trobertson Tracker

Re: Restrict Office Applications like Teams & Outlook to use only Work or School Accounts

trobertson — Mon, 28 Aug 2023 12:36:48 GMT

@rmcpdias, sorry I had Windows on my brain, what endpoints are you using? Windows, Mac, iOS, Android?

Re: Upload vmtools images iso to shared storage

trobertson — Sat, 26 Aug 2023 16:09:39 GMT

Which version have you deployed?

Info for 6.7 & 7

https://kb.vmware.com/s/article/2129825

Have you deployed a vSphere server in the environment yet? Once its up you can us LCM.

https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-lifecycle-manager/GUID-0399E9F5-8584-42A5-88B2-B2760E1C6C1C.html

Re: Double monitor

trobertson — Sat, 26 Aug 2023 15:43:49 GMT

Which version of Workstation Pro are you using?

Autofit Guest > Full Screen > Cycle Multiple Monitors

Here is some reference info:

https://docs.vmware.com/en/VMware-Workstation-Pro/17/com.vmware.ws.using.doc/GUID-E51CADFC-31C3-491F-92D9-C9C1D9615668.html

Depending on the version and guest you may be introducing additional limitations.

Re: Restrict Office Applications like Teams & Outlook to use only Work or School Accounts

trobertson — Sat, 26 Aug 2023 15:36:18 GMT

Rui,

Yes this is possible and like most challenges there are several ways to accomplish this depending on the environment and tools available. 1) Are you AAD, Hybrid, AD on-prem?

2) Do you want to stay in the Microsoft ecosystem or do you want to leverage functionality within Workspace ONE UEM, Access, or another thirty-party authentication platform?

There are options like GPO, CSP, etc depending on your environment and applications.

I've used this before: https://learn.microsoft.com/en-us/sharepoint/use-group-policy#allow-syncing-onedrive-accounts-for-only-specific-organizations

More info on tenant restrictions: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/tenant-restrictions-v2

Re: How to Check the Compatibility Guide for Old Version Servers

trobertson — Mon, 07 Aug 2023 20:47:47 GMT

https://kb.vmware.com/s/article/1035114

It will definitely help if you can get access to the customized images for the host.

Good luck.

Re: Troubleshooting iSCSI

trobertson — Mon, 07 Aug 2023 20:43:06 GMT

I tried to use Meraki MS425s for my ToR solution to a VxRail cluster but I continuously received "High pNic error rate detected." Switched over to Dell S5212Fs for my cluster and the problem is gone.

I understand this was working but stopped after a FW upgrade which is a total P.I.T.A. and due to the lack of visibility in the Meraki platform things are complicated to almost a trial and error approach. I just forewarn you that you may suffer additional challenges in the future and I wish you good luck. I'm eager to see if you can get this resolved.

Re: Win10 Custom Settings Profile to deploy Binary Registry Values

trobertson — Mon, 07 Aug 2023 20:30:03 GMT

Good catch, I fought a similar battle last week before realizing CSP uses different naming for data types like DWORD instead of REG_DWORD. I doublechecked the code several times before I realized the difference.

My only thoughts are "WHY???"

Re: Best Practices departing employees

trobertson — Thu, 20 Oct 2022 21:23:18 GMT

Chamac45,

I believe what you are searching for is actually supervised vs. unsupervised. I've been down this same path for the reason you stated. I purchase a majority of my iOS devices through Verizon which is setup with DEP. Other devices I've enrolled via Apple Configurator which is a little more task intensive.

I'll place a link below that helps explain the differences between supervised & unsupervised. In Workspace ONE UEM you can review a device and within the Summary/Security you can see if a device is Supervised or not.

https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/iOS_Platform/GUID-iOSFunctionalityMatrix.html

MFA using an Authenticator Apps

trobertson — Wed, 19 Oct 2022 14:52:52 GMT

I'm working to implement MFA for remote users leveraging Access with an Authenticator App

I'm good with the understanding and setup of applications and policies in Access. I'm setting up a policy for external users to authenticate with an unregistered device so for MFA I would like to request password and auth. app.

In thinking over the design I'm stuck in a chicken or the egg problem. How does the user register the auth. app. using MFA? I'll try to explain what I'm thinking.

When using an authenticator app in a policy if the user is has not previously registered an authenticator app they can choose to register one. In my mind I'm thinking if someone's password has been stolen by a bad actor and they have not previously registered an authenticator app, couldn't the actor just register their own authenticator app thereby defeating the intended MFA? If the authenticator app is not in an approval workflow or requiring its own MFA to register then doesn't this present a problem? Or am I missing something?

Re: WS1 Java Uninstall

trobertson — Thu, 09 Jun 2022 15:39:42 GMT

In the past I've used some powershell scripts I pushed out to perform uninstalls if the app was not previously managed/deployed from WS1.

Reference something like https://adamtheautomator.com/removing-old-java/ for the powershell script. I'm sure there are plenty of examples online for powershell uninstall java.

