Sideloading on domain joined Windows 8.1 Professional Update Tablets

Hi folks,
first, I want to apologize for my bad English. I'm out of practice since several years and Google Translator is not the best assistance.
We are developing a Windows 8 LOB App for our customer. This App shall only be available for the employees of this customer. Therefore, releasing the App in the Windows Store is not an option.
As far as I understand the announcements by Microsoft, it is now possible to sideload Windows Store Apps on devices where Windows 8.1 Pro Update is installed. The requirements are the app has to be signed, the group policy "Allow all trusted apps to install"
has to be enabled and the devices must be part of a domain. A sideloading key is not required anymore.
At the moment I try to sideload an app to an Windows 8.1 Pro lenovo tablet. The System is up to date and the device is part of an AD-Domain.
To sideload the app, I've done the following:
-> First I deleted the developer license from my testing device.
-> Then I've created a code signing certificate with mkcert and Pvk2Pfx according to.
-> Creating and signing the App package with Visual Studio 2013 worked without problems.
-> I activated the local GP "Allow all trusted apps to install" and installed the certificate under the local machine\Trusted Root Certification Authority certificate store.
But when I try to install the app with Add-AppPackage, the process abort with an error. The error message says, that a developer license or a sideloading key is required.
What do I wrong? Has someone managed to sideload an App to a domain joined Windows 8.1 Pro device and can give me some advice?
Many thanks in advance.
Tobias

Hello,
though, I have not updated this thread in the last days, I'm still not sure, whether sideloading keys are necessary to successfully sideload apps to domain joined Windows 8.1 Pro devices.
To make sure that I have got you right: Might someone confirm to me, that even for domain joined devices with Windows 8.1 Pro Update installed, sideloading keys are necessary, because these devices are only ready to, but not yet enabled for sideloading.
If no sideloading keys are necessary, is it required, for successful sideloading, that the devices are logged into the domain network and connected with the domain controller, for a successful deployment? My test device is domain joined but at the moment it
is not logged into that domain network.
Thanks.
Tobias
I'm unable to confirm myself, since I don't use Pro edition in my organisation (we use Enterprise edition because we purchased that in our agreement).
It might be possible, that the MSFT statements for Pro (does not require sideloading key), might only be functional when using the Volume Licensing channel product for Pro. i.e. maybe the OEM channel and Retail channel of Pro might not be enabled for sideloading?
It sounds like you are using an OEM or Retail channel Pro (i.e. that OS shipped on the Lenovo device).
This is my observation from your symptoms. I'm not sure how to validate that, without trying each case.
It may be necessary to raise a support call with MSFT to validate that.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Similar Messages

Domain joined Windows 8.1 using OneDrive to sync passwords across devices

Background : Domain joined Windows 8.1 devices using OneDrive to sync settings across devices, including "Passwords" under Other Settings. Domain user accounts are NOT local administrators.
Issue : When one drive goes to sync Wireless network security settings (passphrases etc...), a User Account Control (UAC) dialogue pops up from "Program Name : Networks" to enter administrator credentials. Domain users do not have administrator access
to local computers by strict policy.
The only way identified so far to stop the dialogue pop-up is to disable the password sync by group policy. However, that turns off ALL password syncing, including passwords desired to be sync'd, that do not encounter this issue.
Can the UAC be suppressed? Is there a way to NOT sync the wireless password settings?
Welcome any thoughts, direction, assistance, etc... :) Thanks much and have a good day!

