This article describes a Mobile Device Manager (MDM) client update for Windows RT 8.1 and Windows 8.1. This update contains the following improvements and fixes the following issues.
Note The following document is also updated with the additional "3.6 XML Provisioning Document Schema" section:
Note For more information about the ResetUserPassword static method, go to the following Microsoft website:
Note For more information about this improvement, go to the following Microsoft websites:
After you install this update, a Transport Layer Security (TLS) mutual authentication session is negotiated correctly.
Improvement 1
The enrollment provisioning document supports intermediate certificates in addition to the device certificate and the root CA certificate. This update adds a management solution to provision a chain of more than two certificates onto the device.Note The following document is also updated with the additional "3.6 XML Provisioning Document Schema" section:
Improvement 2
A new ResetUserPassword static method is added to the MDM_Client WMI class. This method is added to support a helpdesk-aided password reset scenario for when the user of the device forgets the password. In this scenario, the administrator can push a known password to the device. The password must be sent to the user out of band of the management channel. When the user receives the known password and logs on to the device, they are forced to change the password.Note For more information about the ResetUserPassword static method, go to the following Microsoft website:
Improvement 3
The MDM client supports an enrollment-on-behalf-of protocol. This lets a local administrator enroll a standard user into management on the device.Note For more information about this improvement, go to the following Microsoft websites:
Issue 1
The LockWorkstation static method in the MDM_Client Windows Management Instrumentation (WMI) class fails when it is called to lock a workstation.Issue 2
The MDM client sends the first request to the management endpoint without providing the device client certificate. Then, the client looks for a specific error code and reissues the request with the device client certificate included. However, certain server-side Secure Sockets Layer (SSL) implementations cannot be configured to return the error code. Additionally, the client does not return the full certificate chain in the SSL handshake.After you install this update, a Transport Layer Security (TLS) mutual authentication session is negotiated correctly.
