Recently we found on Tech Soup (we are a non profit) that the F3 License included Windows 10 Enterprise upgrade (from Pro) However upon testing this License my test machine is still showing as Pro. here is a screen clip from Techsoup
Basically, we are trying to find a solution for the front line workers we have that do not need the full E3 package, our frontline workers do not need the desktop apps, but they do need the enterprise upgrade for other reasons like the Policies, lock screen force thru GPO etc...
have you confirmed that Windows 10 Enterprise 'Step-Up' license is enable for your user account in the M365 Admin portal? depending on how the license SKU shows up in the portal the Windows 10 Enterprise license may show outside of the F3 license. Licensing groups are your friend here as you can set up the licensing group profile to turn on specific licenses/and or toggle on/off sub-components automatically...
either way, thank you all for your help and suggestions. My Company now decided to go with E3 for everyone, so effectively my problem is solved. I may play around with this to see if I can get it to work, and If I do I'll post my findings.
@John-CAI Please don't think af this as "a catch", but there is a slight nuance. As this is intended for "Frontline Workers" (i.e. people that spend little time at a desk and are more likely to interact with tablet and/or smartphones) it only includes the right to use a shared device (or a very small personal windows device - screen smaller than 10.1").
It used to be that imaging required identical hardware, technical staff to be physically present, and (for the polished options) a big budget. None of which were\are true for the organizations we help.
I have to assume imaging has changed and evolved in the years since, what would be a recommended solution for geographically dispersed non profits with only remote technical support, dissimilar hardware (whatever happens to be the best deal at Dell that month is the hardware they get), and little to no budget to waste on this.
There are new licensing options for you to purchase Windows 10 Enterprise E3 or Windows 10 Enterprise E5. There was something posted on this here: Microsoft announces subscription pricing for Windows 10 Enterprise with new options to purchase under a CSP licensing channel.
Re-install Win 10 Enterprise on one notebook. After which I would run a few of the downloaded scripts to remove those Win10 apps as much as possible and run windows updates and install necessary apps (Acrobat reader, Office, Java, Chrome etc).
Before I deploy the notebook to user, I would then change hostname, join domain, login as the user for 1st time, check Win activation, check office activation, remove edge from taskbar & start, remove all icons from start (un-install seems stupid as they cannot be removed permanently), put IE and chrome on taskbar ans start.
Although the course is focused on analyzing Windows-based systems and servers, the techniques and investigative processes are applicable to all systems and applications. The course includes detailed discussions of common forms of endpoint, network and file-based forensic evidence collection and their limitations as well as how attackers move around in a compromised Windows environment. The course also explores information management that enriches the investigative process and bolsters an enterprise security program. Discussion topics include the containment and remediation of a security incident, and the connection of short-term actions to longer-term strategies that improve organizational resiliency.
Incident response team members, threat hunters and information security professionals. Prerequisites Background in conducting forensic analysis, network traffic analysis, log analysis, security assessments and penetration testing, or security architecture and system administration. Learners must have a working understanding of the Windows operating system, file system, registry and use of the command line. Familiarity with Active Directory and basic Windows security controls, plus common network protocols, is beneficial.
Are you experiencing problems with the automatic upgrade from Windows 11 Pro to Windows 11 Enterprise during Autopilot on the latest Windows build? Or are your current Windows 11 Enterprise devices reverting to Windows Pro? If so, this blog is for you!
This process could cause issues and prevent the device from upgrading to enterprise. I posted a blog some time ago explaining how to fix this problem. With an easy one-liner, you can ensure that Windows 11 Pro has been upgraded to Enterprise.
If that scheduled task fails, the Windows License is NOT upgraded to Enterprise, and with it all off, the security-related features that are only applicable to Enterprise builds are not going to be applied
To find out what was happening, I installed Procmon and just tried to kick off that task. With the proper filtering in place (Cliprenew and access denied), it became evident that the Cliprenew executable was attempting to create/set a new registry key called mfarequiredcliprenew.
With the installation of KB5036980, existing devices will eventually drop from Windows Enterprise to Windows Pro, depending on their update ring. This update causes the scheduled task responsible for renewing the license to fail due to a permission issue with creating necessary MFA registry keys. As a result, the device cannot maintain its Enterprise status.
If you want to fix it before Microsoft does, you must push this PowerShell script to your device during Autopilot to ensure the license acquisition scheduled task can be launched.
If you want to fix this on existing devices that already went through Autopilot, you also need to trigger that scheduled task to acquire the proper license for the device. You can do so by adding this command to the script above!
When getting a better view by using the pseudocode, it looks like it is indeed trying to create or open the mfarequiredkey just at the first steps of the licenceactivation
This part of the licenceactivation will check if a specific feature related to Multi-Factor Authentication (MFA) is enabled. If this MFACheckinClipRenew feature is enabled, it proceeds with additional actions.
This fix will be released as a security update in the last week of June or on the second Tuesday of July (Patch Tuesday). Until then, we must watch out for this issue on new or existing devices.
Reason 1: When all your devices are 100% up to date, suddenly, one device gives you issues. Most likely, you will send a remote wipe to that device. Guess which Windows Build it has when it needs to enroll again with Autopilot?
Reason 2: If your device has been upgraded to Enterprise using the subscription activation, it must regularly check in to keep it Enterprise. If that scheduled task cannot be executed successfully, the grace period will end, and with it, your device will be downgraded!
Good find, thanks for the detailed write up! Got caught with this one for an hour yesterday thinking it was a license assignment issue. I can confirm the registry permission change works. Although I would rather an official fix. Is there a ticket number or similar I can reference when raising this with Microsoft?
Thank you for the information, Its Works in a non-Autopilot scenario, I had the problem with license activation Pro/Enterprise in some devices, I run the Powershell script Fix Option 1 and line in Powershell and works fine.
Thank you so much. I am able to successfully run the script manually from an Administrative Powershell prompt. I have been unable to deploy the script successfully as a Win32 app via Intune. The install behavior is set to System. Install command: powershell.exe -noprofile -executionpolicy bypass -file RudyFix.ps1. The script does not appear to run at all. I have been unable to isolate the issue. Admittedly my basic powershell knowledge does not help.
I ran the powershell script and I keep getting the error code (0xC03F6504) and the ClipSVC keeps stopping on its own after the license Acquisition is run. Idk if im doing something wrong or if theres something stupid in my GPO from the previous dude that is causing this.
I'm trying to install Windows 64-Bit Enterprise on a new out of the box 840 G3. Both on my USB 3.0 external drive I user to install, as well as a burned DVD of Windows. Both give this error at Windows Setup. "A Required CD/DVD drive device is missing. If you have a driver floppydisc, CD, DVD, or USB flash drive please insert it now."
After talking to HP Elitesupport, I found out that Intel removed USB 2.0 chipset support from theie Skylake chipset. Meaning that normal USB installs for windows will not work. Microsoft Windows ISO doesn't have the native USB 3.0 drivers either. So you have to add the USB 3.0 drivers into the Windows ISO. Intel came through on tihs one too. They have a utility that does all the work for you.
Ive done a little reworking of our install order and now I'm seeing the sso piece being broken again in 12.3. I previously had the company portal app in the prestage packages to install, but now moved it to happen after enrollment, and perhaps thats the issue, but on a 12.3 install im not getting any indication that sso is working.
The problem starts with configuration:
1. Company Portal Registration requests another authetication plus authorization for JamfAAD access to key "MS Workplace Join Key"
2. Than, the first App opened requeste again authentication