Hi,
I searched around but haven't find one way to achieve this, thus I'm afraid that we're unable to prevent the specific network password setting. the syncing settings for all passwords are combined together.
To suppress UAC, we can turn off the UAC under control panel\User Account or via GP Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options ,but we don't recommend this.
Yolanda Zhu
TechNet Community Support

Using Microsoft account on domain-joined Windows 10 Technical Preview

(First asked at
http://answers.microsoft.com/en-us/windows/forum/windows_tp-security/using-microsoft-account-on-domain-joined-windows/63093b15-af76-4461-a23e-8f8b739f4960, was told to come here...)
I have in-place upgraded a domain-joined Windows 7 machine to Windows 10 Technical Preview build 9860.
I can log on as before using my domain account, but I'd also like to be able to log on using my (personal) Microsoft account.
I tried typing [email protected] in the "user" box but this didn't work.
Any clue? Maybe the only way is to first create a local account and then associate it with the MSA but IMVHO this shouldn't be necessary...

Hi sba,
If we updated to Windows 10 Technical Preview from Windows 7, Windows will keep your Windows settings, personal files, and most apps. And based on what I know, if we haven’t create a Microsoft Account on Windows 10 (or there is no Microsoft account available
before we update to Windows 10), it will not allow us to sign in with a Microsoft Account.
To make it able to sign in with a Microsoft account, we need either connect a local account to a Microsoft account (Under PC settings->Users and Accounts-> Your profile)
or
create a new user account(under PC settings->Users and Accounts->Other users->Mange other users-> Add a user);
Best regards
Michael Shao
TechNet Community Support

Photoshop Laggy under Domain Joined Windows 7 Machine

Photoshop CS4 (64-bit) has been working fine up until I added my PC to my Server 2008 R2 level domain, complete with roaming profiles and folder redirection up to my server.
I've googled around and found nothing, basically Photoshop now runs like mud trying to do even something simple like move a layer on an image, it's becoming unbearable and Photoshop is a core piece of my day to day work since I do freelance web design.
Specs:
Phenom Quad Core 955 @ 3.2GHz
8GB DDR3 RAM
NVIDIA 8800GT (512mb)
1.5tb Western Digital SATA 3.0GB/s HDD
As you can probably tell, it's unlikely to be a hardware issue...

Go into Windows 7 and set the default printer to a dummy local printer. When ready to print just change the printer in CS4. This has worked in some cases in Vista so it may work in Windows 7. Worth a try.
Edit: I have also read where Photoshop constantly polls a network drive over and over again. Has to do with recent files being opened and stored in Photoshop. Clearing the recent files open makes it faster . But setting it at zero did not help. You can save files local and when done transfer them to a network drive. I guess Adobe is aware of this issue. There are many threads in here too.
Found this for your reading pleasure:
http://kb2.adobe.com/cps/406/kb406793.html

ModernUI app fail to install from Intune Company Portal on Windows 8.1 Enteprise domain joined

i know that using sideloading keys are required in all scenario's whenever i want to deploy modernUI apps to windows 8.1 devices. Using a domain joined enterprise Windows 8.1 device it should be required as i've heard. However, i'm looking for the exact
technical requirements to be able to deploy a modernUI app through the company portal from Intune. So far i know the following requirements:
device must be domain joined enterprise version OR use sideloading keys;
the device must be joined to the domain that is dirsynced with the Intune subscription;
AllowAllTrustedApps reg key must be set to 1 OR configure the corresponding GPO;
a Microsoft account is required to access the Windows Store;
a Windows Intune subscription user account is required to enroll the device into Windows Intune;
the modernUI (demo) app must be visible in the company portal;
app must be signed and the device must trust the corresponding cert OR use a developer sideloading key: Show-WindowsDeveloperLicenseRegistration;
does someone have a good overview of all requirements in relation to deploying modernUI apps?
I find it very confusing when to determine which requirements apply. thanks in advance!

