Thursday, November 9, 2023

Improve experience with Quick assist Non Administrator mode

Many customers intend to use third-party remote assistance tools for their day-to-day support needs, while some opt for Teams as their remote support tool. In my experience, using the Quick Assist tool has proven to be much more beneficial, and I have personally experienced its advantages.

However, when Administrator mode is not available, I've observed a decrease in the quality of the experience. To address this issue, I've implemented some strategies to avoid suboptimal experiences.

Before that, I recommend using the shortcut for Quick Assist, which is Ctrl + Windows key + Q. It's much easier to guide end users by asking them to press these keys.

Option 01

Quick Assist is my preferred application for remotely resolving technical issues. It also allows me to elevate my privileges and run as an administrator for hardware and software installation and configuration. The following steps outline the process:

Launch the Command Prompt (CMD) on the end user's computer.

Enter the following command:

runas /user:domain\administrator cmd

Replace "domain" with your organization's domain.

Replace "administrator" with any valid administrator login.

If a domain is not available, use the following command in CMD:

runas /user:local_user cmd

Enter the administrator password when prompted.

Once you've successfully launched CMD in administrator mode, you can perform various tasks, such as:

Installing software using a command like

x:\MicrosoftEdgeSetup.exe (for software installation, where x is any drive letter from your computer).
appwiz.cpl for installing or uninstalling program.
Services.msc (Run or Stop a service)
devmgmt.msc (Device Manager, to install/uninstall or upgrade the device driver)
diskmgmt.msc (Disk Management)
compmgmt.msc (Computer Management)
regedit (Registry Editor)

Option 02

When opening an elevated privilege application, a pause screen is typically displayed, and the end user is prompted to enter the Admin password. However, in cases where the user is not accustomed to such a procedure and you, as the administrator, want to ensure a secure experience, this can be challenging.

This is how I've developed a workaround to address this issue.

Login to Intune Admin Center - https://intune.microsoft.com/
Go to Devices and select Configuration profiles
Then Create a Policy

Platform - Windows 10 and later
Profile type - Settings Catalog

Provide the name and click next
In the Configuration Setting Tab, select +Add settings and search for "User Account Control"
Then Select Local Policies Security Options
after that select these two polices

User Account Control Behavior Of The Elevation Prompt For Standard Users
User Account Control Switch To The Secure Desktop When Prompting For Elevation

8. Set below policy as below

User Account Control Switch To The Secure Desktop When Prompting For Elevation - Disabled
User Account Control Behavior Of The Elevation Prompt For Standard Users - prompt for credentials

9. Then Select Next and in the Assignment page add the group. after than click next and create the policy.

After option 02; Quick assist remote experience

A password prompt appears on the remote system, allowing the admin to type

I was wondering how to find the GUID for an application so that I can create an uninstall command for an application that is not available for uninstallation through on the internet.

To extract the GUID for an application, you can follow these steps:

Install the application on a PC.
Open a Windows PowerShell: You can do this by searching for "PowerShell" in the Windows search bar
Run the following command:

Get-CimInstance -ClassName Win32_Product | Sort-Object -Property Name | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

This command will list all installed programs along with their identifying numbers (GUIDs). Look for the application you want to uninstall, and note down its identifying number (GUID).

Now you have the GUID for the application, which you can use to create an uninstall command.

Example: msiexec /x "{5B0C7A0B-0B5A-4552-8E06-0CC630F2C50A}" /qn

The First Step to Passwordless with Temporary Access Pass

Passwordless authentication options, like FIDO2 and passwordless phone sign-in via the Microsoft Authenticator app, provide users with a secure way to log in without using a traditional password. Users have two primary avenues to initiate these Passwordless methods:

Leveraging existing Microsoft Entra multifactor authentication methods.
Employing a Temporary Access Pass (TAP)

A Temporary Access Pass is a time-bound passcode that allows users to sign in with this temporary code to onboard to passwordless authentication methods, such as phone sign-in with an authentication app or FIDO2 with Windows Hello for Business.

