Managing PCs using Windows Intune (Part 7) – Licenses Policies Reporting

If you would like to read the other parts of this article series please go to:

• Managing PCs using Windows Intune (Part 1) – Introduction
• Managing PCs using Windows Intune (Part 2) – Preparing Your Environment
• Managing PCs using Windows Intune (Part 3) – Managing Computers and Updates
• Managing PCs using Windows Intune (Part 4) – Managing Endpoint Protection and Alerts
• Managing PCs using Windows Intune (Part 5) – Remotely Assisting Users
• Managing PCs using Windows Intune (Part 6) – Deploy Software

Introduction

The previous articles in this series have walked you through how to perform various PC management tasks using the System Overview, Computers, Updates, Endpoint Protection and Alerts workspaces of the Windows Intune admin console.  You also learned how to deploy software from the cloud to managed PCs, and how a Windows Intune administrator can use Microsoft Easy Assist to remotely assist users who have problems with their computers. This final article in the series explains how you can use Windows Intune to manage software licenses, create and deploy policies to managed PCs, and generate various kinds of reports.

Note:
This series of articles is based upon a prerelease version of Windows Intune and the final released version may include additional features not included in this version.

Managing licenses

Not only can you use Windows Intune to deploy software to your Windows-based computers, you can also use it to manage your software licenses for both Microsoft and non-Microsoft software installed on the computers. Figure 1 below shows the Overview page of the Licenses workspace in the Windows Intune administrator console:

Figure 1: Managing software licenses using Windows Intune.

To add a new license agreement to Windows Intune, click Add Agreements in the above figure. Doing this opens the Add Agreements page as shown next:

Figure 2: Adding a license agreement to Windows Intune.

The Add Agreement page lets you add the following types of license agreements:

• Volume Licensing agreement – Lets you upload Microsoft Software License Terms information to the Microsoft Volume Licensing Service Center (VLSC) site. 
• Other software licensing agreement – Lets you upload licensing information for Microsoft software purchase through retail channels or for third-party (non-Microsoft) software.

Note:
Microsoft does not monitor license agreements you upload this way, so you should consider the Licensing workspace of Windows Intune more of convenience to help you track your licenses than a tool for verifying your compliance with your VL agreements.

If you select Volume Licensing Agreement as in the previous figure above, you can upload a CSV text file containing the details of your agreement and specify the License Group to which the uploaded agreement should be added. If you select Other Software Licensing Agreement however, you will need to manually specify the details of your agreement as shown in the next two screenshots:

Figure 3: Manually specifying the details of a licensing agreement.

Figure 4: Manually specifying the details of a licensing agreement (continued)

If you select the option Add The Agreements To A New License Group as shown in the figure above, the Create License Group page opens and allows you to specify a name for your new license group and to add unassigned license agreements you select to the group:

Figure 5: Creating a new license group.

Once you’ve uploaded your licensing agreements to Windows Intune, you can create and view reports that summarize your licensed software in selected license groups or that compare the installed software on your managed computers with your current license agreements. For more information, see the section Creating and Viewing Reports later in this article.

Creating and Deploying Policies

Policies are collections of settings you can create and deploy to your managed PCs using the Windows Intune admin console. Policies are created from predefined templates and can include settings for managing software updates, Endpoint Protection, Windows Firewall, or the Windows Intune Center on your managed PCs. To start working with Policies, select the Overview page of the Policy workspace in the Windows Intune admin console:

Figure 6: Step 1 of creating and deploying a policy using Windows Intune.

You start by clicking Create new Policy in the Tasks list on the right-hand side of the Overview page shown above. Doing this launches the Create A New Policy wizard and displays the Select A Template For The New Policy (see figure below). You have three templates you can choose from to create your new policy:

• Windows Firewall Settings – This template can be used to create policies that configure Windows Firewall settings on the computers targeted by the policy. The firewall settings you can configure include:
  • Which profile(s) (i.e. Domain, Private, Public) have Windows Firewall enabled on them (the default is Yes for all profiles).
  • Whether or not to block all incoming connections on a specific profile (the default is No for all profiles).
  • Whether Windows Firewall should notify the user when a new program is blocked for a specific profile (the default is Yes for all profiles).
  • Whether an exception should be opened for a specific Windows service (e.g. BranchCache, BITS, File and Print Sharing, and so on) for a specific profile (the default is Not Configured for all exceptions).
• Windows Intune Center Settings – This template can be used to create policies that display specified support information when the user opens the Windows Intune Center on their managed PCs when they are targeted by the policy. For more information on using this template to create a new policy, see the screenshots that follow below.
• Windows Intune Agent Settings – This template can be used to create policies that configure how the Windows Intune update agent and the Windows Intune Endpoint protection agent behave on computers targeted by the policy. For example, you can configure a policy to:
  • Specify whether Endpoint Protection should be installed on the targeted computers.
  • Specify whether Endpoint Protection, if installed, should be enabled.
  • Whether a System Restore point should be created by Windows prior to malware remediation (the default is Yes).
  • How many days you have to manually check whether a malware remediation has been effective on a targeted computer (the default is 7 days).
  • Whether Real-time Protection should be enabled and how it should be configured.
  • The schedule for running malware scans (the default is daily) and how quick and full scans should be configured to run.
  • The default action that Endpoint Protection should take when malware is found.
  • Files, folders, file types and processes that should be excluded from malware scans.
  • Microsoft SpyNet membership settings.
  • How often Windows Intune should check for new software updates for the targeted computers.
  • When and how any new available software updates should be installed.
  • How much network bandwidth can be used by the BITS service to download software updates.