i know that using sideloading keys are required in all scenario's whenever i want to deploy modernUI apps to windows 8.1 devices. Using a domain joined enterprise Windows 8.1 device it should be required as i've heard. However, i'm looking for the exact
technical requirements to be able to deploy a modernUI app through the company portal from Intune. So far i know the following requirements:
device must be domain joined enterprise version OR use sideloading keys;
the device must be joined to the domain that is dirsynced with the Intune subscription;
AllowAllTrustedApps reg key must be set to 1 OR configure the corresponding GPO;
a Microsoft account is required to access the Windows Store;
a Windows Intune subscription user account is required to enroll the device into Windows Intune;
the modernUI (demo) app must be visible in the company portal;
app must be signed and the device must trust the corresponding cert OR use a developer sideloading key: Show-WindowsDeveloperLicenseRegistration;
does someone have a good overview of all requirements in relation to deploying modernUI apps?
I find it very confusing when to determine which requirements apply. thanks in advance!
If you have a domain joined Windows 8.x Enterprise workstation, you do not need the sideloading keys. You only need sideloading keys for Windows 8 Pro, RT etc.
It will install as long as:
Domain joined
AllowAllTrustedApps - GPO or Local Policy enabled
Signed by a trusted certificate

Are sideloading keys required to sideload Apps to domain joined OEM/retail Windows 8.1 Pro devices?

Hello,
I want to sideload a Microsoft Store App to a Lenovo Thinkpad 2 device. The device has an OEM / retail version of Windows 8.1 Pro installed and is part of an active directory domain network.
With this preconditions and according to announcements by Microsoft, it seems to be possible since May 2014 to deploy Apps directly to these devices. Without the need to buy a sideloading key.
To check this, I have generated an code signing certificate with makecert/Pvk2Pfx and then I followed the instructions in this
blog article.
Everything went fine, only the actual deployment with add-appxPackage didn't work. The installation aborts with the error message, that a developer or sideloading license is required, as no license or sideloading policy can be applied.
Can anybody in this forum give me some advice to these questions:
1. Does the new sideload licensing model for May 2014 also applies to OEM/retail versions of Windows 8.1, or is is volume licensing required?
2. Has anybody managed to successfully sideload an App to a OEM / retail Windows 8.1 Pro device?
3. At the moment I don't have access to the domain network. I can login with a domain user locally but changes to the local group policies and to the local certificate stores can't be confirmed by the domain controller. I'm not an administrator, so might this
be a source of error?
Thanks
Tobias

Hello Tobias,
Please check if you can normally sideload Windows Store App in other domain-joined OEM computer.
About the OEM issue, it is recommended to contact the manufacturer.
Best regards,
Fangzhou CHEN
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Sideloading not working on domain joined enterprise devices

Hi,
I wanted to know if sideloading has any limitations that an OMA DM agent that it won't be able to install an app through sideloading if the tablet is domain joined?
We are seeing this on enterprise edition tablets which are domain joined and enrolled to the an MDM (mobile device management) server that the OMA DM agent cannot install a sideloaded app.
We'd highly appreciate some pointers.
Thanks,
D

Hi,
Sorry for my dilatory reply. According to the following description:
Windows 8.1 supports three types of user accounts on a device: Local Accounts, Microsoft Accounts and
Domain Joined Accounts. The OMA-DM agent is disabled when a device is domain joined which means
the management service cannot set password policy for a domain joined account. Windows 8.1 RT and
Windows 8.1 Home SKUs cannot be domain joined.
It seems like OMA-DM agent doesn't support domain joined of Windows 8.1 device.
You can access to the link below to download the document for more details:
http://download.microsoft.com/download/8/6/B/86BAC59D-0DA3-4B9C-AF15-C077DC0D46CF/Windows%208.1%20Enterprise%20Device%20Management%20Protocol.pdf
Roger Lu
TechNet Community Support

Windows 7 or Windows Server 2008 R2 domain join displays error "Changing the Primary Domain DNS name of this computer to "" failed...."

