I was recently working on assignment to get the audit logs for list of SharePoint online sites with specific audit activities such as PageViewed, FileAccessed, FileDownloaded,FileDeleted (This can be expanded further based on the needs) and email the data at regular intervals. For list of audited activities in office 365, https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#audited-activities For list of page and file activities https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#file-and-page-activities If you are looking for audit logs (manual), you can do it using security and compliance center. For more information on how to do it using the security and compliance, refer https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#step-1-run-an-audit-log-search If the ask is repeated on daily/weekly/monthly, you would…
Author: Eswar Koneti
I was troubleshooting the client issue for co-management and found that the device was not hybrid Azure AD Joined. Hybrid Azure AD joined (if your devices are on-prem) is one of the pre-requisites for co-management. To check if the devices are hybrid Azure AD joined or not, you can open cmd and run dsregcmd /status If the device is hybrid Azure AD joined, the status for AzureAdJoined=Yes (This field is applicable for both AAD or hybrid AAD). On the problematic machine, there is no data for the dsregcmd. For more information about configuring the Hybrid Azure AD joined and troubleshooting,…
In Microsoft Endpoint Configuration Manager, To monitor infrastructure and operations, we use the Monitoring workspace in the Configuration Manager console. One of the common ask in many forums is that how to find who created or modified or deployed certain tasks to users or devices that caused an issue. when someone deploys something, they would not know it would cause some outage or impact the end-user experience. When such things happen, you always in search of identifying who did that?. In this blog post, we will see how to find who deployed or created an assignment for the software update…
Technet Gallery has been there for almost 15 years for community to share scripts, files, utilities, tools etc for Microsoft Products. With the retirement/closure of Technet Gallery, there are large number of scripts/reports that I have uploaded to Technet for my blog and now am receiving the feedback from the blog readers that they cannot download the files. When you visit any of my blog post and find a link to Technet for sample download, you will be redirected to https://docs.microsoft.com/en-us/samples/browse/?redirectedfrom=TechNet-Gallery which does not help. In this blog post, we will see, how to download the samples from Technet Gallery…
Co-management enables you to concurrently manage Windows 10 devices by using both Configuration Manager and Microsoft Intune. For more information about Co-management, benefits, pre-requisites, licensing, read https://docs.microsoft.com/en-us/mem/configmgr/comanage/overview When you have windows 10 devices that are Azure AD joined, enrolled to Intune, and also co-managed, these devices would appear in Configuration Manager. In this blog post, i will show you how to create a collection for Azure AD joined co-managed devices. When a device is AAD joined and co-managed ( not on-prem domain joined but only the cloud), we will have the tenantID, device ID, domain or group, and other information.…
In this blog post, we will see how to use Microsoft Intune to disable the firewall and network protection notifications that pop-up on windows 10 workstation. The use case could be that, if you have POS devices where you need to disable/hide all notifications. We are not disabling the firewall instead it will be notifications ONLY. To disable the firewall and network protection notifications using Microsoft Intune, we will use configuration service provider (CSP). A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. For a supported CSP’s, please refer Configuration…
This is quick blog post on how to create device collection for computers that are online and showing the green checkmark.When a configuration manager client is installed,it will have the following status code indicating the device. For more information about device client status, please refer hereHow do we create a collection for clients that are online? Collections uses WQL and following is the WQL syntax you can use to create the collection.we will use wmi class called SMS_CollectionMemberClientBaselineStatus which has the client online status information. This information comes from the client notification that uses BGB/fast channel.This collection uses sub-selected query.select…
I had provisioned a windows server 2012 R2 (Yes, it is 2012 R2) and while installing the SCEP client (System Center Endpoint Protection client installation files are picked from current branch 2010), it failed with the following error code. Setup - Cannot complete the System Center Endpoint Protection installation. An error has prevented the System Center Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x8004FF91. [8004FF91] I have tried various command line switches for SCEP client installation but all returned the same error code. The server was installed with Configuration Manager client 2010…