Intune Startup and Logon Scripts

[petben]

Hello, am I right thinking:

 

- a PowerShell script in Intune assigned to a device group is run as startup

- a PowerShell script in Intune assigned to a user group is run at logon

 

 

If not how do I run logon scripts?

Thanks

[computer_expert]

Powershell scripts in intune aren't really designed for logon scripts:

 

The Intune management extension agent checks with Intune once every hour and after every reboot for any new scripts or changes. After you assign the policy to the Azure AD groups, the PowerShell script runs, and the run results are reported. Once the script executes, it doesn't execute again unless there's a change in the script or policy. If the script fails, the Intune management extension agent retries the script three times for the next three consecutive Intune management extension agent check-ins.

https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension

 

You may be able to bodge it via scheduled tasks or this script here.

[petben]

Thanks so if I want to run a powershell script that:

 

e.g.

Start the Papercut client

Maps a network drive

 

that traditionally would be a logon script how would you recommend I do that?

[computer_expert]

Papercut: https://www.papercut.com/support/resources/manuals/print-deploy/roll-out-print-deploy-client/topics/deploy-intune.html

 

I can't help with network drives as we have everything on onedrive/teams/sharepoint which pretty much made network drives redundant.

[foofighterjim]

Network drives:

[psydii]

Thanks so if I want to run a powershell script that:

 

e.g.

Start the Papercut client

Maps a network drive

 

that traditionally would be a logon script how would you recommend I do that?

 

Since Vista the “correct” way to launch an administrator assigned app on start up/logon is a scheduled task.

 

It feels a bit of a regression to have to suggest a script to map a network drive. But I suppose from an ideological point of view during network drives is the regression.

 

So....

 

If you have network drives then you have on prem servers. If you have on prem servers you have AD. If you have AD use a GP preference to map the drives.

 

Once you are all in on the cloud you won’t have servers, or network drives and so the interdependency can be swept away in one step.

 

Fwiw we still have old fashioned logon scripts and group policies doing thing that were right in 2001 but a pain to let go twenty years later.

[deano]

Whilst the InTune.Training mentioned script works, in my testing I have found an issue. If the user say had an issue and I removed the user's local profile, when they log back on the script won't run again. In order to get the script to run again, you either need to modify remove script from within InTune and re-apply, or remove reg keys on device for InTune profiles. This was temperamental in my testing. I think scheduled task is best way forward, however not sure how to get a script on device through InTune and how I can get two different scripts called depending on user logged on e.g. staff team for staff, student team for student?

[deano]

Not tried yet, but found this

 

https://www.lieben.nu/liebensraum/2019/06/simplify-logon-scripts-in-intune-without-schedules/

[petben]

Papercut: https://www.papercut.com/support/resources/manuals/print-deploy/roll-out-print-deploy-client/topics/deploy-intune.html

 

I can't help with network drives as we have everything on onedrive/teams/sharepoint which pretty much made network drives redundant.

 

The Papercut Intune process is nearly there, Print Deploy is set up but there's an error in the log:

 

It is installed as an App on a client from my Intune environment

Firewall has been set to allow the Print Deploy ports

On the client Print deploy asks for the UN/PW of the logged in person and it shows the 2 deployed printers but these 2 printers fail to install with an error:

 

 

2021/03/19 09:46:31 pc-print-deploy-client.exe: STDOUT|Installing local server printer '\\print1.sls.local\Global Queue'...

2021/03/19 09:46:31 pc-print-deploy-client.exe: STDOUT|failed to open printer \\print1.sls.local\Global Queue: The printer name is invalid.

2021/03/19 09:46:31 pc-print-deploy-client.exe: STDOUT|check access to server printer '\\print1.sls.local\Global Queue' failed

2021/03/19 09:46:31 pc-print-deploy-client.exe: STDOUT|Error installing server printer. Error: printer not found, inaccessible or server unavailable

 

 

Any ideas would be great.

Thanks

[jasonatpapercut]

2021/03/19 09:46:31 pc-print-deploy-client.exe: STDOUT|Installing local server printer '\\print1.sls.local\Global Queue'...

2021/03/19 09:46:31 pc-print-deploy-client.exe: STDOUT|failed to open printer \\print1.sls.local\Global Queue: The printer name is invalid.

 

Hi PetBen,

 

PaperCutter here.

 

When deploying a Server based Print Queue with Print Deploy the username/password input to the Print Deploy client does not interfere with the SMB/CIFS/UNC authentication to the server. That is to say, the OS logged in user needs to be able to open \\print1.sls.local\Global Queue.

 

If you're using PaperCut Mobility Print, thats a different matter as we control the authentication stack there.

 

In situations where authentication doesn't/can't work, we do suggest to look at installing PaperCut Mobility Print on the print server and using Print Deploy to push out those queues.