Hi,
Windows 7 or Windows Server 2008 R2 domain join displays error "Changing the Primary Domain DNS name of this computer to "" failed...."
DC:windows Server 2008 R2
Domain functional level:Windows Server 2003
When Winxp join domain, have no this error message.
I checked http://support.microsoft.com/kb/2018583?wa=wsignin1.0 does't work.
There have 3 suggestion in this article:
1.The "Disable NetBIOS over TCP/IP" checkbox has been disabled in the IPv4 properties of the computer being joined.
Doesnt's work.
2.Connectivity over UDP port 137 is blocked between client and the helper DC servicing the join operation in the target domain.
On my DC, I run netstat -an, reslut as below:
UDP 192.168.20.3:137 *:*
3.The TCP/IPv4 protocol has been disabled so that the client being joined or the DC in the destination domain targeted by the LDAP BIND is running TCP/IPv6 only.
We are not using IPV6.
This server recently updated from Windows Server 2003 to Windows Server 2008 R2. Before upgrade, when Win7 and Win2008 join this domain, also have the same error message.
Please help to check this issue.
Thank you very much.
BR
Guo YingHui

Hi Guo Ying,
I have faced this critical error which makes over-writes the host names in the domain when you join.
For example: Already you had a host name called as PC.domain.com in the domain.com Domain.
When you try to add the another host name called as PC in the domain.com Domain, it doesn't give you the duplicate name error on the network it does over-write the existing host name called as PC.domain.com & it will add the new host name into the domain.
Host name which got over-written will get removed from the domain. I faced this issue in my project. My DPM host name got removed from the Domain & new host name got joined into the domain which halted my backups for one day.
Final Resolution is as follows:
You need to start the dns console on the DC & drop down the domain name.
Select the _msdcs when you click on _msdcs it will show the Name Server's list on the right hand side.
You need to add the Domain Naming Master under the _msdcs or add all the domain controllers which you had.
After you add the Name server's try joining the PC OR Laptop to the domain which is successfully joins it.
Regards
Anand S
Thanks & Regards Anand Sunka MCSA+CCNA+MCTS

Windows 8.1 Pro has error while joining domain, while windows 7 pro has no problem to join in the same network

I am having the same issue as posted in http://social.technet.microsoft.com/Forums/windows/en-US/6ea57e5f-6e9d-49bd-9dd7-832ea84c0276/windows-81-pro-will-not-join-domain?forum=w8itpronetworking
There are a few other people have the same issues. However there was no real solution provided although the post was marked as answered. I am posting it here again and hopefully I can get some help to solve this issue.
We got two new PCs, one with windows 7 and the other with windows 8.1 Pro. In the same network with domain, the windows 7 pc has no problem at all to join the domain. However the windows 8.1 Pro won't join the domain. On the windows 8.1 Pro computer,
I can ping the other computers in the network. The error message says:
An Active Directory Domain Controller (AD DC) for the domain "cmi" could not be contacted. ...
In my case, the domain name is "CMI". I am sure the DNS setting is correct. What did I do wrong? Any help is greatly appreciated. Thanks.

I tried the solution in that article.
In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters folder, there is no
NeutralizeNT4Emulator. So I followed the instructions and created one, and set the value to 1. Then I restarted the computer and tried to join the domain again. I got the same error. Below is more from the netsetup log file:
06/04/2014 21:36:37:256 -----------------------------------------------------------------
06/04/2014 21:36:37:256 NetpValidateName: checking to see if 'XPS8700' is valid as type 1 name
06/04/2014 21:36:40:256 NetpCheckNetBiosNameNotInUse for 'XPS8700' [MACHINE] returned 0x0
06/04/2014 21:36:40:256 NetpValidateName: name 'XPS8700' is valid for type 1
06/04/2014 21:36:40:256 -----------------------------------------------------------------
06/04/2014 21:36:40:256 NetpValidateName: checking to see if 'XPS8700' is valid as type 5 name
06/04/2014 21:36:40:256 NetpValidateName: name 'XPS8700' is valid for type 5
06/04/2014 21:36:40:256 -----------------------------------------------------------------
06/04/2014 21:36:40:256 NetpValidateName: checking to see if 'cmi' is valid as type 3 name
06/04/2014 21:36:40:272 NetpCheckDomainNameIsValid for cmi returned 0x54b, last error is 0x0
06/04/2014 21:36:40:272 NetpCheckDomainNameIsValid [ Exists ] for 'cmi' returned 0x54b
----------------below is the error message from the pop up window
Note: This information is intended for a network administrator. If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\Windows\debug\dcdiag.txt.
The domain name "cmi" might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.
If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.
DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain "cmi":
The query was for the SRV record for _ldap._tcp.dc._msdcs.cmi
The following domain controllers were identified by the query:
cmi-dc2.cmi
cmi-dc1.cmi
However no domain controllers could be contacted.
Thanks.

