foofighterjim Posted September 28, 2021 Posted September 28, 2021 Just looking for a bit of a sanity check and advice on this one. I have a requirement to run software that we can only deploy via Intune (Windows App), none of our domain computers are currently Azure AD joined and even if they were the software has Bluetooth requirements that our domain computers do not meet. I have some leftover DfE laptops (Dell 3190s) that would work spec wise. I thought it best to approach this as an Intune project rather than worrying about joining the domain and ADD with potentially conflicting policies. I am fairly familiar with Intune, having spent some time getting it setup for student loan devices; unfortunately, because of this, all policies need to be device based. So far I have: Enrolled a laptop into Intune. Set it up as a shared device as multiple students will be using it. Successfully deployed the required software. Now here lies the problem, I believe marking it as a shared device is causing issues as ideally I need to enable OneDrive and known folder move to allow students to easily save their work. I have this working flawlessly with our loan devices, but they are not marked as shared devices as they are 1:1. Initially marking as a shared device hid everything except the downloads folder, which means that unless using apps with OneDrive integration the students would not be able to save their work (not sure why MS thought doing this was a good idea), I have relaxed this so users can now see the local documents and drives knowing that I should be able to sort the risks of that out with AppLocker, but I can't get OneDrive and KFM to kick in. I have read a few things where creating a custom policy with the following entries should enable it, and OneDrive does now work when manually run: ./Device/Vendor/MSFT/Policy/Config/System/DisableOneDriveFileSync (Integer = 0) ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP (Integer = 1) I'm just not sure how to get it to run automatically on login like the loan laptops do.
IT_JB Posted September 28, 2021 Posted September 28, 2021 We had the same problem. Shared PC mode seems to disable OneDrive completely on the device and we were wanting to run KFM same as you. I think it's do with shared PC mode deleting the profiles on logout each time. The only fix is to create a device configuration policy on intune with the two custom settings you listed. We have been running this for a few months now and it works perfectly. Once this is in place the normal KFM polices for silent setup work on these devices. 1
foofighterjim Posted September 28, 2021 Author Posted September 28, 2021 We had the same problem. Shared PC mode seems to disable OneDrive completely on the device and we were wanting to run KFM same as you. I think it's do with shared PC mode deleting the profiles on logout each time. The only fix is to create a device configuration policy on intune with the two custom settings you listed. We have been running this for a few months now and it works perfectly. Once this is in place the normal KFM polices for silent setup work on these devices. I actually have our policy to only delete the profile after 60 days or when the local drive hits 75% full, not sure if this is actually happening or not at this point though (least of my worries right now). I think I might need to reset the device as OneDrive is now automatically signing in, but I'm not sure if this is because I had previously started it manually from that account or if it is because the policy is now working. Can't help but feel that this would be much easier on a Chromebook (he says, having never even used one).
chaplic Posted September 28, 2021 Posted September 28, 2021 Shared PC mode seemed to be to be more like 'kiosk mode with individual logins' and a bit pointless, why use?
foofighterjim Posted September 28, 2021 Author Posted September 28, 2021 Shared PC mode seemed to be to be more like 'kiosk mode with individual logins' and a bit pointless, why use? It was the cleanest / simplest way to set the profile retentions and also gives a "clean" login window on each boot i.e. not always showing and defaulting to the last logged on user. I'm sure the settings are also somewhere in the Administrative Templates section; that said, who knows when MS is concerned.
stumot Posted October 15, 2021 Posted October 15, 2021 I've been looking into not showing the last logged in user for Intune and have managed to locate the setting for this, its in the settings catalogue -> Local Policies Security Options -> interactive logon do not display last signed in Just in case you want to disable shared pc mode
free780 Posted October 15, 2021 Posted October 15, 2021 Shared PC mode seemed to be to be more like 'kiosk mode with individual logins' and a bit pointless, why use? It’s because the OneDrive sync client is designed for 1:1 devices. The machine level installer improves the experience a bit. So shared PC Mode can only be used if users are only using Edge and Office software. 1
cheekycharly Posted June 7, 2023 Posted June 7, 2023 Any of you expert veterans to this topic still about on this forum. I have spent two weeks with this issue on my test environment and only just realised that its when I make a custom provisioning package using Setup School PC's application and enable Shared PC mode that this all goes TU and OneDrive stops functioning. We don't have many needs for our system setup just that the shared devices get logged into and at that point OneDrive moves local storage to cloud storage. The provisioning package enabled us to have sign on background and desktop background as well as pre defined domain name all ready for use hence why I was trying to setup using this config. When I create those settings on Intune to push out the background and desktop wallpaper and domain name nothing ever changes. Our base OS is Windows 10/11 Pro and we pay for 365 A3 licensing which upgrades the OS upon login to Windows Enterprise. Any ideas how I get over this hurdle as its driving me insane!!! Thanks
KK20 Posted June 7, 2023 Posted June 7, 2023 I might be being thick here and have grabbed the wrong end of the stick. Are your PCs on a traditional onsite active directory and you are wanting to roll out software via intune (but do not have a presence with intune at the moment)? If so, hybrid join, then roll out software to your PCs. Make a dynamic group based on something relevant on your AD OUs so that you have parity OU->Group and away you go. thats where we are at (im basically migrating GPOs to intune policies as I go, software installs included). I didnt need to mess around with shared PC settings, we use onedrive client extensively as we are cloud based for user storage now.
