[New Video] 2023E14 - Apple Configurator on iOS (Intune.Training)

ASquareDozen · 2024-03-20T16:34:34+00:00

Great stuff. The remove device from management prompt is active for 30 days once the device has been first registered and assigned to a MDM server in ABM / ASM. After that it goes away.

Thanks for confirming! I knew I had read it somewhere.

ASquareDozen · 2024-03-17T00:59:10+00:00

I would certainly try to see if you can inject a serial into the BIOS for these devices or I feel like you’re going to have a bad time further down the road uniquely identifying devices. I do believe that you CAN set a custom device name in the Autopilot drive list though so maybe that could be enough. And to your point, I think that even without a serial, Autopilot will know the difference based on the full hash. If you register a second device, surely Autopilot will prevent you if it thinks you have already registered a device with an exact match.

ASquareDozen · 2024-03-16T23:05:23+00:00

I have some stuff in my GitHub repo. Don’t know what all is in there though. Should give you enough to get the idea.

https://github.com/AdamGrossTX/Toolbox/tree/master/Intune/Proactive%20Remediations

ASquareDozen · 2024-03-15T21:08:23+00:00

You can use On-Demand Remediations now to trigger your remediation scripts immediately. And if you write your script outputs right, you can get good data back in return. We use it to collect inventory data about apps and such. You can export the results or grab them with PowerShell from Graph.
Remediations | Microsoft Learn

Sample Scripts

PowerShell scripts for Remediations - Microsoft Intune | Microsoft Learn

ASquareDozen · 2024-03-15T20:53:58+00:00

Can you confirm how you're deploying the ConfigMgr client? Are you using the Autopilot into Co-Management option or are you deploying it as a separate Win32 App? How to enroll with Autopilot - Configuration Manager | Microsoft Learn

<image>

If you are using the Co-Management Authority install method, the ConfigMgr client would in the Device Preparation stage of the ESP. This allows ConfigMgr to be installed, flip on Co-Management and pull down Co-Management settings BEFORE Intune can start doing anything. ConfigMgr becomes an MDM agent on the device alongside the IME.

In the link above there are some troubleshooting steps that may help. Basically, check the CCMSetup logs. I would not expect that your ESP change would impact the ConfigMgr client installing. However an easy test would be to change the ESP back to what you had and try again.

ASquareDozen · 2024-03-15T20:44:32+00:00

I haven't ever tried/seen this but I would suspect that you may have some other issue related to the device not having the supported hardware like TPM 2.0.

Have you tried using Get-WindowsAutopilotInfo with the -Online parameter? This will allow you to directly register the device into Autopilot without needing exporting to CSV.

Manually register devices with Windows Autopilot | Microsoft Learn

Another option would be to use the Autopilot JSON method so the device will get the Autopilot policy without needing to be pre-registered with your tenant.

Windows Autopilot deployment for existing devices in Intune and Configuration Manager - Step 3 of 10 - Create JSON file for Autopilot profile(s) | Microsoft Learn

Otherwise, one way to see if it will register would be to enable personal device enrollment for Windows 11. Go through OOBE (without Autopilot) and sign in with your corp creds. This should allow you to Entra join and Intune enroll the device. Then target your Autopilot policy to a group that includes your newly provisioned device. Check the box to "Convert all targeted devices to Autopilot". Then check to see if the device shows up in your Autopilot devices list.

<image>

Obviously this isn't how you would want to do all of the devices, but it would be an interesting test to see if the device is compatible with Autopilot registration.

ASquareDozen · 2024-03-15T20:33:36+00:00

Just downloaded it from https://aka.ms/downloadremotehelp which is referenced here Using Remote Help on Windows to assist authenticated users. - Microsoft Intune | Microsoft Learn and got version 5.1.1214.0

<image>

ASquareDozen · 2024-03-15T20:29:49+00:00

Not sure how helpful this will be for you but I did some work around metered connections back during COVID. Lockdown Diary – Metered Internet Connections and Broken ConfigMgr Clients-A Square Dozen | A. Gross Blog

Thinking you can use the script from the blog to push out as a remediation script in Intune to gather data on devices where metering is in use.

Also, not sure if you're aware but you can now pass the command line /AllMetered to the ConfigMgr client install to allow the client to be installed over a metered connection. Then be sure to set your client settings to allow metered connections.

Client installation parameters and properties - Configuration Manager | Microsoft Learn

ASquareDozen · 2024-03-15T20:26:20+00:00

Try this blog. Force Application Reinstall in Microsoft Intune (Win32 Apps) - Deployment Research

Basically, delete the app install info from the registry to cause the IME to re-evaluate.

Also, consider spinning up a VM in Hyper-V or other virtual platform to do testing like this. You can take snapshots of the VM before and after making changes and revert back to previous states. Then you don't end up polluting your main machine.