If you go the ps route you can use provisioning or app deployment to push out your commands.

It's been a while since I did this last so I'm interested to see if there are other suggestions.

Re: Workspace one Assist screen sharing show black screen

trobertson — Sun, 05 Jun 2022 15:04:31 GMT

I have seen this from time to time, I've been wondering if my firewall is causing it. We've been using another screen sharing product for years and I'd like to switch to Assist. This week, I'm going to try to get my team to use it exclusively, (I may have to turn off the other product first). Hopefully I have more to report back soon.

Re: UAG reverse proxy to sharepoint

trobertson — Fri, 03 Jun 2022 17:03:20 GMT

Are you using VMware Tunnel and configured the settings in UEM?

https://docs.vmware.com/en/Unified-Access-Gateway/3.1/com.vmware.uag-31-deploy-config.doc/GUID-8B96F385-ADE5-4502-8485-6269EE41D222.html

Here is a link to the techzone blog that walks you through the setup.

https://techzone.vmware.com/deploying-vmware-workspace-one-tunnel-workspace-one-operational-tutorial#tunnel-mode-per-app-vs-full-device-tunnel

Let me know if this is on the right path and if you've setup everything as documented but still having issues.

Re: Workspace One Policies

trobertson — Fri, 03 Jun 2022 13:11:10 GMT

For anyone new to Workspace ONE, I would recommend heading over to https://techzone.vmware.com/ as it is an excellent resource for more information.

After your familiar with policies and if you would like to see some more, I would recommend https://github.com/vmware-samples/euc-samples . UEM-Samples>Profiles> Pick-your-os.

On the github above there is also some good resources in the euc-samples/UEM-Samples/Utilities and Tools/

-In Generic there is an Excel Add-in that can assist you with importing data into excel. I personally haven't tried it but this may help you extract some of the info.

Re: Domain admins added to local Admin on Windows 10

trobertson — Fri, 27 May 2022 15:57:21 GMT

I use a Microsoft Policy CSP within a profile for this. I followed Grischa's blog post when I preformed this setup. See the link below.

https://modernmanagement.works/windows/manage-local-administrators-groups-with-csp/

Re: Using Apple Music on a Supervised Business iOS Device

trobertson — Thu, 26 May 2022 13:14:35 GMT

To supervise or not, here is a comparison:

https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/iOS_Platform/GUID-iOSFunctionalityMatrix.html

Additional info:

https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2011/UEM_Managing_Devices/GUID-AWT-ENROLLMENT-SUPERVISEDMODE.html

I will say from experience, it is a bit more work from an administrative standpoint to enable device supervision, however to me its worth in when you need to enable or clear an activation lock from a terminated employee.

Re: Using Apple Music on a Supervised Business iOS Device

trobertson — Thu, 26 May 2022 13:06:16 GMT

Supervised devices do not require an Apple ID, but you can still use one.

All my iPhones have been supervised and I continue to use a number of apps and services linked to my Apple ID. No worries, all the standard functionality remains even if the device is supervised...unless someone blacklist the apps.

Re: Workspace ONE Exchange Config

trobertson — Tue, 24 May 2022 19:43:39 GMT

Hi, I tackled this same setup when I first deployed WS1. I still use Boxer today for all iOS devices and now my users have all been migrated to O365.

I started by utilizing SEG (v2) to connect Boxer with on-prem Exchange. I have now moved to Powershell for O365. You can manage which configuration you utilize within the Boxer assignments. Both can exist at the same time, just utilize assignment groups to control who is using which assignment.

Below I've added some helpful links. Let me know if you have more specific questions.

https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2203/WS1-Secure-Email-Gateway/GUID-AWT-INTRO-SEG.html

https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/context?id=memOverview

Re: What are the high-level steps to integrate Workspace ONE with Horizon?

trobertson — Tue, 24 May 2022 19:31:11 GMT

Techzone is the best place for to spend any extra time you have to learn more about these solutions. Over the past 2 months I have been implementing additional functionality into our WS1 environment and 90% documentation for these efforts came strait out of techzone. I hope your WS1 + Horizon project succeeds and I'm looking forward expanding my WS1 footprint with Horizon in the near future.

Re: Where to download VMware converter standalone

trobertson — Tue, 24 May 2022 13:11:08 GMT

Thanks for these suggestions. As part of my archiving system I always roll my current PC into a VM when I'm ready to replace it. I typically use Workstation to perform this however it relies on the standalone. It's making me a bit nervous about keeping this practice moving forward, I'm hoping they have a solution moving forward.

Re: Does anyone have experience with Cerner CareAware, Zebra TC51-HC and Spectrlink Versity Devices?

trobertson — Tue, 24 May 2022 13:01:32 GMT

I recently purchased a Zebra TC51-HC for testing to replace our existing Symbol MC3200s. I'm expecting the TC51-HC android setup to be much easier than the Windows Rugged (CE) setup on our 32Ks. We will have a pretty vanilla setup on these which should consist of some barcode profiles and kiosk setup for our application.