Windows 7 MDT Offline Domain Join

In a scenario where a user does not have access to the corporate network, a mostly automated media-based refresh is implemented.
- Refresh laptops from Windows XP/Vista to Windows 7
- MDT task sequence, OS, drivers, apps, contained on a supplied DVD
- User needs only to select the task sequence from the Wizard menu, all else is automated
- Hardlink user state capture and migration
The problem exists with joining the offline computer to the corporate domain. If the domain join fails, the user can't log on to his/her restored domain user profile.
Does anyone have any experience or tips related to using the Win7/2008 djoin.exe utility with an automated MDT task sequence? I can't find much information on it, and it's new to me.
I gather that you have to join the object at the domain first, then extract the required metadata, and somehow inject this individual computer data (aka Base64 blob) in the 'Microsoft-Windows-UnattendJoin/Identification/Provisioning' section of the unattend.xml
... but how to do that with some type of variable? I'd like to avoid creating a customized DVD for every single computer in the field.
I'll keep searching, but if anyone has done this before please let me know your experiences.

Appreciate the reply, but I've already read through that. I'm looking for information specific to MDT and suggestion on how to include the process in a [semi] automated task sequence in a media-based offline scenario.
A general idea would be to compile a text file of target computer names, run a script to execute djoin.exe against the list to provision all the computers, generating a base64 blob text file for each. Then, store that repository of files in the deployment
share so it is included on the MDT media. Call the file as a Run Command step using the computer name variable during the task sequence State Restore phase to execute the offline join. eg:
cmd.exe /c djoin.exe /requestODJ /loadfile %ScriptRoot%\Blobs\%OSDComputerName%.txt /windowspath %windir% /localos
In testing, provisioning an existing computer on the DC breaks any domain relationship because the computer account is reset by the /reuse parameter. The relationship can be fixed by running the /requestODJ command on the computer - essentially 'rejoining'
the machine to the domain - but it presents a problem for the time lapse between pre-staging computers and distributing the media. Since the users are all currently running XP or Vista, it doesn't make sense to explore a theory of re-using the same blob
data multiple times, such as immediately after provisioning and then again during the reimage.
I'm opening a call with MS support, but still interested to hear if anyone has used this utility with MDT at all.

How to join to virtual domain from windows 8.1 host ??

Hi there
does it possible to join to virtual domain from windows 8.1 host or not ??
I installed windows 8.1 on my system as host windows and then enable windows 8.1 hyper-v and installed windows server 2012 r2 and installed active directory domain service
now I want to join to this domain from my windows 8.1 but I can't . I create a user in active directory users and comupers and do it's DNS but can't complete .
give me this Error that may be the domain name is not correct or the user name or password is incorrect
please help me how can I join to virtual domain from windows 8.1 host in my pc ??
thanks
Regards :
Raha
whit the best regard : Raha

Yes, you can.
You will need to configure the virtual network switch as either internal or external.
Then, you'll need to specify the IP address of the virtual Domain Controller as a DNS Server on the Windows 8.1 device.

