topic Re: DEM Teams - MFA - login every time in Dynamic Environment Manager

DEM Teams - MFA - login every time

harlee — Thu, 29 Oct 2020 01:38:40 GMT

We have been using the per-machine installer version of Teams and DEM to capture the settings. However we have never successfully been able to capture the user logins so the user has to log in each time they open a new non-persistent session.

For Teams we use Duo MFA push to log in.

If we capture the whole profile the settings persist so somewhere we are missing a setting to capture in DEM.

Any suggestions would be welcome here as I am at my wits end with this program.

Current DEM settings are as follows ( we do not use DirectFlex):

[IncludeFolderTrees]

<LocalAppData>\Microsoft\IdentityCache

<LocalAppData>\Microsoft\Teams

<LocalAppData>\Microsoft\TeamsMeetingAddin

<LocalAppData>\Microsoft\TeamsPresenceAddin

<LocalAppData>\SquirrelTemp

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

<AppData>\Microsoft\Teams

<AppData>\Microsoft Teams

<AppData>\Teams

[IncludeRegistryTrees]

HKCU\Software\Microsoft\Office\Teams

[ExcludeFolderTrees]

<AppData>\Teams\logs

<AppData>\Microsoft Teams\logs

<AppData>\Microsoft\Teams\media-stack

<AppData>\Microsoft\Teams\Service Worker

<AppData>\Microsoft\Teams\Application Cache

<AppData>\Microsoft\Teams\Cache

<AppData>\Microsoft\Teams\tmp

<AppData>\Microsoft\Teams\meeting-addin\Cache

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\Temp

[ExcludeFiles]

<AppData>\Microsoft\Teams\*.txt

<AppData>\Microsoft\Teams\lockfile

<LocalAppData>\SquirrelTemp\SquirrelSetup.log

Re: DEM Teams - MFA - login every time

ijdemes — Tue, 03 Nov 2020 11:36:17 GMT

Hi harlee,

I suspect the following marked (red) item to be the reason.

[ExcludeFolderTrees]

<AppData>\Teams\logs

<AppData>\Microsoft Teams\logs

<AppData>\Microsoft\Teams\media-stack

<AppData>\Microsoft\Teams\Service Worker

<AppData>\Microsoft\Teams\Application Cache

<AppData>\Microsoft\Teams\Cache

<AppData>\Microsoft\Teams\tmp

<AppData>\Microsoft\Teams\meeting-addin\Cache

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState

<LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\Temp

Can you put a hashtag (#) at beginning of that line to exclude this (line turns green) and double check using a clean profile? Don't forget to save the config file before checking .

#<AppData>\Microsoft\Teams\Cache

Re: DEM Teams - MFA - login every time

harlee — Wed, 04 Nov 2020 03:19:43 GMT

Thank you ijdemes this seems to have fixed the issue now.

Re: DEM Teams - MFA - login every time

RachelW — Tue, 24 Nov 2020 18:04:45 GMT

@ijdemes

So, including the Cache (<AppData>\Microsoft\Teams\Cache) folder in UEM is "required" to prevent login prompts for Teams. Is that correct?

That is such a HUGE folder to load in UEM. Does ALL of the Cache directory need to be included? Importing such a large folder in UEM will increase login times.

Re: DEM Teams - MFA - login every time

Lieven — Fri, 27 Nov 2020 21:17:33 GMT

I agree with you @RachelW , the cache folder can get really big. This is why I choose to use FSLogix in stead of DEM for saving he profile.

I use DEM only for saving some Windows settings and pushing ADMX based settings, shortcuts, drive mappings, reg keys, FTA's, Printer mappings, ... This way I keep logon time to a minimum (<30s)

Re: DEM Teams - MFA - login every time

RachelW — Tue, 01 Dec 2020 18:43:00 GMT

@Lieven ,

Wow! <30 for login times?! That would be amazing.

I am not familiar with FSLogix. How does that work? Where can I find information on it? AND it DOES work with DEM - so you can use DEM and FSLogix?

Re: DEM Teams - MFA - login every time

Lieven — Wed, 02 Dec 2020 10:07:18 GMT

I wrote a small article on FSLogix on https://www.ituda.com/microsoft-fslogix-basic-installation-and-configuration-notes/

Re: DEM Teams - MFA - login every time

RachelW — Wed, 02 Dec 2020 18:32:09 GMT

@ijdemes,

So, I included the Cache directory in my Teams Flex config file and even though I did not get prompted when Teams first launched, I did get prompted after I had been working on the desktop for a while and attempted to use Teams...??

Re: DEM Teams - MFA - login every time

harlee — Thu, 03 Dec 2020 04:59:44 GMT

Now that the logins are being captured I found another issue where the Office plugin setting does not persist across logins.

- Register Teams as the chat app for Office - this setting is unticked every time I log off and in again.

Re: DEM Teams - MFA - login every time

RachelW — Thu, 03 Dec 2020 16:27:13 GMT

@ijdemes ,

So today I was prompted for my password when Teams automatically started after logging into my Windows 10 desktop. This is NOT happening on our Windows 7 desktop.

Re: DEM Teams - MFA - login every time

RachelW — Thu, 03 Dec 2020 16:35:42 GMT

@harlee ,

"Register Teams as the chat app for Office - " What does this mean? And how do you do this?

Re: DEM Teams - MFA - login every time

harlee — Thu, 03 Dec 2020 21:09:38 GMT

@RachelW

In Teams under settings there is an option to select "Register Teams as the chat app for Office". Once you have selected this Outlook will use Teams for meetings and also display presence of users in mail threads.

