Out of Office Hours

Powered by
WordPress

  • When does a Windows client sync with Intune?

    It seems like a simple question, but a complete answer isn’t necessarily simple. We can start off with the documentation: OK, so about every 8 hours. But it’s different right after you enroll, with the theory being that it might take a little more activity to get the device set up initially. The docs describe…

  • Using a well-known Intune app ID for access to Graph? Not for much longer.

    I noticed a section on the Features in development page that talks about a change coming on April 1st, which is not very far away (and an interesting place to put “we’re going to break things” notices): If you’re using the Intune PowerShell application ID (d1ddf0e4-d672-4dae-b554-9d5bdfd93547), you’ll need to update your scripts with a Microsoft…

  • Autopilot topics of the week

    It’s been a week of randomness, but at least some of that randomness is interesting. Let’s look at a few goings-on in the world of Windows Autopilot. Yes, you can generate hashes in Windows PE, but… A blog post by Johannes Bedrech described a process that could be used to generate hardware hashes in Windows…

  • What’s actually in a WIM or ESD file?

    It seemed like a simple question: Can you figure out what’s in an ESD file without download the whole file? I’ve been manipulating data like this quite a bit over the past couple of days, so I’d like to think I’m getting pretty good at it — so I had to take that as a…

  • Convert Windows 11 Home to Education for Autopilot

    It’s a question that’s come up a number of times: How can I take a device running Windows 11 Home, upgrade it to Windows 11 Education, and provision it via Windows Autopilot? I suppose we should start off with a more basic question: Why? For devices that ship with Windows 11 Pro, they are all…

  • WindowsApps folder getting out of hand?

    The whole Windows app (UWP) model is weird: apps are installed per user, but the files for those apps are shared between users. That leads to situations where there are several different versions of an app on the system, each of which with its files in C:\Program Files\WindowsApps (a tightly-secured folder that you’re not supposed to…

  • New enhancements to Get-AutopilotDiagnosticsCommunity

    It started off as a simple change: I was annoyed that the “Observed Timeline” in the output from the Get-AutopilotDiagnosticsCommunity (and the older Get-AutopilotDiagnostics script too) had events in the wrong order. For example, it would show that app #2 had started downloading before app #1 had finished, but that’s not what Intune Management Extension ever does. The…

  • Autopilot branding app improvements

    Since I had been testing out the UpdateOS script to see how it performed based on the number of CPU cores, I figured I should try the same thing with the Autopilot Branding package as I had noticed that it too was fairly slow, taking close to 10 minutes to complete in a VM. The first…

  • Autopilot randomly not working? Perhaps KB5033055 is to blame.

    I was doing some testing with Windows Autopilot on Windows 11 23H2 and couldn’t figure out why properly-registered machines with profiles assigned would “sometimes” behave like they weren’t registered with Autopilot. Instead of going to the Azure AD / work or school sign in page, it would display the OOBE license terms page: Sure, you could…

  • Installing updates during Autopilot: Windows 11 edition, revisited again

    This seems to be a frequent blog topic, with posts going back to 2019: Installing Windows updates during a Windows Autopilot deployment. My first attempt, back in October 2019. It worked to install updates during OOBE, but it was slow. That was with Windows 10 at that point. Installing updates during Autopilot: Windows 11 edition. This was supposed to…

  • Looking back on 2023: Site statistics

    History has proven that posting top 10 lists detailing the most popular articles for the year on https://oofhours.com doesn’t draw many views. But I don’t care, I’m going to do it anyway. (Seriously, I don’t typically post anything for the views, it’s usually just something that interested me at the time, or something that I wanted to…

  • Use the new community modules for Autopilot

    As I mentioned in my previous post, there is a new community version of the WindowsAutopilotIntune PowerShell module that I created a few years ago (needed because the “official” Intune modules don’t include any beta Graph objects, and the Autopilot objects seem to be permanently stuck in beta). But there are actually three different ones available. Each…

  • Get Autopilot for Existing Devices to skip the region page

    In an Autopilot user-driven AAD join deployment profile, you can configure it to specify the “Language (Region)” and as long as there is network connectivity (e.g. a wired device), that will work just fine. You can specify “Operating system default” for it to choose the default, or you can specify an explicit language, e.g. “English (United…

  • Creating ConfigMgr boot media without a password? Maybe that’s a bad idea.

    Sometimes going off on a tangent leads you to yet another tangent. Or maybe it’s just an attention span issue. Regardless, it resulted in a question: How is the stuff that ConfigMgr embeds into boot media (e.g. the PKI certificate that you specify that enables the boot image to actually talk to ConfigMgr) protected? I knew that it…

  • Thank you, Tanium!

    My experiences working at Tanium have been great: great people, a great company culture, and great technology. Honestly, it was an extremely positive experience overall, working from home with individuals all over the world, creating solutions like Tanium Provision and learning a lot along the way. (In case you’re wondering, yes, Linux bare metal imaging…

  • Renaming Autopilot-deployed devices

    Over three years ago (yikes), I did a blog post that talked about renaming Hybrid AADJ devices after they have been deployed via Windows Autopilot. As I was revisiting that for an upcoming presentation, it occurred to me that such a thing doesn’t need to apply only to Hybrid AADJ; it can also be useful…

  • Installing updates during Autopilot: Windows 11 edition, revisited

    In my previous post about this, I was baffled by the issue I ran into: a reboot during the Autopilot process, needed after updates were installed, effectively bricked the device. But with the cause of that discovered to be something unrelated (running an MDT task sequence as a Win32 app) and fixed, it’s worth revisiting…

  • Run an MDT task sequence during Autopilot, revisited

    In my previous post on the subject, everything worked well: I could take an MDT task sequence, package it up as an Intune Win32 app, and deploy it during an Autopilot provisioning process. After that, I moved on to installing Windows updates during the process, and that’s when things when wrong: after rebooting to complete…

  • Remove the Azure Arc Setup “feature” installed on Windows Server 2022

    Microsoft added a new “Azure Arc Setup” feature in Windows Server 2022 via this month’s cumulative update. You can see it show up in the Start menu: And there’s a folder created to hold the installer itself: Having a feature is one thing, having it installed by default — as part of a Patch Tuesday…

  • Installing updates during Autopilot: Windows 11 edition

    Updated 2023-10-23: This post has effectively been superseded by this new post. The issues described below are actually not caused by the Windows update process; more details on that here. Back in 2019, I did a blog post about installing Windows updates during an Autopilot deployment. That was with Windows 10. There was no reason…