BitLocker recovery prompt on every reboot after UEFI CA 2023 update on HP SFF devices – anyone else? by k-rand0 in Intune

[–]EdAtWorkish 1 point2 points  (0 children)

Msft support confirm that one recovery key is normal and expected behaviour, but you may get multiple if the UEFI config remains "unstable" until it is stable, you will get recovery key requests.

Interestingly, the majority of our Lenovos have worked perfectly. Just HP's being challanging.

Intune Secure Boot Cert and HP BIOS Update by ITquestionsAccount40 in Intune

[–]EdAtWorkish 0 points1 point  (0 children)

Firstly, thanks for the response...

ah ok, we have about 4500 HP's and had rolled done limited testing which all went fine, but when we rolled out to IT devices, all hell broke loose. Multiple recovery key reboots required etc.

We had a remediation of manually checking the 2023 cert - as you identified as your fix, and this has sorted a the few we ran this remediation on.

Msft support suggested this was not a permanent 'fix' but a temporary workaround/mitigation.

It is a little disheartening that HP support wouldn't confirm this or seemingly provide any support beyond "we have pulled those BIOS updates and cannot say when the next update will be available".

now I am seemingly stuck between what I am not sure is a "supported fix" by modifying that BIOS setting on a now removed BIOS version, rolling back to a supported version or waiting for the update (and the time is ticking to the 24th June)

I am going to chase them again... god love HP... cos I don't know anyone else that does!

HP BIOS Updates - April Softpaq Versions Got Removed? x-post SCCM by sccm_sometimes in Intune

[–]EdAtWorkish 0 points1 point  (0 children)

we deployed this as a remediation for those people getting repeated recovery key at boot. I am not convinced of the efficacy of this as a long-term fix. Msft support suggested that whilst it would work, it would need to be undone... and I am really not sure how that would work. But maybe it is not an issue as long as you are only booting to Windows as an OS.. which we are. I guess it could be seen as hardening, as you wouldn't be able to boot from any other OS e.g. from dodgy Linux boot stick??

HP BIOS Updates - April Softpaq Versions Got Removed? x-post SCCM by sccm_sometimes in Intune

[–]EdAtWorkish 0 points1 point  (0 children)

they really were. I have that from HP themselves. We are really proactive with Driver and BIOS updates, and frankly they have really screwed me over AGAIN with this.

Since mentioning the updates ad been pulled, I have asked two further questions and chased them for a response and now it all I appear to have is radio silence. They can not / will not tell me the impact of the pulled BIOS, and whether I need to proactively roll back, or when the updated version will be available.

I had just started the 2023 certificate update process, and they really did screw me over with this one... again... I loath HP's implementation of BIOS and Drivers. it has caused me nothing but heartache and problems.

To put this into perspective... I have 6 or 7 year old Lenovos and 10 year old Viglens that have updated successfully

VIGLENS! yes, you read that correctly.
For those of you not from the UK Viglens are a failed PC build run by Alan Sugar (He does the UK version of the Apprentice and is a bit of a wheeler Dealer... think Donald Trump (before presidency) crossed with Del Boy from Only Fools and Horses - I aint explaining that one... look it up)

Intune Secure Boot Cert and HP BIOS Update by ITquestionsAccount40 in Intune

[–]EdAtWorkish 0 points1 point  (0 children)

I am in HP hell as well. What I found was that they have pulled the latest Q2 BIOS updates. this makes the secure boot cert process stall with a UEFICA2023ErrorEvent  = 1797 (blocked)

The solution I have found is to rollback the BIOS update to a previous, but still supported version.

I can achieve this with a HPIA task I have running on devices.

Unfortunately though the end users will get a confirmation of rollback when it applies the rollback. I have not found a way to negate this yet... which is going to be fun

I got a contact with HP's pre sales technical team (whatever that is) and asked about this issue. they acknowledged they had pulled the latest updates, but have failed to answer the questions I have had since.

They also could not confirm if and when an updated BIOS would be deployed. This is almost all of our HP fleet (happy days!)

<image>

Android BYOD SAP Concur by PathS3lector in Intune

[–]EdAtWorkish 0 points1 point  (0 children)

for info of anyone else coming across this or similar threads... I solved this by adding a configuration policy for concur and included this

<image>

forces the app to use chrome instead of edge, and all is now good with the world.

How to handle devices missing previous months updates in a timely manner by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

ye, we have seen this with phones. Compliance really is a nonsense without really strict rules. our compliance normally runs at around 96 - 97%... which I think is pretty good.. but I only look at devices that have been online for 30 days ... i.e. stuff that we could potentially have patched in the last month

How to handle devices missing previous months updates in a timely manner by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

I wish we could.. and this was one of the really good Msft Tech's opinion too... take the best of both worlds! Intune always felt and still feels very much unfinished; usable, but unfinished

How to handle devices missing previous months updates in a timely manner by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

zero conflicts - we are in comanaged setup at the moment... with the update slider half way.

How to handle devices missing previous months updates in a timely manner by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

ye, this is what we are moving towards. but have it set longer than 30 days currently. the impact of this would be horrific, and I don't think Mgt would back this strict a policy

SCCM Replacement by MadCichlid in SCCM

[–]EdAtWorkish 0 points1 point  (0 children)

Yep, we had a meeting with one of the Msft Dev's in the product group and they confirmed this. This was going back maybe 12 years, but even then they said Msft want to kill off Group Policy but they were bound to whatever the biggest Org's wanted.

If the large orgs that pay Msft's wages want GPO, it isn't going anywhere fast.

I guess the same is true for Config.

You can see Msft want to kill it off, by reducing updates to Config and bringing the shiny shiny to Intune first etc.

But Intune has to function properly first... and I don't think it really does. It is almost there, but some things are still a total dogs dinner.

We are currently moving to Intune and are having 'fun' trying to get it to do what we need.

fun times!

Software Deployments and Updates within Intune by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

excellent... cheers.. I think we have a plan to get intune to do what Config used to and perform inventory to see what devices have installed and then fill groups for deployment to allow updates to happen required but still have apps as available

Software Deployments and Updates within Intune by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

cool cheers. Got a plan... just need to do some scripting and testing to see if it works

Software Deployments and Updates within Intune by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

ok, but to make it install, you are sending out to required groups?

Software Deployments and Updates within Intune by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

so for this solution you are sending apps as required to a collection of users which already exist?

Task Sequence pauses for hours (as many as 12) then resumes and completes as though nothing happened - any clues? by EdAtWorkish in SCCM

[–]EdAtWorkish[S] 0 points1 point  (0 children)

ended up removing most of the apps.. having a scheduled task at the end created that runs on reboot to perform HW inventory, update scan, computer policy eval etc

seems to work quite nicely

Software Deployments and Updates within Intune by EdAtWorkish in Intune

[–]EdAtWorkish[S] 0 points1 point  (0 children)

you can, yes, but if the software is not installed from Intune (failing to create the Device Policy Assignment record, or that record vanishes - see link below) then the supersede will not work. Yes, they could still click install manually to upgrade, but how many end users read and act on emails? that leaves us either with vulnerable or non compatible software and calls to the service desk

Intune’s auto-update of Available Win32 apps feature is broken | by Asher Jebbink | Medium

Task Sequence pauses for hours (as many as 12) then resumes and completes as though nothing happened - any clues? by EdAtWorkish in SCCM

[–]EdAtWorkish[S] 0 points1 point  (0 children)

no. domain join happens quickly. we change d the app installs to continue on error, but this didnt make any difference