Enable Temporary Access Pass (TAP)

6. Then Enable and select Configure

Create a Temporary Access Pass for User

1. Navigate to user account on the Entra Portal - Identity > Users

3. select Authentication methods

Share the Details with User.

Sign-in experience on the End-user

From here, you can add your authentication method, such as FIDO2.

Admin Portal experience

In the Admin center, we can see the details of the created Temporary Access Pass, and if it has expired, we can also see that.

Token protection in Microsoft Entra Conditional Access

Token safeguarding, also known as token binding within the industry, aims to diminish the vulnerability to attacks involving token theft. It achieves this by guaranteeing that a token remains functional exclusively on the designated device. In instances where a malicious actor manages to pilfer a token through tactics like hijacking or replay, they gain the ability to impersonate their target until the token's expiration or revocation. Although token theft is perceived as a relatively infrequent occurrence, its potential consequences can be substantial.

Token protection establishes a cryptographically robust connection between the token and the device (referred to as the client secret) for which it was issued. In the absence of the client secret, the tethered token becomes ineffectual.

Requirements

This preview supports the following configurations for access to resources with Token Protection conditional access policies applied:

Windows 10 or newer devices that are Azure AD joined, hybrid Azure AD joined, or Azure AD registered.
OneDrive sync client version 22.217 or later
Teams native client version 1.6.00.1331 or later
Power BI desktop version 2.117.841.0 (May 2023) or later
Visual Studio 2022 or later when using the 'Windows authentication broker' Sign-in option
Office Perpetual clients aren't supported

Known limitations

External users (Azure AD B2B) aren't supported and shouldn't be included in your Conditional Access policy.
The following applications don't support signing in using protected token flows and users are blocked when accessing Exchange and SharePoint:
PowerShell modules accessing Exchange, SharePoint, or Microsoft Graph scopes that are served by Exchange or SharePoint
PowerQuery extension for Excel
Extensions to Visual Studio Code which access Exchange or SharePoint
The new Teams 2.1 preview client gets blocked after sign out due to a bug. This bug should be fixed in a future service update.
The following Windows client devices aren't supported:
Windows Server
Surface Hub
Windows-based Microsoft Teams Rooms (MTR) systems

Licensing requirements

Using this feature requires Azure AD Premium P2 licenses.

Create the Conditional Access Policy

Token Theft Simulation

Numerous methods are at your disposal for testing this scenario, and I will be utilizing the tokentactics tool.

after downloading extract the File and run below commend in powershell.

#set the location - i have save it on the C drive

Set-Location C:\TokenPhish

#Set execytion to unrestricted

Set-ExecutionPolicy Unrestricted

#import the Token Tactics Modules

Import-Module .\TokenTactics.psd1

#initiate the Tocken phising

Get-AzureToken -Client Outlook

Share this URL with and the code and ask to sign it.

Select the user

Sign it is blocked

Check from the sign in logs

Microsoft Entra Conditional Access with Strictly Enforce Location Policies

A new feature in conditional access allows for the strict enforcement of location policies using continuous access evaluation (CAE). This enables the quick invalidation of tokens that violate your IP-based location policies. When a client's access to a resource is denied because CAE's strict location policies are activated, the client will experience a blockage.

Adding Sponsors for Guest user

Introducing the sponsor feature enables you to designate a responsible individual or group for each guest user. This functionality allows for the tracking of the inviting party and enhances accountability.

This article delivers an overview of the sponsor feature and offers guidance on its application within B2B scenarios.

The Sponsors field within the user object pertains to the individual or group responsible for extending the invitation to the guest user within the organization. This field serves as a means to identify the inviting party and enhance accountability. It's important to note that being a sponsor does not confer administrative privileges upon the sponsor user or group. Instead, it can be employed for approval processes in Entitlement Management.

When extending an invitation to a guest user, you automatically assume the role of the sponsor for that guest user, unless you explicitly designate another user as the sponsor during the invitation process. Your name will be automatically added to the Sponsors field within the user object. Additionally, it's possible to assign up to 5 sponsors to a single guest user.