Windows 2012 R2 ADRMS domain controller version and Non-domain-joined Mac Client with outlook 2011

Hi,
What is the AD version for Windows 2012R2 ADRMS? Is it possible to have Windows 2003 R2 DC with Windows 2012R2 ADRMS?
Any installation guide Non-domain-joined Mac Client with outlook 2011?
What is the SQL version for Windows 2012R2 ADRMS?
Please advise. Thanks.
Kelvin Teang

Hi Kelvin -
There is no RMS Client for Macs. That functionality is actually provided through the Office for Mac application (this is different compared to the PC). Domain-joined clients will autodiscover the RMS server and should be able to create and consume
protected content. Non-domain-joined clients cannot automatically discover their RMS server. In this scenario, prepare a protected document or email from a domain-joined machine and send it to your non-domain-joined users. They will open
the document or email up and the URLs contained in the publishing license of the document will direct them to the correct RMS server.
I hope that helps!
Micah LaNasa
Synergy Advisors
synergyadvisors.biz

Windows 7 domain joined getting Windows 10 upgrade!!

I was building a reference image the other day for Windows 7 (we still want to use Windows 7 for "legacy" P4 machines) and it had activated itself via our KMS server and for some reason it would still show the Windows 10 Upgrade notification even though the upgrade doesn't (apparently) support KMS so it does seem there are some glitches with the update.
Also, I could understand not using WSUS in that case if its only a small collection of computers and it seems they do most work inside the XenApp server which I would hope. Although, it does sound like you have a server over there so it might be worth implementing if you ever make the move to Windows 10 as they are creating some sort of new solution that I believe is called "Windows Update for Business."

Hi,
We have several computers that are not using WSUS and are Domain Joined that are trying to upgrade to Windows 10 automatically. Luckily they are failing but it has downloaded Windows 10 into the $Windows.~BT folder.
I checked the GWX event logs and says they are Domain Joined and I know they are not suppose to get Windows 10.
I think it is to do with KB2952664 as the computers that got the Windows 10 upgrade seem to have not restarted since this re-released patch was out.
Has anyone else had this happen? I've tried search with no joy.
Even though it is failing to preform the Upgrade now we are worried that Microsoft will make a change or something will happen and the upgrade will complete...
Aaron
This topic first appeared in the Spiceworks Community

Do SCCM clients need to be domain joined for Windows Patch Deployments

Hi,
We have SCCM 2012 R2 deployed in an environment with both workgroup and domain joined machines. Currently only the domained joined machines have the SCCM client installed. We were thinking of bringing patching into SCCM rather than WSUS but were wondering
if we install the SCCM client on workgroup machines do they need to be domain mebers to work or do they just need to be able to resolve the SCCM server?BAsically, I'm looking for confimation that we can patch non-domain joined machines via SCCM.
Thanks,
Simon

Here's a nice blog post that adds some gotcha and additional detail:
http://blogs.technet.com/b/configurationmgr/archive/2014/07/01/managing-workgroup-clients-in-system-center-2012-configuration-manager.aspx
Ultimately, ConfigMgr doesn't care if systems are domain joined or not but there are some nuances and caveats that must be accounted for.
Jason | http://blog.configmgrftw.com | @jasonsandys

Windows 8.1 modern shortcut icons are not displayed in taskbar after domain join

Hello,
Like the title says: modern (metro) shortcut icons in taskbar are not displayed after domain join. There's just blank space where the icon should be for Store, OneDrive etc. Shortcuts work for classic and 3rd part applications.
Shortcut icons work properly if I log in with local account. The applications work properly whether the icons are displayed or not for every user (local and domain).

Hi,
Since this issue only happened for domain account, I suggest you check whether there're some GPOs\logon scripts applied to the domain accounts which controls the taskbar icons.
Have you tried to unpin the modern taskbar icons and re-pin the icons to the taskbar? What is the result?
Yolanda Zhu
TechNet Community Support

Sideloading on domain joined Windows 8.1 Professional Update Tablets

Similar Messages

Maybe you are looking for