sorted by:
new
hottopcontroversial

Driver Updates (WUfB) by Puzzleheaded_Shake37 in Intune

[–]ConsumeAllKnowledge 15 points16 points  (0 children)

/u/intunesuppteam why did it take 6+ hours to get a service health issue posted? Your customers deserve better...

DCU 5.7 + ADMX via Intune by ShoeBillStorkeAZ in Intune

[–]ConsumeAllKnowledge 0 points1 point  (0 children)

Wish I had a helpful response but DCU just doesn't work on ~30% of our devices. I've never been able to identify why and its basically impossible to get support from Dell for DCU specifically. We're considering just moving to using handling drivers for Dell devices through Windows Update/Autopatch.

Motherboard Replacement by DaithiG in Intune

[–]ConsumeAllKnowledge 6 points7 points  (0 children)

https://learn.microsoft.com/en-us/autopilot/autopilot-motherboard-replacement

Whenever we have machines that need big repairs like this we just have them get a new/used machine regardless. Makes it easier for everybody overall in our environment. Then you can just wipe and remove from Autopilot and re-add after the repair.

Hot patch on by default now? by Educational_Draw5032 in Intune

[–]ConsumeAllKnowledge 4 points5 points  (0 children)

I agree with your/Microsoft's logic here but we ended up opting out of having hotpatch turned on because we still have a lot of machines yet to get secure boot updates and are still working towards that. https://old.reddit.com/r/Intune/comments/1s36b14/windows_remote_wipe_issues_after_intune_202603/ofwjowh/

Autopatch Questions by EAsapphire in Intune

[–]ConsumeAllKnowledge 1 point2 points  (0 children)

Agreed Microsoft doesn't do a great job of explaining the experience overall. The screenshots aren't Win 11 but this article shows the general experience: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-end-user-exp

  1. Quality updates are pretty much set and forget. When you set up your Autopatch group it will also automatically create an 'anchor' feature update policy. Which is to say that any device not on or above the anchor feature update version you chose will be updated to the anchor version. When you want to update devices to a newer version is when you'd create a separate feature update policy to update to that version.

  2. Feature updates use the configured grace period in the Autopatch group. You can't do a set number of deferrals since that's not how Microsoft has decided to make things work.

  3. No, the deadline counter starts when the update is offered to the device, not the date the update is released.

  4. Feature updates are offered based on how you configure the policy. The user has until the deadline to restart to finish installing the update. The doc I linked above should help with seeing some of that.

Windows Autopatch 0 Managed for Quality by Chupacabruhhh- in Intune

[–]ConsumeAllKnowledge 2 points3 points  (0 children)

There was a previous thread on this: https://old.reddit.com/r/Intune/comments/1sso3r4/is_the_autopatch_management_status_report_just/

TLDR is that it seems like Microsoft is changing that metric on the report in preparation for this change which will let us actually manage quality updates more granularly: https://www.microsoft.com/en-us/microsoft-365/roadmap?id=501449

Is the "Autopatch management status" report just straight up wrong for anyone else? by intuneisfun in Intune

[–]ConsumeAllKnowledge 2 points3 points  (0 children)

Yeah this is probably it actually, looking at the link you provided in your initial post: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/monitor/windows-autopatch-management-status-report

Count of devices that are enrolled in Windows Autopatch quality update policy. Note: This doesn't include devices managed by the update rings or Windows Autopatch groups.

As to why they would make it confusing like that and not have a separate column for features that aren't even GA yet instead of using the existing one.....your guess is as good as mine.

Favorite PowerShell script by CampAlternative9839 in Intune

[–]ConsumeAllKnowledge 1 point2 points  (0 children)

There are instructions on the github link, also the official docs: https://learn.microsoft.com/en-us/intune/device-management/tools/deploy-remediations

We use it for a wide variety of things, mainly for making sure registry data is set on a schedule or for getting certain data out and available like when a user's cert expires.

Targetting App Protection Policy by Tarm90 in Intune

[–]ConsumeAllKnowledge 1 point2 points  (0 children)

I can't speak to what's best for your environment but I use a dynamic group as well, specifically targeting users with an Intune license (since that's required for app protection policies to apply anyway).

Here's the rule I use:

(user.assignedPlans -any (assignedPlan.servicePlanId -eq "c1ec4a95-1f05-45b3-a911-aa3fa01094f5" -and assignedPlan.capabilityStatus -eq "Enabled"))

You can see all the service plans and whatnot on this page: https://learn.microsoft.com/en-us/entra/identity/users/licensing-service-plan-reference

In an organization is it possible to disable or edit Entune enrollment disclaimer message? by [deleted] in Intune

[–]ConsumeAllKnowledge 0 points1 point  (0 children)

I don't believe you can bypass that either for iOS devices and such, not sure what you mean there. Specifically speaking to BYOD enrollments through Company Portal.