Exchange hybrid "writeback" with Cloud Sync (Cloud to On-prem Sync)

An Exchange hybrid deployment is a way to extend the feature-rich experience and administrative control of an on-premises Microsoft Exchange organization to the cloud. It provides a seamless look and feel of a single Exchange organization between an on-premises Exchange organization and Exchange Online.

With this new feature enabled, we can "write back" Exchange Online attribute to on-premises AD environment.

Introducing Azure AD Connect Cloud Sync, a cutting-edge solution by Microsoft designed to cater to your hybrid identity needs for seamless synchronization of users, groups, and contacts to Azure AD. This innovative offering utilizes the Azure AD cloud provisioning agent, presenting a departure from the traditional Azure AD Connect application.

All you need to know about Remote Help with MS Intune

Prerequisites

Intune subscription
Remote Help add on license or an Intune Suite license for all IT support workers (helpers) and users (sharers)
Windows 10/11
The Remote Help app for Windows.(https://aka.ms/downloadremotehelp)

Network Requirement

Remote Help communicates over port 443 (https) and connects to the Remote Assistance Service at https://remoteassistance.support.services.microsoft.com by using the Remote Desktop Protocol (RDP). The traffic is encrypted with TLS 1.2.

Both the helper and sharer must be able to reach these endpoints over port 443:

Domain/Name	Description
*.aria.microsoft.com	Used for accessibility features within the app
*.events.data.microsoft.com	Microsoft Telemetry Service
*.monitor.azure.com	Required for telemetry and remote service initialization
*.support.services.microsoft.com	Primary endpoint used for the Remote Help application
*.trouter.skype.com	Used for Azure Communication Service for chat and connection between parties
*.aadcdn.msauth.net	Required for logging in to the application Microsoft Azure Active Directory (Azure AD)
*.aadcdn.msftauth.net	Required for logging in to the application Azure AD
*.edge.skype.com	Used for Azure Communication Service for chat and connection between parties
*.graph.microsoft.com	Used for connecting to the Microsoft Graph service
*.login.microsoftonline.com	Required for Microsoft sign in service. Might not be available in preview in all markets or for all localizations
*.remoteassistanceprodacs.communication.azure.com	Used for Azure Communication Service for chat and connection between parties
Allowlist for Microsoft Edge endpoints	The app uses Microsoft Edge WebView2 browser control. This article identifies the domain URLs that you need to add to the allowlist to ensure communications through firewalls and other security mechanisms

Check for Licensing

From the Intune portal you can check the licensing.

Access the Intune portal.
Navigate to the Endpoint portal.
Proceed to the Tenant Administration section.
Select "Intune Add-ons" to check the licensing.

from here you can activate your trail.

Integrate Intune - Remote Help

Access the Endpoint portal.
Navigate to the Tenant Administration section.
Choose "Remote Help" from the available options.
Click on "Settings" and select "Configure.

Following Setting need to set

Enable Remote Help: Enable

Allowed Remote help to unenrolled Devices : Allowed

Disable Chat : No

RBAC Permissions for Intune Remote Help

Access the Endpoint portal.
Navigate to the Tenant Administration section.
Choose "Roles" from the available options.

You can assign the "Help Desk Operator" or you can create a new Role. Select Create button to create new role. fill the below details

Name : Provide a Name
In the permission select Remote help and select necessary permission

Elevation - Elevation allows the helper to enter UAC credentials when prompted on the sharer’s device when remote help is enabled. Enabling elevation also allows the helper to view and control the sharer’s device when the sharer grants the helper access.
View Screen - View screen allows the helper to view the sharer’s device when Remote Help is enabled for all platforms we support.
Take Full Control - For Windows and Android devices, take full control allows the helper to view and control the sharer’s device when Remote Help is enabled.

Select next & Create.

After that Open the Role base profile previously created and go to assignment. Fill the following

Select Assign and provide a name
Admin Group - Add the admin group or helper group (Support team Group)
Scope Group - you can add all users, All device or specific halpee group.

Select Next and Create.

