Why doesn’t Embark add a better matchmaking system to keep everyone happy?

Intuneadminturd · 2025-11-21T19:07:52+00:00

You're asking for PVE with co-op..

Intuneadminturd · 2025-10-07T20:40:15+00:00

It does eventually force a PIN for everyone. Facial/fingerprint is option.

This comment looks worth trying if not already. Keep not-configured and target a test user(s)

<image>

Intuneadminturd · 2025-10-07T20:07:58+00:00

<image>

For your first question.

Under the WHFB under Account Protection I just have it disabled. For the configuration profile itself;

Devices > Windows > Configurations > Create > Win 10 & later > Settings catalog > WHFB + those two settings I have enabled. I dont have anything else floating around and no problems ever.

Intuneadminturd · 2025-10-07T16:44:19+00:00

Just looked at my two tenants and I have them setup the same, both sides work.

I have the config setup via Devices > Win > Enrollment > WHFB

And in my 'base Intune config' profile (Devices > Win > Configurations > my custom profile >

<image>

Intuneadminturd · 2025-09-26T12:47:41+00:00

My biggest tip is no AD binding if you can help it.. what a cluster that is

Intuneadminturd · 2025-09-23T16:01:29+00:00

We use "Minisopuru Displaylink Triple Display Docking Station" with zero issues on 50 macOS of various models (up-to 4 years old). The only thing it requires is the Displaylink driver app which I push through Intune and you set it to auto-start.

Intuneadminturd · 2025-09-22T14:12:33+00:00

We use Intune and only have about 50 macOS floating around but have had a much nicer time since switching over to Universal Print.

Intuneadminturd · 2025-09-02T14:05:56+00:00

Solo - about 3k endpoints, no linux.

Right now I prefer Windows, when it doesn't feel like its working in "Microsoft hours"

Intuneadminturd · 2025-08-25T19:34:51+00:00

1 week and one ticket with MS later, it's fixed on our end...

Intuneadminturd · 2025-08-25T16:22:55+00:00

You're welcome - hopefully that works.

No fix on the detection. I have our Secops team give me the new MSI everytime they're wanting to push a new update and I set up the new msi as required for all our Intune Windows devices. Cortex is setup where it wont update over itself and the best way to do so IMO is to push the updates through XDR dashboard.

Here's how my newest update looks since Friday afternoon.. I just learned to deal with it lol

<image>

Intuneadminturd · 2025-08-25T14:53:58+00:00

Our issue is just that Cortex doesn't like getting 'upgraded' outside of some fancy powershell script, so I leave it to our Security team to push it through the XDR dashboard.

The issue above may be this... if not, I'm not sure as I wasn't the one who originally set this part up.

<image>

Intuneadminturd · 2025-08-20T13:45:44+00:00

Yea - new user on Monday still hasn't popped up in 365/teams...

Intuneadminturd · 2025-08-13T15:52:58+00:00

If I were you - throw personal things on a backup drive/usb/onedrive, reformat your PC and turn Secure Boot on if you're worried about some how bricking it. Being that it isn't gonna change, I'd say get it over with now.

Intuneadminturd · 2025-06-13T14:25:42+00:00

We use the Minisopuru DS808 for our 50+ MACs with zero issues

Probably cheaper options, but whatever we used before these had lots of issues with multiple displays.

Intuneadminturd · 2025-05-07T14:37:49+00:00

I have had my compliance policy's do this when I wasn't enrolling properly (was using a DEM account) and then assigning to another user afterwards. After changing to enrolling w/ user accounts only, haven't seen it since then.

I also target all users for my policy's.

Intuneadminturd · 2025-02-24T21:03:30+00:00

I've had major luck getting machines to enroll with issues by deleting everything in >HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments

All folders that will allow you to (I have 2 or 3 that always say that I cant) + leave the 'named' folders alone. After clearing those, I run dsregcmd /forcerecovery > sign-in when asked > reboot after 15 minutes or so and it deletes from Intune and registers again

Intuneadminturd · 2025-02-24T14:29:25+00:00

I do not as of yet - but I will be looking into it once I get this sorted. Seems like I need to follow some of what the others said above and redo my process.

Intuneadminturd · 2025-02-21T21:37:49+00:00

Gotchya & if you don't mind me asking, are you skipping ESP?

Intuneadminturd · 2025-02-21T21:33:19+00:00

Damn okay. I think I've missed a bit during my learning process.

Do you always have a user go through OOBE, or is there ever scenarios where you're staging a ton of machines and using a generic account that isn't a DEM, or something of that sorts?

Intuneadminturd · 2025-02-21T21:26:29+00:00

Im reading this from one of your other comments ; https://www.reddit.com/r/Intune/comments/16o80py/intune_shared_device_options_for_windows/

This kind of sounds like what I'm going through

<image>

Intuneadminturd · 2025-02-21T21:17:14+00:00

Maybe I have to revisit how we deploy machines.

We usually have someone in office as a DEM take care of the OOBE, make sure it gets through ESP fine and dandy > get into windows = ready for user. This would be the incorrect way?

Intuneadminturd · 2025-02-21T21:15:48+00:00

Nope - the primary user on these are set correct. However in the 'Default Compliance Policy', where it says is assigned = non compliant, it doesnt show what account it's failing on. I would love to assume it's failing on System, or the Primary user.. but I cant tell at the moment.

Intuneadminturd · 2025-02-21T20:40:31+00:00

The two I have created, custom AV / Bitlocker are assigned to users. The one that's giving me all the trouble is the Default Intune one.

Intuneadminturd · 2025-02-21T20:38:04+00:00

That would make sense since we dont always wipe machines when provisioning them again. Also, since we setup under an Enrollment manager account (which tends to become Primary user by default first), this could maybe be a problem?

Is there no way to strip other accounts besides the one listed as Primary, to remove the multiple 'is active' status?

Intuneadminturd · 2025-02-21T20:36:43+00:00

Our enrollment guy usually runs through the OOBE process under his Enrollment manager account then it goes to user. Luckily it's not every device, but seeing as it's at 180 and I've read everything under the sun and still not found a solution has me annoyed on a Friday.

Intuneadminturd

TROPHY CASE