Manage Google Chrome Android from Microsoft Intune

This short post will show you the basics to deploy Google Chrome setting when you use Intune to manage Android Enterprise.

there is an older technet blog on this topic from 2017, but it is kind of obsolete, so I've decided to refresh it.

Prerequisites:

• Android for Work is enabled and you enroll devices using AfW
• Google Chrome is added as Managed Google Play app

Configuration steps:
Go to Microsoft 365 Device Management portal (i like this new portal when working with Intune only 😉)
Navigate to Client Apps -> App configuration policies and click on Add

Type a name for your policy and select the following:
Device enrollment type - Managed devices
Platform - Android
Assosiated app - Google Chrome.
If you don't see Google Chrome in the list, you must get is first from Managed Google Play!

Click on OK down under the configuration page.

Right after you've presses OK, you'll see new tab "Configuration settings". 

Click on "Configuration settings", select "Use configuration designer" as settings format and click on Add

Select Managed Bookmarks from available options and click OK

Add desired bookmarks into Configuration Value field
in this example i've added
[{"toplevel_name":"DEMO"},{"url":"https://myapps.microsoft.com","name":"MyApps"}]

• {"toplevel_name":"DEMO"} will create root folder named DEMO
• {"url":"https://myapps.microsoft.com","name":"MyApps"} will create bookmark named MyApp and point it to myapps.microsoft.com

Click on OK and ADD down under the page and you are all set.

Don't forget to deploy this policy to you users or devices 😁


Other configuration settings can be added in the same way.

Chrome policy reference is located here - https://www.chromium.org/administrators/policy-list-3, however not everything is available on Android.

running multiple WSUS servers with shared database and central content share

I was going to write this down for a while and finally i've got so far :) ...

there are numerous reasons to have multiple WSUS servers in your organization, where the most logical is to spread load and provide high availability of WSUS infrastructure:

• when you are running SCCM 2012 SP1 (or higher)
• when you've got complex WSUS hierarchy

and in both cases you've got strong HA requirements

This blog post Yvette OMeally provides in-depth coverage of changes that were made in SCCM 2012 service pack 1 to optimize Software Update Point functionality. Basically you can now have multiple SCCM SUP's that can be load-balanced automagically.

It always looks cool and wonderful in documentation and marketing booklets, but it is however not as simple as it seems to get it up and running, isn't it?

side note - the WSUS servers installed in this blog post are meant for production SCCM 2012 R2 site with multiple SUP's.


For my recent customer i needed to deploy a relatively small SCCM 2012 R2 single site hierarchy that must be made as available as possible. And yes, one of the aspects is to configure HA SUP's, which implies using redundant WSUS servers running with shared SQL database and shared content location.

Well... let's set it up :D

Short build info:
the environment is built on Windows Server 2012 R2 with latest patch level up to the article's publishing date. SCCM and WSUS are using Microsoft SQL 2012 sp1 cu6

Assumptions:

• you've got AD fully configured and functioning
• you've got properly installed and configured Microsoft SQL server with KERBEROS authentication
• you've got properly configured DFS namespace to host WSUS content share
• WSUS content share is configured to provide all read/write acces for the computer accounts that will be running WSUS.

Installation

install first WSUS server

instal WSUS role from server manager
select WSUS service and WSUS database

configure content share


configure database

provide the name of you DB server

run post installation configuration

if this pop-up appears check database and share configuration and click on OK



in a few minutes WSUS configuration wizard will appear. when installing WSUS for SCCM this wizard may be omitted.
we'll proceed through the WSUS config to show it's working ;)
in the wizard i've configured WSUS to synchronize only critical updates for Windows Server 2012 R2

go to sync tab in WSUS console and run sync again

now we see that sync is working...

lets configure some additional settings to get the second, the third (and so on) WSUS servers working...

configure first server:
on the first WSUS server stop IIS, WSUS and Windows Update service (if it is running)
net stop W3SVC && net stop WsusService && net stop wuauserv

open IIS management and go to "Content" virtual directory of "WSUS Administration"site

modify path the "Content" virtual directory is pointing to by adding preceding "\\" to it.



start the services again
net start W3SVC && net start WsusService && net start wuauserv

configure the SQL server:
WSUS post-setup config has created necessary SQL login and SUSDB user for the first server.


before installin any additional WSUS server we have to manually add SQL login and configure SUSDB user for the second WSUS server (and for 3d, 4th ...)

connect from SQL studio to the SQL instance hosting SUSDB and create SQL login for the computer account of the second WSUS server

enter server name manually like for example AD\WSUS2$, do not click on "browse"


map it to the SUSDB

go to Databases -> SUSDB -> Security -> Users and modify just created user propertis by adding webservice to its mebership


 
Install WSUS on the second server


instal WSUS role from server manager
select only WSUS service


configure content share


stop IIS, WSUS and Windows Update service (if it is running)
net stop W3SVC && net stop WsusService && net stop wuauserv

start REGEDIT and go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup

Modify the following keys: 
ContentDir = \\ad.local\Infra\Software\WSUS
SqlServerName = database01
HINT - to avoind faults, just copy and paste values of these two kees from the first server ;)

open IIS management and configure path of the "Content" virtual directory to to point to the location specified in ContentDir reg key (just the same way we did it for the first server)

enable WSUS service (it might be still disabled as post-install configuration hasn't been run yet)

start IIS and WSUS services

start WSUS management console

if you get the window with share configuration, check the share location and click on OK. in a few minutes it should tell that config was successful


now that console has opened we'll go to synchronization tab and see our two sync's we've previously seen on the first WSUS server.

additionally you can run the following query on the SUSDB SQL and you'll see that both WSUS servers are talking to the database

SQL query (watch out for the right quotation marks around database name!)
select d.name, d.dbid, spid, login_time, nt_domain, nt_username, loginame
from sysprocesses p inner join sysdatabases d on p.dbid = d.dbid
where d.name = 'SUSDB'
go
 

and we are done :D

P.S. you can simplify your life by not using shared content location if you don't have to.

about shared content location:
there is currently no official Microsoft documentation available on TechNet regarding support for shared content location for WSUS 6.x servers.
actually there is nothing documented at all about it, except for WSUS 3.0 spX where is stated that shared content location is only supported when placed on DFS.

References:
Software Update Points in Configuration Manager Service Pack 1 
Best Practices for Software Updates in Configuration Manager
Considerations for multiple WSUS instances sharing a content database when using System Center Configuration Manager, but without Network Load Balancing (NLB)
Configuring WSUS 6.x for Network Load Balancing (NLB)
Configure WSUS for Network Load Balancing 
A TechNet forum thread about shared WSUS content