cheekycharly Posted June 7, 2023 Posted June 7, 2023 No this setup is going to be fully AAD with Endpoint Manager and A3 logins. HOPEFULLY No on prem Hybrid sync.
IT_JB Posted June 7, 2023 Posted June 7, 2023 Any of you expert veterans to this topic still about on this forum. I have spent two weeks with this issue on my test environment and only just realised that its when I make a custom provisioning package using Setup School PC's application and enable Shared PC mode that this all goes TU and OneDrive stops functioning. We don't have many needs for our system setup just that the shared devices get logged into and at that point OneDrive moves local storage to cloud storage. The provisioning package enabled us to have sign on background and desktop background as well as pre defined domain name all ready for use hence why I was trying to setup using this config. When I create those settings on Intune to push out the background and desktop wallpaper and domain name nothing ever changes. Our base OS is Windows 10/11 Pro and we pay for 365 A3 licensing which upgrades the OS upon login to Windows Enterprise. Any ideas how I get over this hurdle as its driving me insane!!! Thanks We have this exact same setup. It's the shared PC mode that is disabling OneDrive, Microsoft say this is the intended behaviour. You need the following Configuration Profile assigned to those devices to 'fix' it. Custom Policy Windows 10 and later OMA-URI Settings [TABLE=width: 802] [TR] [TD]DisableOneDriveFileSync[/TD] [TD][/TD] [TD]./Device/Vendor/MSFT/Policy/Config/System/DisableOneDriveFileSync[/TD] [TD=align: right]0[/TD] [/TR] [TR] [TD]MDMWinsOverGP[/TD] [TD][/TD] [TD]./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP[/TD] [TD=align: right]1[/TD] [/TR] [/TABLE] 2
cheekycharly Posted June 7, 2023 Posted June 7, 2023 If that works JB I will owe you big time. Going to try it now... I read this article before and thought I'd found the fix so wiped another laptop and provisioned it with the school setup with shared mode but no joy... Configuring Shared PC mode with OneDrive sync enabled and configured – All about Microsoft Intune (petervanderwoude.nl)
KK20 Posted June 7, 2023 Posted June 7, 2023 No this setup is going to be fully AAD with Endpoint Manager and A3 logins. HOPEFULLY No on prem Hybrid sync. Sorry, I was posting to OP.
cheekycharly Posted June 7, 2023 Posted June 7, 2023 (edited) We have this exact same setup. It's the shared PC mode that is disabling OneDrive, Microsoft say this is the intended behaviour. You need the following Configuration Profile assigned to those devices to 'fix' it. Custom Policy Windows 10 and later OMA-URI Settings [TABLE=width: 802] [TR] [TD]DisableOneDriveFileSync[/TD] [TD][/TD] [TD]./Device/Vendor/MSFT/Policy/Config/System/DisableOneDriveFileSync[/TD] [TD=align: right]0[/TD] [/TR] [TR] [TD]MDMWinsOverGP[/TD] [TD][/TD] [TD]./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP[/TD] [TD=align: right]1[/TD] [/TR] [/TABLE] That look like yours IT_JB? I get an error. Edited June 7, 2023 by cheekycharly
IT_JB Posted June 7, 2023 Posted June 7, 2023 I think it's a device only policy, I have mine deployed to device groups. Otherwise, looks the same.
cheekycharly Posted June 8, 2023 Posted June 8, 2023 Is your environment Windows 10 and my test one 11? Cant see a reason why it is failing.
cheekycharly Posted December 7, 2023 Posted December 7, 2023 Yes, got past this issue and now OneDrive signs in upon login of a student.
jamoritch Posted December 7, 2023 Posted December 7, 2023 Yes, got past this issue and now OneDrive signs in upon login of a student. Brilliant, did you just push out the above settings?
cheekycharly Posted December 7, 2023 Posted December 7, 2023 Basically the settings IT_JB wrote are correct. My issue turned out to be caused by the imaging package that was being created. Stopped using images and just install base Windows 11 and let In tune do the rest and it worked fine. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now