Out of Office Hours

Powered by
WordPress

  • Forcing an MDM sync from a Windows 10 client

    Updated 3/31/2024: Note that this method may no longer work. It certainly didn’t work for me on Windows 11 23H2. But see the PowerShell alternative in this post for a mechanism that does: https://oofhours.com/2024/03/30/when-does-a-windows-client-sync-with-intune/ (scroll most of the way down the page). I was reading a blog recently that made me think “there’s got to…

  • Now choose from more language/locale choices for Windows Autopilot self-deploying mode

    Several people pointed out in the past when setting up Windows Autopilot self-deploying mode profiles (used for kiosks, digital signs, and shared PCs) in Intune that the list of language and locale combinations was, well, very incomplete.  The drop-down list included the “core” language/locale combinations for each language pack (e.g. “en-us” and “en-gb”) but not…

  • Time for another Q&A session

    Back in August, I hosted an “OOF Hour” Q&A session and said I would try to schedule one each month.  September is rapidly disappearing, so it’s time to get something on the schedule. This one will be on September 26th (Thursday) at 8am Pacific time.  See the attached zip file containing an ICS appointment that…

  • Windows 10 on ARM64

    I admit it, I still have flashbacks about Windows RT, the previous version of Windows that ran on ARM processors.  (Don’t remember that?  Read up on it here.)  That was a 32-bit version of the OS (with significant restrictions), running on older, slower processors.  The ARM processor platform has come a long way since then…

  • A challenge with Windows Autopilot for existing devices and Windows 10 1903

    We implemented the Windows Autopilot for existing devices scenario with Windows 10 1809 to enable an interesting scenario:  Using ConfigMgr (or other deployment tools, e.g. MDT) to take an existing Windows 7 or 8.1 machine, wipe it, load Windows 10, and then take it through the Windows Autopilot user-driven experience (now supporting both Azure AD…

  • Turn your laptop into a portable mainframe

    Way before working with Windows, I started off in IT as a database administrator and systems programmer, working on IBM (and later Amdahl) mainframe systems running the MVS operating system, CICS transaction processing system (basically, software that drives thousands of terminals at once), and Adabas database.  The first model I remember working with was an…

  • Windows Autopilot known issues in Windows 10 1903

    I listed a few issues in a previous blog, which are also reflected in the Autopilot documentation, but there are more issues addressed in later cumulative updates as well.  Here’s a full list: Issues addressed in KB4505903 (7D update released in late July): Windows Autopilot white glove does not work for non-English OSes.  (If you’ve…

  • Windows Autopilot device provisioning network traffic, annotated

    While I will never be a fan of proxy servers, there is one case where it is useful to use one:  When you want to see all the network traffic and the actual URLs that are being visited.  I took the opportunity to capture a side-by-side video showing a Windows Autopilot user-driven scenario, joining a…

  • Geeking out with UEFI

    Some people may think some of my past posts get into the weeds, exploring the technical depths of Windows Autopilot, Intune, Windows 10, ConfigMgr, etc.  But I would say those generally only get to the 300-level – I will leave out the really deep stuff because it can be harder to explain, and some people…

  • Sign in to Azure Active Directory with a FIDO2 key

    Back in July, Alex Simons announced the public preview of Azure Active Directory’s support for FIDO2 security keys.  Even though I have been carrying one of those around with me for several months waiting for that (I couldn’t come up with a good reason to ask for access to the private preview), it’s taken me…

  • Windows Autopilot high-level scenarios

    Time for a little up-leveling (especially after the super-long proxy server post).  Based on a recent Twitter conversation, I think it’s worth talking about a couple of higher-level topics.  First, what are the goals for Windows Autopilot.  And then, what high-level scenarios does Windows Autopilot support?  (Yes, the word “scenario” is exceedingly overused, but in…

  • Windows Autopilot and proxy servers

    Did I mention that I dislike proxy servers?  I certainly talked a lot about them in this post, but let me go on the record to say I really, really dislike them (at least non-transparent ones) and wish they would just go away.  But sadly, that’s not going to happen so we have to live…

  • BitLocker, ESP, and Windows Autopilot: Working in harmony

    Let’s say you want to enable BitLocker during a Windows Autopilot user-driven deployment, and you want “maximum security” by changing the default BitLocker encryption settings to instead use XTS-AES 256-bit encryption (instead of the default 128-bit).  You would end up creating a device configuration profile in Intune that looks something like this: Notice the note…

  • The Enrollment Status Page phases and steps

    Have you ever wondered what actually happens during each phase of the Enrollment Status Page (ESP) and each step within a phase?  Or maybe more simply, what exactly is it tracking?  If you look at a composite picture of the ESP UI (showing all sections expanded – something impossible to do while the ESP is…

  • Why does “Preparing your device for mobile management” take longer with Windows 10 1903?

    It’s a question that I’ve been asked a number of times, and one that I actually asked myself when doing initial tests with Windows 10 1903.  And the answer is interesting – yes, ESP is waiting longer while “Preparing your device for mobile management” in Windows 10 1903. But what is going on during that…

  • Requiring a network connection for the Windows Autopilot process

    If you’ve gone poking around in the available device configuration policies in Intune, you might have seen this one in the “Device Restrictions” category for “Windows 10 and later” devices, in the “General” section: But what does that “Require users to connect to network during device setup” actually do? The intent is simple: Don’t let…

  • Trying out the ConfigMgr task sequence debugger

    One of the new features in the ConfigMgr 1906 release (and in previous tech preview releases) is the task sequence debugger.  See the What’s new documentation that talks about it, and the official documentation that walks through using it and lists known issues.  Since this is still a pre-release feature, make sure you enable it…

  • Windows Autopilot oddities

    Sometimes I can’t explain them, but I can at least pass them on so that you don’t tear your hair out trying to figure out what’s going on. The enrollment status page doesn’t track PowerShell scripts executed via Intune Management Extensions.  They will be sent to the machine along with all the other policies, and…

  • Event Viewer and “Saved Logs”

    If you are like me and open lots of saved event log files (*.evtx), such as those captured by the “mdmdiagnosticstool.exe -area Autopilot -cab c:\autopilot.cab” command, you probably end up with an Event Viewer window that looks something like this: Always opening, never closing (which you can do by right-clicking and choosing “Delete”).  Fortunately, there’s…

  • Creating a Windows Autopilot role in Intune

    Some customers have asked “how do I delegate access to manage Windows Autopilot devices in Intune.”  Well, Intune has a robust Role-Based Access Control (RBAC) mechanism that can be used to create a role that can do that – and only that.  You just need to understand what needs to be granted to that role. …