUSER=1 ALLUSERS=1 /qb /norestart)  however I did not use the /qb and /restart commands.  Will that make a difference?

2) I  do not have that entry in the registry of my image.  I only have this one: TeamsMachineInstaller  REG_EXPAND_SZ %ProgramFiles%\Teams Installer\Teams.exe --checkinstall--source=PROPLUS.

3) Where do I find the rediretions.xml file?

Thank you so much for your help!

0 Kudos