Out of Office Hours

Powered by
WordPress

  • You can use Intune to create a local admin account, but that doesn’t mean its a good idea

    There are a variety of blog posts that talk about creating a local account on a device, to be used as a “break glass” account in case anything ever happens where the user can’t sign in.  That’s not too hard to do using custom OMA-URIs, since the Accounts CSP already supports that.  You can specify…

  • More help with Windows Autopilot diagnostics

    I’ve talked about the Get-AutopilotESPStatus.ps1 script a few times in previous blogs (like this one).  Well, here’s another one.  First, I added some additional diagnostics information at the top of the output: This will tell you some basic information about the device (e.g. the tenant details, the Intune device ID, the Autopilot settings being used),…

  • Windows enrollment restrictions

    It seems some days become worthy of a blog post, if only due to the coincidental collision of research and customer questions.  Today is one of those days.  I started off the day looking at the behavior of a Windows enrollment restriction that can be configured in Intune to block the enrollment of personal devices…

  • Podcast episode #2: Group tags

    I did my first podcast episode back in March.  Because I didn’t know any better, it was posted at a higher bitrate than necessary, so it used up a significant amount of the monthly quota on the service that is hosting the audio.  No problem, I thought, as the quota is reset at the beginning…

  • VLSC is getting monthly updates for Windows 10 media!

    If you routinely sign into the VLSC portal at https://www.microsoft.com/vlsc to download Windows 10 media you may have noticed something interesting recently.  Here’s a snapshot of Windows 10 1909 from mid-March: And here’s another snapshot from today: Notice the difference?  Windows 10 version 1909 was updated.  And if I would have captured an update during…

  • My guide to setting up Windows Server 2019 for VPN (with no guarantees that it will work)

    Sadly, I can remember setting up my first Remote Access Service (RAS) on Windows NT Server 4.0.  It was a very simple process:  First you added the Remote Access Service in network settings as a new service, specifying how many ports you wanted and of what types (dial-up, PPTP), then you checked a box on…

  • Publish Certificate Services CRL and OCSP sites to the internet using Azure App Proxy

    I have set up a variety of test domains over the years, and inevitably I need to set up Active Directory Certificate Services (ADCS) on them because I need to issue certificates of some kind for some purpose (e.g. VPN, Wi-Fi access, Windows Hello for Business, etc. – see https://oofhours.com/2020/04/05/intune-certificates-something-everyone-should-set-up/ for details on how to…

  • Random news of the week: New white glove fix, updated Intune module

    In the category of “stuff probably not worth a separate blog” category, I’ll combine some notes together into a single post.  Let’s go through those one at a time. New white glove fix Windows Autopilot white glove scenarios have always supported the provisioning of all device-targeted apps, policies, certs, etc.  And if there is a…

  • Deploying Edge without a desktop shortcut, the easier (but not easiest) way

    As Per Larsen blogged this week, the recent Edge stable release now has a new MSI parameter to skip the desktop shortcut.  From the release notes: Added an MSI command line parameter that lets you suppress Desktop icon creation when you install Microsoft Edge. The following example shows how to use this new parameter:MicrosoftEdgeEnterpriseX64.msi DONOTCREATEDESKTOPSHORTCUT=trueThere…

  • Fun with Windows Autopilot Group Tags

    This one falls squarely in the “I can’t believe I’m doing another blob about group tags” category.  Past examples: Group tags with spaces? Fun with Azure AD dynamic groups Now you can edit group tags and computer names for Windows Autopilot devices Windows Autopilot Companion app updated to support editing the computer name and group…

  • Correlating Hyper-V VMs that are registered with Windows Autopilot

    Over time, I’ve created a whole bunch of VMs for testing Windows Autopilot.  They are named so that I can keep track of the Windows 10 build, the environment they are tied to, the scenario they are configured for, etc.  But overall, it is a still a bit of a mess – cleaning up that…

  • Another new Get-AutopilotESPStatus script posted

    Building on top of the script that I blogged about just over a month ago (time flies), I’ve now posted a new version.  A few changes this time around: Apparently the MSI product ID for the Intune Management Extensions changed, so I updated the script to know about the new ID.  (I hope it doesn’t…

  • Outlook and Azure AD Join: Automatically configuring the user’s mailbox

    In an average day, I provision a bunch of Windows 10 devices using Microsoft Intune and Windows Autopilot, including Office 365 ProPlus.  But somehow I never actually launched Outlook (or if I did, I didn’t pay attention to what I needed to do to configure it).  It’s not very pretty: What you really want to…

  • Intune + certificates: something everyone should set up

    If you are using Intune and haven’t yet set up a mechanism to deliver certificates to your MDM-managed devices, you should probably do so – at some point you’ll need to, and there’s no time like the present. If you are already using Active Directory Certificate Services (instructions for setting it up here), the Intune…

  • Group tags with spaces? Fun with Azure AD dynamic groups

    Many of you using Windows Autopilot have used Azure AD dynamic groups for various purposes, leveraging the Group Tag value that has been assigned to a device.  Somewhere along the line, people started using the -contains operator, described in the Azure AD docs, for doing that.  If you do that, it will work fine, at…

  • Include Microsoft Edge in your ESP blocking app list

    A quick note:  A few people noticed that you couldn’t select the new Microsoft Edge app types when selecting the list of blocking apps in an enrollment status page profile.  That’s been fixed, so you can now include Edge:

  • An experimental script to check out your Windows Autopilot devices

    I published a new script on the PowerShell Gallery called AutopilotDeviceSync.  This grabs a list of all your Windows Autopilot devices, Azure AD devices (including Hybrid Azure AD Join devices synced from your on-premises Active Directory), and Intune devices.  If you weren’t aware that every device existed in three or more places, let me explain…

  • Importing a device hash directly into Intune

    I resisted the urge to add a switch to the Get-WindowsAutopilotInfo script to add the device to Windows Autopilot using the Intune Graph API.  But since people were doing it anyway in worse ways (e.g. writing their own scripts and not leveraging the functionality that was already available, e.g. taking the CSV from Get-WindowsAutopilotInfo and…

  • Podcast episode #1: Windows Autopilot Hybrid Azure AD Join

    I admit it, I’ve been procrastinating. I’ve been carrying around podcasting equipment for months, intending to use it from hotel rooms around the world to create podcasts for those that prefer audio information over written text. Since traveling is no longer a near-term option, I decided it was time to turn my home office into…

  • More Autopilot ESP information

    I published a script last week that I talked about in a previous blog which would dump out information from the registry to tell you what happened during a Windows Autopilot deployment, as tracked by the enrollment status page.  You can read that post here. I’ve now published version 2.0 of that script which has…