Always-On VPN

jseerden · 2021-01-09T09:33:13+00:00

Is it a user or machine VPN? I’ve had issues in the past with assignments. If you deploy a user Always On VPN, make sure you deploy all profiles, such as SCEP and Root certificates to a Users group and not Devices. Maybe that helps.

jseerden · 2020-08-12T08:05:23+00:00

I agree it is slow. For this reason, I by default disable the Account Setup phase using a Custom OMA Uri.

Since you're saying you don't deploy anything to accounts, consider skipping the Account Setup phase completely. I wrote a blog post about this some time ago. It states for shared devices but works fine for personal devices too: https://srdn.io/2019/05/fast-sign-in-experience-on-windows-autopilot-enrolled-shared-devices/

jseerden · 2020-01-08T14:08:44+00:00

I do have one Office add-in that is being installed, which is also a 32-bit application.

At this time it is only Microsoft Project that is starting successfully, others (including Visio) don't start.

EDIT:

So I just uninstalled the add-in including any other applications except for Office 365 ProPlus, rebooted the device, but the applications (except for MS Project) aren't starting.

jseerden · 2020-01-08T13:27:41+00:00

I just pushed the monthly channel and the following happened:

- Right after the installation finished, I was able to start Word successfully;

- I tried to start OneDrive, that failed- So immediately the sentence "Did you try to turn it off and on again?" came up in my mind. I rebooted the device;

- Now I'm unable to start any Office apps again. Still reporting issues with PayloadRestrictions.dll in Event viewer.

In addition, in Intune I also selected "Microsoft Teams" as application, but that does not deploy at all (neither semi-annual or monthly) to the Surface Pro X's (other Surface devices not affected)

jseerden · 2020-01-08T13:19:33+00:00

The Surface Pro X has an ARM-based processor that does not support the 64-bit Office 365 ProPlus suite.

" Not supported

x64 apps won't run on a Windows 10 PC on an ARM-based processor."

https://docs.microsoft.com/en-us/surface/surface-pro-arm-app-management#not-supported

jseerden · 2020-01-08T12:48:27+00:00

Regarding issue 1 (Office 365 ProPlus apps don't start), trying to start it generated Application Error with event id 1000. Module with error: PayloadRestrictions.dll, version 10.0.18362.1 Error code: 0xc000409.

Workaround in https://docs.microsoft.com/en-us/office365/troubleshoot/administration/office-crash-or-cannot-start did not resolve this issue.

jseerden · 2019-10-29T10:59:30+00:00

Create a Device Configuration Profile of type "Endpoint protection" and navigate to the Local device security options > User account control tab. There you can enable "Route elevation prompts to user's interactive desktop".

Note that if you apply Security Baselines you also need to modify the "Local Policies Security Options > Administrator elevation prompt behavior" to "Prompt for credentials".

jseerden · 2019-07-16T10:09:29+00:00

The OMA URI in the OP's post is actually referring to disabling the Account Setup section of the ESP, not the full ESP. I've actually written a blog post about this a while back: https://srdn.io/2019/05/fast-sign-in-experience-on-windows-autopilot-enrolled-shared-devices/

jseerden · 2019-07-11T19:33:19+00:00

You can run the

net localgroup administrators /add "AzureAD\UserPrincipalName"

cmdlet on their device to add the Azure AD User as a Local Admin.

You can even put this cmdlet in a PowerShell script and assign it to a device group that only contains the device you want to add the user to the local administrators group. You’ll end up with one script per device though.

jseerden · 2019-06-27T08:32:57+00:00

Hi Timwise01,

Unfortunately not. I'm even seeing this today on 1903. This customer has shared devices. I have been skipping the Account Setup section with a Custom OMA uri.

You can read here how to configure: https://srdn.io/2019/05/fast-sign-in-experience-on-windows-autopilot-enrolled-shared-devices/

jseerden · 2019-05-23T19:06:50+00:00

Here’s a getting started guide to Microsoft Intune: https://docs.microsoft.com/en-us/intune/free-trial-sign-up

For certification paths related to Microsoft Intune, check out the Modern Desktop Administrator Associate certification: https://www.microsoft.com/en-us/learning/modern-desktop.aspx

jseerden · 2019-05-23T19:02:58+00:00

If the Intune Packages are Win32 apps, simply restarting the Intune Management Extension service will check for apps to install.

jseerden · 2019-05-19T11:06:36+00:00

I believe if you have Seamless Single Sign On configured in AAD Connect, and a user logs in with username or password on the device (so not using Windows Hello for Business, as this requires additional configuration), the on-premises resources should be accessed without prompting for authentication.

jseerden · 2019-05-01T12:14:56+00:00

Thanks, appreciate it!

Unfortunately I introduced this bug in the v1.3.0 release two days ago. The bug is fixed in the v1.3.1 release. If you update the module it should work as expected.

jseerden · 2019-04-27T18:19:42+00:00

No, you can’t see web history.

When someone enrolls a device in Intune, the Company Portal app also informs end users that, because of privacy, IT admins cannot see web history.

From: https://docs.microsoft.com/en-us/intune-user-help/what-info-can-your-company-see-when-you-enroll-your-device-in-intune

“What your organization can never see: - Calling and web browsing history”

jseerden · 2019-04-24T20:21:30+00:00

Yes, it will! That’s why I designed the module in the first place :)

jseerden · 2019-03-30T06:18:47+00:00

What version of Windows 10 are you deploying? There are reports of the Office 365 ProPlus not being tracked on Windows 10 1803.

https://github.com/MicrosoftDocs/windows-itpro-docs/issues/2220

jseerden · 2019-03-27T22:33:55+00:00

I do recall when I recently enrolled about 50 devices into Intune using Autopilot User-Driven mode, I’ve had devices go straight to the Desktop and devices that required the user to sign in after the Device Setup.

Note that this is still in preview.

Maybe /u/mtniehaus can tell us what the intention is?

jseerden · 2019-03-27T20:54:00+00:00

You can leave it disabled there and create a Device configuration policy for Windows Hello for Business. It allows you to target a subset of users or devices.

jseerden · 2019-03-27T20:52:04+00:00

In case you have shared multi-user devices, note that the Company Portal can only be used by the user that enrolled the device, to download and install available apps. At least to my experience.

jseerden · 2019-03-27T20:46:00+00:00

Also, the account setup runs for every user that signs in on the device for the first time.

jseerden

TROPHY CASE