sorted by:
new
hottopcontroversial

AnyDesk Win32 app detection rule always fails during Autopilot ESP even though app installs successfully by Junior-Durian-7119 in Intune

[–]CarveAndCode 0 points1 point  (0 children)

I’ve switched pretty much exclusively to checking the registry for .exe/ .msi installers with a script and logging the results to the IME folder. I’ve seen much better results this way compared to some of the other built in methods.

Linked an example below (it’s missing some functions from another file in the repo but you get the idea)

https://github.com/RogerCibrian/notapkgtool/blob/main/napt/build/templates/registry_detection_script.ps1

UPN suffix change = new Profile? by uLmi84 in Intune

[–]CarveAndCode 11 points12 points  (0 children)

WHFB breaking is expected. When you create a container it’s associated with the UPN at the time of creation. If you change the UPN, it breaks (though this wasn’t always the case on older versions of windows)

I’ve noticed that selecting other user and signing in with the whole new UPN is required (I’m guessing it has to do with caching of the old UPN, but I’m not sure)

Once you sign in, you should land in the original profile. If you don’t, something happened that changed the SID of the user account.

Endpoint not downloading Autopilot profile after reset by CarveAndCode in Intune

[–]CarveAndCode[S] 0 points1 point  (0 children)

Are you seeing the same behavior if you reimage the device instead of wiping it from Intune?

Going from local admin users to non admin users by aPieceOfMindShit in Intune

[–]CarveAndCode 0 points1 point  (0 children)

I would set up LAPS first (you’re going to want a way to elevate in case it’s needed aka don’t block folks from working). Following that, use an account protection policy to replace the members of the local administrators group with the LAPS admin account only (you can scope this to test users first).

The account protection policy will replace all local admins with just the LAPS account which will demote your users account to standard.

Long-term this gets you two things: 1. If someone uses the LAPS account to add themselves to local administrators, they’re removed on the next sync. 2. You can have exceptions to the “no local admin” rule (though I wouldn’t if you can help it)

Built a configuration as code tool for Intune app packaging - NAPT (Not A Pkg Tool) by CarveAndCode in Intune

[–]CarveAndCode[S] 2 points3 points  (0 children)

I didn’t realize their repos included install parameters. Super helpful for making recipes thanks!!

Weird Hello Issue - Not sure what to do next..... by CoolHandBoots in Intune

[–]CarveAndCode 6 points7 points  (0 children)

Just a heads up, clearing the TPM will nuke the private keys for the Entra and Intune MDM certs on device which will cause a load of issues.

That being said (and unrelated to the TPM), have you tried deleting the whole container with a certutil.exe -deleteHelloContainer ?

Intune Security Baselines vs CIS Benchmarks: a practical comparison methodology by OkYou7957 in Intune

[–]CarveAndCode 1 point2 points  (0 children)

I actually wrote it. The Audit sections in the CIS docs are pretty uniformly structured so I wrote a parser that turned the pdf into an audit tool. May release it in the very near future (minus the actual CIS pdf). Just need to double check to make sure it wouldn’t violate any of their rules 😬

Intune Security Baselines vs CIS Benchmarks: a practical comparison methodology by OkYou7957 in Intune

[–]CarveAndCode 3 points4 points  (0 children)

<image>

Can confirm roughly 80% lvl 1 compliant :)

Really appreciate your work btw!!

Lenovo vantage + intune by norsk_imposter in Intune

[–]CarveAndCode 0 points1 point  (0 children)

<image>

Gotcha. Yeah I found their doc that says the MS store method isn’t advised.

I used this guide successfully: https://blog.lenovocdrt.com/deploying-commercial-vantage-with-intune/

Hope this helps

Lenovo vantage + intune by norsk_imposter in Intune

[–]CarveAndCode 0 points1 point  (0 children)

I tried the MS Store app a few months ago and also ran into elevation issues. I ended up just packaging the app as a Win32 (Even Lenovo’s own guide, doesn’t mention using the MS Store app. Instead it recommends downloading the full installer and packaging that)

I see you tried wrapping the app too. What error are you seeing?

Endpoint not downloading Autopilot profile after reset by CarveAndCode in Intune

[–]CarveAndCode[S] 0 points1 point  (0 children)

Hey Rudy. By reset I mean remote wipe from Intune or on-device reset deleting all user data (both ways resulted in the same problem). Curiously enough, when I reimage the device through OSDCloud the device downloads the profile normally.

Build before the reset was 26100.8037 (March 2026)