For our walkthrough we’ve selected the Windows Intune Center Settings template:

Figure 7: Step 2 of creating and deploying a policy using Windows Intune.

Clicking the Create Policy button takes you to the Create Policy page where you specify a name and description for your new policy (see next figure) and some info for how the user can contact the helpdesk of your organization (see figure after next):

Figure 8: Step 3 of creating and deploying a policy using Windows Intune.

Figure 9: Step 4 of creating and deploying a policy using Windows Intune.

Clicking Save Policy saves the new policy in the Windows Intune cloud, but the new policy isn’t deployed unless you also click Yes in the Deploy Policy dialog box:

Figure 10: Step 5 of creating and deploying a policy using Windows Intune.

If you choose to deploy the new policy you just created, you must select the managed computers to which the policy should be applied:

Figure 11: Step 6 of creating and deploying a policy using Windows Intune.

Once you’ve finished creating and deploying your new policy, it should be visible on the All Policies page of the Policy workspace:

Figure 12: Step 7 of creating and deploying a policy using Windows Intune.

Creating and Viewing Reports

Finally, the Windows Intune admin console can also be used to create and view various kinds of reports. To see which types of reports are available, select the Overview page of the Reports workspace:

Figure 13: You can create and view different types of reports.

Let’s examine one type of report: the Update Report, which lists software updates that were successfully installed, failed installation, or are pending installation, or are still needed on your managed computers. To create and view a new Update Report, select Update Reports in the Reports workspace:

Figure 14: Creating an Update Report.

As you can see from the screenshot above, we want to create and view a report that will list any critical updates installed on computers in the Vancouver group. Clicking the View Report button opens an Update Status Report window that lists all critical updates installed on PCs in Vancouver:

Figure 15: Viewing an Update Report.

The two buttons at the top right of the Update Status Report window let you print and export your report respectively. We’ll look at exporting a report in a moment. 

Returning to the Update Reports page and clicking Save As lets you save the report using a name you specify:

Figure 16: Saving an Update Report.

Clicking the Load button displays a list of the reports you have saved (see next screenshot). Selecting a report then lets you view it by clicking View Report.

Figure 17: Loading a previously saved Update Report.

Returning to the Update Status Report window and clicking the Export button at the top right opens the Export dialog, which lets you select the format in which to export the report data:

Figure 18: Exporting an Update Report.

Tip:
The best way to learn about the reporting capabilities of Windows Intune is to try using the Reports workspace to create and view different kinds of reports.

The Administration Workspace

Finally, the Windows Intune admin console includes an Administration workspace which lets you perform various tasks, some of which have already been described in previous articles in this series:

Figure 19: The Administration workspace.

Additional Resources

The best place to learn more about Windows Intune and keep abreast of any changes or improvements with this management platform is the Windows Intune home page of the Windows Client TechCenter on Microsoft TechNet.

Another good source for more information is the online help for Windows Intune.

To download Windows Intune and get started with the platform, go to Microsoft’s Evaluation Download Center and select the link under Cloud Services.

A good general source of info on all of Microsoft’s cloud offerings is the TechNet Cloud Hub.

Also be sure to check out the Microsoft Virtual Academy for their learning content on cloud computing.

Finally, keep abreast of improvements to the Windows Intune platform by subscribing to the RSS feed for the Windows Intune Blog at http://blogs.technet.com/b/windowsintune/.

If you would like to read the other parts of this article series please go to:

• Managing PCs using Windows Intune (Part 1) – Introduction
• Managing PCs using Windows Intune (Part 2) – Preparing Your Environment
• Managing PCs using Windows Intune (Part 3) – Managing Computers and Updates
• Managing PCs using Windows Intune (Part 4) – Managing Endpoint Protection and Alerts
• Managing PCs using Windows Intune (Part 5) – Remotely Assisting Users
• Managing PCs using Windows Intune (Part 6) – Deploy Software