Vladimír machv

How to run Azure AD Connect behind proxy server

In this scenario I am using two proxy servers:

User proxy - with authentication required for users
System proxy - for machine context without any authentication

Sample squid configuration is below together with PowerShell script to configure prerequisities (https://docs.microsoft.com/cs-cz/azure/active-directory/hybrid/how-to-connect-install-prerequisites#connectivity).

Do not make any changes to miiserver.exe.config. This file is overwritten on every upgrade so even if it works during initial install, the system stops working on first upgrade. For that reason, the recommendation is to update machine.config instead.

Office Apps for Enterprise Deployment

Group Policy Objects

User

Policy Path	Name	Value	Note
User Configuration\AT\Microsoft Office 2016\First Run\	Disable Office First Run on application boot	Enabled
User Configuration\AT\Microsoft Office 2016\First Run\	Disable First Run Movie	Enabled
User Configuration\AT\Microsoft Office 2016\Subscription Activation\	Automatically activate Office with federated organization credentials	Enabled	Needed when AD FS is used

	[
	{
	"is_default":true,
	"name": "Google",
	"keyword": "google.com",
	"search_url": "{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:iOSSearchLanguage}{google:searchClient}{google:sourceId}{google:contextualSearchVersion}ie={inputEncoding}",
	"suggest_url": "{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:omniboxFocusType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}"
	},
	{
	"name": "Bing",

	• Name AppLocker
	• Destination log Forwarded Events
	• Type Source computer initiated
	• Computer Groups “Domain Computers” (or custom group containing the computer accounts to accept events from).
	• Events to collect:
	o Logged Any time
	o Event level Error, Warning, Information
	o Event logs Microsoft-Windows-AppLocker/EXE and DLL
	Microsoft-Windows-AppLocker/MSI and Script
	Microsoft-Windows-AppLocker/Packaged app-Deployment

	Connect-AzureAD

	$skus = Get-AzureADSubscribedSku
	$skus \| Select -Property Sku*,ConsumedUnits -ExpandProperty PrepaidUnits \| Select SkuPartNumber, ConsumedUnits, Enabled
	$sku = $skus \| where SkuPartNumber -eq "O365_BUSINESS_ESSENTIALS"
	$sku.ServicePlans
	$serviceToEnable = "57ff2da0-773e-42df-b2af-ffb7a2317929"

	$users = Get-AzureADUser
	$user = $users \| Select -First 1 -Skip 2

	$hosts = 1..2 \| foreach { ("swarm{0:00}.{1}" -f $_, $env:USERDNSDOMAIN).ToLower() }

	# Install Docker Engine to all nodes
	Invoke-Command -ComputerName $hosts -ScriptBlock {
	Install-PackageProvider -name NuGet -MinimumVersion 2.8.5.201 -Force
	Install-Module -Name DockerMsftProvider -Repository PSGallery -Force
	Install-Package -Name docker -ProviderName DockerMsftProvider -Force
	}

	# Restart is needed

	function Test-DnsResolving($DnsServer, $Delay, $Query)
	{
	begin {
	$testsCount = 0
	$latencySum = 0
	$max = [Double]0
	$min = [Double]99999
	[Console]::TreatControlCAsInput = $true
	}

	[Settings]
	Priority=FallbackDeployRoot, DefaultGateway, Default

	[FallbackDeployRoot]
	; Default deployment root in case of failure in the next step with the gateway selection
	DeployRoot=\\CZ-PRG-MDT\ClientDeploymentShare$

	[DefaultGateway]
	; Based on the default gateway we will select corresponding location section
	172.24.39.254=CZ-PRAHA