Deploy Remote help app though Intune

Frist you need to download below two setup

Remote app for windows - (https://aka.ms/downloadremotehelp)
Microsoft Win32 Content Prep Tool - https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool

Open the app Microsoft-Win32-Content-Prep-Tool and open the IntuneWinAppUtil application.

specify the source folder of the Remote app for windows location
Specify the setup file - Example - remotehelpinstaller.exe
Specify the output folder to export the intunewin file
Catalog Select - No

exported location you ca see that intunewin has been created

then go to Endpoint admin portal > Select app > windows Apps and click Add icon. fill below information to create the app in intune

App Type : Windows app (Win32) and select
Click Select App package and brouse the intunewin file we created previously
file the app information as required & click next (publisher required to fill

in the Program fill below information

Install command - remotehelpinstaller.exe /quiet acceptTerms=1
Uninstall command - remotehelpinstaller.exe /uninstall /quiet acceptTerms=1

To opt out of automatic updates, specify enableAutoUpdates=0 as part of the install command remotehelpinstaller.exe /quiet acceptTerms=1 enableAutoUpdates=0

Requirement tabs fill below

Operating system architecture - 32 bit & 64 bit
Minimum operating system - Windows 10 1607

and select next

Detection Rules tab fill below information

Rules format - Manually configure detection rules and click +add
Rule type - select File
Path, specify C:\Program Files\Remote Help
File or folder, specify RemoteHelp.exe
Detection method, select String (version)
Operator, select Greater than or equal to
Value, specify the version of Remote Help you are deploying. For example, 10.0.22467.1000
Leave Associated with a 32-bit app on 64-bit clients set to No

Finished the wizard (Assignment tab Assign to deployment group.)

Setting up Conditional Access for Remote Help

Conditional Access for Remote help still in Preview. We need to enable it before we create the polices

Install-Module -Name AzureADPreview
Connect-AzureAD
New-AzureADServicePrincipal -AppId 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2

Create policy

Access the Endpoint portal.
Navigate to the Endpoint security section.
Select Conditional Access
then select Policy and Create New policy

Initiate a remote help session

Access the Endpoint portal.
Navigate to the Device section.
Windows devices & open the Manage PPC

Supported features and scenarios

The following table shows the features and scenarios supported by each remote assistance option. A check mark (✅) indicates that the feature or scenario is supported, and a cross mark (❌) indicates that it's not supported.

System-preferred multifactor authentication Method

System-preferred multifactor authentication (MFA) is a security feature that prompts users to sign in using the most secure method they have registered. This can help to improve sign-in security and discourage the use of less secure methods, such as SMS.

For example, if a user has registered both SMS and Microsoft Authenticator push notifications as MFA methods, system-preferred MFA will prompt them to sign in using the push notification method. The user can still choose to sign in using another method, but they will be first prompted to try the most secure method they have registered.

If you are an administrator, I encourage you to consider enabling system-preferred MFA in your organization. This is a simple way to improve the security of your sign-in process and protect your users' data.

Enable system-preferred MFA in the Entra ID portal

By default, system-preferred MFA is Microsoft managed and disabled for all users.

In the Azure portal, click Security > Authentication methods > Settings.
For System-preferred multifactor authentication, choose whether to explicitly enable or disable the feature, and include or exclude any users. Excluded groups take precedence over include groups.

How does system-preferred MFA determine the most secure method?

When a user signs in, the authentication process checks which authentication methods are registered for the user. The user is then prompted to sign in with the most secure method according to the following order. The order of authentication methods is dynamic, meaning it is updated as the security landscape
changes and as better authentication methods emerge.
Temporary Access Pass

A one-time passcode that is generated and sent to the user via email or SMS.

FIDO2 security key

A physical security key that the user inserts into their computer or mobile device to authenticate.

Microsoft Authenticator push notifications

A notification that is sent to the user's Microsoft Authenticator app. The user can then approve the sign-in attempt from their app.

Time-based one-time password (TOTP)

A code that is generated by the user's phone or other device. The code changes every few seconds, making it difficult for attackers to guess.

Telephony

A phone call or text message that is sent to the user. The user then enters a code from the call or text message to authenticate.

Certificate-based authentication

A digital certificate that is installed on the user's computer or mobile device. The certificate is used to authenticate the user when they sign in.

About Me

Facebook Pages

Popular Posts

Total Pageviews