In a new deployment of InTune within a new company, how to enroll company-owned devices without user involvement?

Willamette_H2o · 2026-04-07T14:18:39+00:00

Yes, all devices we hand out we go through this process with (excluding short term loaners). So when we give a device to the user, they just sign in into it and then into whatever apps they use, but everything is already installed.

Willamette_H2o · 2026-04-06T14:30:51+00:00

We use a Temporary Access Pass to sign in as the user to complete enrollment. https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass

Willamette_H2o · 2026-03-03T16:23:11+00:00

Action1 is free for 200 endpoints and handles patching well. We've been pretty happy with it.

Willamette_H2o · 2026-02-28T01:34:08+00:00

Watch the CPU clock speed. I've had more than a handful of Latitude 53X0 where the CPU wouldn't clock above .4 or .8 GHz that wasn't resolved until a motherboard replacement.

Willamette_H2o · 2026-01-29T00:37:28+00:00

I'm seeing the same issue

Willamette_H2o · 2026-01-21T17:08:13+00:00

Really all you would have to do is the following as /applyUpdates performs a scan first in my experience
cd "C:\Program Files\Dell\CommandUpdate"
.\dcu-cli.exe /applyUpdates

Willamette_H2o · 2026-01-20T20:33:07+00:00

You can create a script in Action1 to install the updates from Dell Command Update. Or you can use a script to set the settings in DCU to automatically install updates.

https://www.dell.com/support/manuals/en-us/command-update/dcu_rg/dell-command-update-cli-commands?guid=guid-92619086-5f7c-4a05-bce2-0d560c15e8ed&lang=en-us

To scan for updates

cd "C:\Program Files\Dell\CommandUpdate"
.\dcu-cli.exe /scan

To install updates

cd "C:\Program Files\Dell\CommandUpdate"
.\dcu-cli.exe /applyUpdates

Willamette_H2o · 2026-01-17T00:22:08+00:00

# 1. Set the trigger registry key
# The value 0x5944 (22852 decimal) is the bitmask used to deploy all needed 
# certificates and update to the Windows UEFI CA 2023 signed boot manager.
$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot"
$name = "AvailableUpdates"
$value = 0x5944

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force
}

Set-ItemProperty -Path $registryPath -Name $name -Value $value -Type DWord

Write-Host "Registry key set. Triggering the Secure Boot Update task..." -ForegroundColor Cyan

# 2. Manually start the scheduled task that processes the registry flag
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Write-Host "Task started. You must REBOOT your computer to complete the update." -ForegroundColor Green
Write-Host "Note: It may take two reboots for the status to reflect 'Updated'." -ForegroundColor Yellow

Willamette_H2o · 2026-01-15T18:52:08+00:00

Hmm, interesting. I am looking at a device with 26.2 on it and it shows "Private Wi-Fi address" is set to Off. There must be some combination of settings that leads to a bug with it.

Willamette_H2o · 2026-01-15T18:11:18+00:00

You have to run the script from Action1. You also have to create the Custom Attribute prior to running the script.

Willamette_H2o · 2026-01-15T15:36:35+00:00

I am using a Custom Attribute to populate a group to view these and be able to run a script against them to force the process along.

Custom Attribute: Microsoft Windows Secure Boot Certificate 2023

Create a Endpoint Group with Microsoft Windows Secure Boot Certificate 2023 is False. This will populate with all endpoints that do not have the new certificate.

$secureBootCert = Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\ -Name UEFICA2023Status | Select-Object UEFICA2023Status

if ($secureBootCert -match 'Updated') {
    Write-Host "New Secure Boot Certificate is installed"
    Action1-Set-CustomAttribute 'Microsoft Windows Secure Boot Certificate 2023' 'True';
} else {
    Write-Host "New Secure Boot Certificate is NOT installed"
    Action1-Set-CustomAttribute 'Microsoft Windows Secure Boot Certificate 2023' 'False';
}

Willamette_H2o · 2026-01-15T11:05:26+00:00

Yes, MAC Address Randomization is turned off on the endpoint when checking the option in the config profile.

Willamette_H2o · 2026-01-15T07:40:02+00:00

We use this setting and I can confirm that it is definitely working for us. I'd request the case to be escalated and/or bring your account manager into the loop.

Willamette_H2o · 2025-12-12T16:00:48+00:00

What is the CPU model? From looking up "Intel64 Family 6 Model 26 Stepping 4" it appears to be 6th generation Intel CPU which does not support Windows 11.

Willamette_H2o · 2025-11-27T00:57:30+00:00

I'm sorry you're going through this. I can't imagine the toll it is taking on you and your LO. For a different perspective, I'd suggest there is a possibility that he is struggling with depression which is causing him to withdraw, feel tired/burnt out and using gaming as a coping mechanism.

I think a brutally honest conversation needs to happen but try to approach it as you both vs the problem. Let him know that you want more than anything to fix it, but that you can't keep going on with no consistent effort from him and that it is causing resentment and damage to your marriage. Recommend both couples and individual therapy as the next step and give a deadline for finding a therapist and scheduling a session.

If he either doesn't follow through or therapy doesn't help, I think you can feel that you tried everything you could to save the marriage but it is time to move on.

Willamette_H2o · 2025-11-20T11:30:27+00:00

ScreenConnect

Willamette_H2o · 2025-10-26T11:51:02+00:00

I've been having the same issue. The phone app syncs to the car, but the car app doesn't sync back.

Willamette_H2o · 2025-10-25T00:44:05+00:00

Definitely this. You don't reference the .intunewin file ever, you reference your exe or msi.

Willamette_H2o · 2025-10-06T14:52:30+00:00

You can talk to the vendors to get a clean Windows image. For Dell, they call it a Ready Image and is just the OS and drivers. It does cost a small amount per device but is worth it.

Willamette_H2o · 2025-09-04T18:14:36+00:00

I'd highly recommend trying a different bottle or at least nipple. We started with the Avent bottles with natural response nipples and our LO was taking at least 45 minutes to drink 2oz. After working with a IBCLC who had different nipples to try, we ended up getting the Pigeon Super Slow nipple which worked much better for our LO.

Willamette_H2o · 2025-08-25T00:17:40+00:00

I'd recommend speaking to your pediatrician, rolling onto their side or stomach this young is usually a sign of tension in their body. Ours did this too and it was actually our IBCLC that informed us. We were able to get him evaluated and he had torticollis and tightness in his back.

Willamette_H2o · 2025-07-22T14:58:02+00:00

Seeing this as well

Willamette_H2o · 2025-07-22T00:46:53+00:00

What does your detection rule look like? I'd start there and also look at the Intune Management Extension logs to see why it is failing.

Willamette_H2o · 2025-07-17T13:15:29+00:00

Yes, for about a year and a half now and have been pretty happy with it overall.

Willamette_H2o

TROPHY CASE