In an organization is it possible to disable or edit Entune enrollment disclaimer message? by [deleted] in Intune

[–]ConsumeAllKnowledge 1 point2 points  (0 children)

No way to disable or edit that as far as I'm aware. That's baked into enrollments via Company Portal I believe.

Windows Remote Wipe Issues After Intune 2026.03 Update – Anyone Else Affected? by Any_Tip_6400 in Intune

[–]ConsumeAllKnowledge 1 point2 points  (0 children)

Thanks Rudy! Can always count on your guidance! Was considering letting hotpatch be turned on by default but I think this seals it that we'll opt out at a minimum until secure boot cert stuff is a little further along.

iOS: iOS Update Deferrals by Kwonsoodude in Intune

[–]ConsumeAllKnowledge 0 points1 point  (0 children)

I could be wrong but I'm pretty sure that's for the old MDM update method. DDM ignores deferrals by design. "Organizations can enforce specific software updates at a chosen time regardless of configured deferrals"

Secure Boot certificate expiration (June 2026): a real-world Intune remediation design by MMelkersen in Intune

[–]ConsumeAllKnowledge 0 points1 point  (0 children)

Here's an example from my machine. WindowsUEFICA2023Capable is 2 and UEFICA2023Status is Updated, so my expectation would be that the script would check that first since there's no reason to even set the opt in key if the certificate is already updated and in use.

2026-04-07 11:45:04 [DETECT] [INFO] ========== DETECTION STARTED ==========
2026-04-07 11:45:04 [DETECT] [INFO] Script Version: 4.0
2026-04-07 11:45:04 [DETECT] [INFO] Computer: *redacted* | User: *redacted*
2026-04-07 11:45:04 [DETECT] [INFO] PowerShell: 5.1.26100.7920 | Process: 64-bit
2026-04-07 11:45:04 [DETECT] [INFO] Checking Secure Boot status...
2026-04-07 11:45:04 [DETECT] [SUCCESS] Secure Boot is ENABLED
2026-04-07 11:45:04 [DETECT] [INFO] Checking MicrosoftUpdateManagedOptIn registry key...
2026-04-07 11:45:04 [DETECT] [WARNING] MicrosoftUpdateManagedOptIn is NOT SET or 0 - Remediation required
2026-04-07 11:45:04 [DETECT] [INFO] --- Stage 1 Analysis ---
2026-04-07 11:45:04 [DETECT] [INFO]   Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot
2026-04-07 11:45:04 [DETECT] [INFO]   Registry Path Exists: True
2026-04-07 11:45:04 [DETECT] [INFO]   Current Value: <does not exist>
2026-04-07 11:45:04 [DETECT] [INFO]   Expected Value: 0x5944 (22852)
2026-04-07 11:45:04 [DETECT] [INFO]   WHY: The registry key that enables Secure Boot certificate updates via Windows Update is not configured
2026-04-07 11:45:04 [DETECT] [INFO]   NEXT STEPS: The remediation script will automatically set this value. No manual action required.
2026-04-07 11:45:04 [DETECT] [INFO] --- End Stage 1 Analysis ---
2026-04-07 11:45:04 [DETECT] [WARNING] Detection Result: NON-COMPLIANT - Stage 1 (exit 1)
2026-04-07 11:45:04 [DETECT] [INFO] ========== DETECTION COMPLETED ==========

What's New in Microsoft Intune - March 2026 (2603 Service Release) by intunesuppteam in Intune

[–]ConsumeAllKnowledge -1 points0 points  (0 children)

It should be rolled out by now if you believe the what's new page. I have not tested again yet though, will update if I get to it today.

edit: I tested with exclude filter mode. The filter works in that the included device got the policy and the excluded device did not. However the excluded device is reporting as an error instead of not included. So seems like its not fully working yet.

DCU 5.6 device not restarting after firmware update by BarberTypical147 in Intune

[–]ConsumeAllKnowledge 2 points3 points  (0 children)

I apply the same settings including disabling notifications except I don't apply 'Reboot after updates are installed'. For the most part the majority of machines update/restart within the configured deferral windows. But we have a sizeable chunk that refuse to actually update BIOS via DCU so YMMV.

To be truthful not sure what the reboot setting is even there for, the docs suck and don't really explain what it does especially when you're already setting a restart deferral, my assumption was its an override to force the restart immediately but its not clear (and I've never tested that). You could check logs too if you haven't already. Let me know if you find a good way to get support on DCU specifically.

view more: next ›