Re: DEM Teams - MFA - login every time

ijdemes — Fri, 04 Dec 2020 16:07:45 GMT

Hi @RachelW ,

Sorry for the late response, but as mentioned earlier on, it's about excluding the cache location instead of including it.

As @Lieven mentioned, FSLogix is doing its work for Teams caching and stuff really well. Same goes for Outlook cache (OST) and OneDrive.

Re: DEM Teams - MFA - login every time

RachelW — Thu, 10 Dec 2020 22:03:57 GMT

@harlee

That option "Register Teams as the chat app for Office" is already set in Teams

Re: DEM Teams - MFA - login every time

RachelW — Thu, 10 Dec 2020 22:15:30 GMT

Hi @ijdemes ,

So does FSLogix get installed a server or just the images?

I must have missed that from the article you sent.

Re: DEM Teams - MFA - login every time

RachelW — Fri, 18 Dec 2020 16:53:43 GMT

Hi @Lieven ,

I am reading through the documentation you created but would you be able to tell me a couple of things:

1) Can we run FSLogix WITH DEM/UEM? I read something in the documentation on Profile Container that says it is installed and configured after stopping use of other solutions used to manage remote profiles. SO, I would assume that means UEM/DEM...? Please help me understand what this means?

2) Are we able to create the file shares on our UEM server?

Thank you.

Re: DEM Teams - MFA - login every time

Lieven — Fri, 18 Dec 2020 18:21:56 GMT

Hi @RachelW ,

You can certainly run FSLogix in combination with DEM. I use FSlogix for all profile related things and DEM for mapping printers, assigning shortcuts, setting registry keys, applying ADMX settings, ....

For FSLogix is does not matter where the file shares are located. So yes, they can be on the same server where you store the DEM folders. Just be aware to calculate the space needed. By default the FSlogix VHD files can grow up to 30 GB.

Personally I use 4 different shares:

Share 1 = Redirected folders (My documents, My Music, desktop, favorites, ...)
Share 2 = DEM share
Share 3 = FSlogix profile share
Share 4 = FSlogix Office share

I hope this helps.

Regards,

Lieven

Re: DEM Teams - MFA - login every time

RachelW — Fri, 18 Dec 2020 22:19:04 GMT

Hi @Lieven

OK so here is what I did.

1) Installed FSLogix Apps on my image
2) Created a share on my server for the FSLogix Office share
3) Setup and configured Office Container to redirect Teams (at this point) on my image
4) Disabled Teams Config in UEM

Created a snapshot and republished to my desktop. Logged in the first time to the desktop and was prompted to enter my credentials in Teams (Username was already filled in, clicked Continue and typed in pasword). Teams started ok.

Logged out of my desktop, waited a few minutes for it to delete and then logged in again. This teams did NOT autostart which we want it to. When I double clicked on the Teams icon on the desktop, I was prompted to enter my password.

So no change with Teams except now I am back to square one - Teams doesn't autostart. I am sure I missed something.

Re: DEM Teams - MFA - login every time

Lieven — Fri, 18 Dec 2020 22:59:55 GMT

@RachelW

You're almost there.

One of the important things with MS Teams in VDI environments is the way you install it. Make sure you do a "per-machine installation" of MS Teams. This can be done in the following way:

msiexec /i Teams_Windows_x64.msi /lv C:\Windows\Temp\Teams_install.log ALLUSER=1 ALLUSERS=1 /qb /norestart

To ensure MS Teams starts up automatically at logon make sure the below registry exists:

REG ADD HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v Teams /t REG_SZ /d "C:\Program Files (x86)\Microsoft\Teams\current\Teams.exe" /f

The fact that you are prompted for your password the first time you startup teams is "normal". There is a bug in teams where SSO does not seem to work. If anybody finds a solution I am interested in knowing it.

To keep the FSLogix profile container small, I am also excluding some MS Teams (and other) folders from the FSLogix profile container by using the below FSLogix redirections.xml file

<?xml version=”1.0? encoding=”UTF-8??>

<Excludes>
<Exclude Copy="0">$Recycle.Bin</Exclude>
<Exclude Copy="0">AppData\Local\Google</Exclude>
<Exclude Copy="0">AppData\Local\SquirrelTemp</Exclude>
<Exclude Copy="0">AppData\Local\OneDrive\cache</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\OneNote\16.0\cache</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Office\SolutionPackages</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Office\16.0\Lync\Tracing</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Teams\Current\Locales</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Teams\Packages\SquirrelTemp</Exclude>
<Exclude Copy="0">AppData\Local\Microsoft\Teams\current\resources\locales</Exclude>
<Exclude Copy="0">AppData\Local\Apps\2.0</Exclude>
</Excludes>

</FrxProfileFolderRedirection>

Regards,

Lieven

Re: DEM Teams - MFA - login every time

RachelW — Mon, 21 Dec 2020 16:11:45 GMT

Hi @Lieven,

1) I did in fact install Teams using that command (msiexec /i Teams_Windows_x64.msi /lv C:\Windows\Temp\Teams_install.log ALLUSER=1 ALLUSERS=1 /qb /norestart) however I did not use the /qb and /restart commands. Will that make a difference?

2) I do not have that entry in the registry of my image. I only have this one: TeamsMachineInstaller REG_EXPAND_SZ %ProgramFiles%\Teams Installer\Teams.exe --checkinstall--source=PROPLUS.

3) Where do I find the rediretions.xml file?

Thank you so much for your help!