The Deployment Sessions-003: How to Connect Configuration Manager 2012 SP1 to Windows Intune to Enable Mobile Device Management Including Windows RT devices

  • Article

System Center Configuration Manager 2012 SP1 can be connected to Windows Intune to enable mobile device management of Windows RT, Windows Phone, iOS and Android devices. This is a great solution because these types of devices expect an “always on” connection to the Internet and Windows Intune provides that “always on” management layer since it’s a public cloud service. In this video I connect Windows Intune to Configuration Manager and enrol a Windows RT device with our Windows Intune account. Doing so provides a company portal enabling our users to connect their own devices and download software prescribed by the IT department. Skip to 12 minutes if you just want to see the Windows RT experience.

How to Connect Configuration Manager 2012 SP1 to Windows Intune to Enable Mobile Device Management Including Windows RT devices

This is a tricky area, so here’s some instructions to help you along

I can’t stress enough how important it is to do things in this order, if you don’t you’ll end up having to wait up to 72 hours for things to work through the various components to undo changes (which I did although only 25 minutes but it depends on the size of your directory).

 

First thing’s first you will need to download System Center Configuration Manager 2012 SP1 and have Windows Server 2012 to run it on, then setup your lab, once you have you can follow this video and these instructions…

  1. Prepare Your Active Directory
    1. Make sure users have publically accessible UPN in AD DS
    2. Change the UPN for users who will use Windows Intune to match the public DNS
  2. Setup the Windows Intune Subscription in Configuration Manager 2012 SP1
    1. In the Administration work space select Windows Intune Subscriptions and then Create Windows Intune Subscription from the ribbon.
    2. Signup for a new Intune trial account
    3. Wait for the email
    4. Select the types of devices to manage – be sure to include Windows RT
    5. Enter a collection that has the users in that can enrol devices – I use All users and alter this later
    6. Provide the certificate used to sign LOB apps
    7. Enter Sideload keys – these are required for Windows RT devices
  3. Add records to Public DNS
      1. Go to account.manage.microsoft.com
      2. Select Domains from the left hand side
      3. Add a domain that you own the for verification add the TXT record to your public DNS to prove ownership Note this can take a while
      4. Create public DNS Alias to point EnterpriseEnrollment.<company domain name>.<tld> to manage.microsoft.com – this will allow users to enrol devices with their email address
  4. Deploy DirSync
    1. Prepare for DirSync, build a Windows Server 2012 server with the .Net 3.5 feature
    2. Download and run the deployment readiness tool
    3. Prepare Intune for DirSync
      1. Go to account.manage.microsoft.com
      2. Go to Users > Active Directory Synchronization Setup
      3. Download and install DirSync
      4. Setup Synchronization
      5. Check Synchronization by making sure users now appear in the Users view at account.manage.microsoft.com
      6. Enable users for Synchronization
      7. Enable users for Windows Intune      
  5. Enable Windows Intune for the User you want to allow to enrol in Windows Intune
    1. Ensure the users password has been changed – users cannot enrol devices using the default password they are issued upon account creation
  6. Add the Windows Intune Connector Site System Role
  7. On the RT device go to Company Apps
    1. Log in with the users email address and password
    2. Install the portal
    3. Start the portal
    4. Sign into the Company Portal App