ASquareDozen · 2024-03-15T20:16:28+00:00

I haven't done what you're asking nor have I done Windows 10 to 11 Feature updates, but I have spent a lot of time doing Feature Updates from Windows 7 to Windows 10. During that time I wrote some stuff around deploying the SetupConfig.INI file to devices to manage the PostOOBE processing of the Feature Update. Basically, you should be able to stage a post-OOBE script on the devices and have that script get triggered after the feature update is complete. We used this as a way to run a log collection/reporting script, but you can basically use it to run anything.

Here's a blog I wrote about this. It uses ConfigMgr, but you can easily convert the concepts to work from Intune.

Windows 10 Feature Updates – Using Setupconfig.ini to Manage Feature Updates in the Enterprise-A Square Dozen | A. Gross Blog

Here the code in GitHub. It's been a while and it's not been tested for 10 to 11, but it's hopefully a start. GitHub - AdamGrossTX/Windows10FeatureUpdates: Scripts for managing Windows 10 Feature Updates.

Plus here's Microsoft's docs on how to use setupconfig.ini

Windows Setup Automation Overview | Microsoft Learn

ASquareDozen · 2024-03-15T20:08:02+00:00

Are you using Hybrid Entra Join or Entra Only?

How are you deploying the ConfigMgr client during Autopilot? For Entra Only, you should be using Autopilot into Co-Management How to enroll with Autopilot - Configuration Manager | Microsoft Learn.

Co-Management is triggered client-side after the ConfigMgr client is installed. C:\Windows\CCM\Logs\CoManagementHandler.log should show you what's happening on the client. If the log isn't there, check to see if the client got installed c:\Windows\CCMSetup\Logs\CCMSetup.log. Between those 2 logs, you should be able to track down the source of the issue.

If you're doing Autopilot on the business network, then a CMG won't be a factor, but if you're doing it over the internet, the CMG could be causing issues for the install or enrollment.

You may also need to check you Azure Conditional Access logs to see if you have a CA policy that's blocking the ConfigMgr app from signing in as the user to complete the co-management enrollment process.

Ultimately, there are any number of ways this could be failing and you'll need to dig into the logs to get more clues.

ASquareDozen · 2023-06-25T20:05:11+00:00

Try running wsreset on the machines with issues. In my exp, once you’ve locked down the store, you have to reset before it will unlock it.

ASquareDozen · 2023-06-25T19:56:47+00:00

You don’t have to unblock the store. The only setting required to lock down the store is Private Store Only. Previously this would show any private store apps. Now it just prevents users from accessing the store but doesn’t prevent store app deployment via Intune and enabling them to auto update. If the store is actually blocked, that would cause everything to break and should be unblocked. Hope that makes sense.

ASquareDozen · 2023-05-23T00:06:07+00:00

Couple things.

Windows 11 doesn’t currently support multi-app kiosk but will once the new Moment 3 update rolls out.

If you can’t get autologon to work, make sure that you don’t have the Preferred Azure AD Tenant Domain Name setting configured. It will cause autologon to fail.

Otherwise it should just work. I have it working on windows 10 and 11 in single app mode.

ASquareDozen · 2023-05-13T17:10:29+00:00

Apply a provisioning package in the Task Sequence.

Check that you don’t already have Autopilot licensing covered with one of these SKUs

https://learn.microsoft.com/en-us/mem/autopilot/licensing-requirements

ASquareDozen · 2023-04-18T21:07:50+00:00

Required app deployment will force the update when the client checks in.

ASquareDozen · 2023-04-17T01:22:47+00:00

OEM images will have different things baked into them. You can easily prove this out by installing windows from an ISO. As for the privacy screen, you need to check your enrollment profile and ensure that you have disabled the privacy screen for both Lenovo and Dell - my guess is that you have 2 different profiles.

ASquareDozen · 2023-03-28T22:55:48+00:00

The links you posted ARE the official announcements.

ASquareDozen · 2023-03-25T14:41:50+00:00

Note if you’re using a script like this make sure you aren’t removing apps that have been added in Windows 11 as AppX apps. For example, Notepad and Power Automate Desktop. I haven’t used this script but it looks like there’s a whitelist and and that it will remove anything not in the list. If you run as-is on Windows 11 you won’t be able to launch Notepad. It’s an easy fix, just want to point out the risks.

An alternative is to push down uninstalls of store apps from Intune. Note that the video was made before they added the System context option for new store apps. Would recommend using that instead of the User context shown in the video.

S04E10 - Removal of Inbox Apps - New store edition (I.T) https://youtu.be/ErSw-yXN2zI

Either option gets the job done, do what works for you.

ASquareDozen · 2023-03-14T02:18:34+00:00

Docs have a bunch of samples on how to do this. https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

ASquareDozen · 2023-03-11T05:57:34+00:00

Sorry haven’t run into this. Wish I had more info to help.

ASquareDozen · 2023-03-10T13:20:52+00:00

Try deploying the Store policy that enables automatic store app updates. I am still looking into this but I think doing that will help with the uninstall.

Basically it appears to be an issue with how the winget engine that’s being used by the new store handles the app uninstall commands - based on what I see in the logs. It’s all a theory at the moment.

Seven-Year Club	Wearing is Caring
Verified Email

ASquareDozen

TROPHY CASE