Intune Lockdown for Students

[_techie_]

Hi.

 

We are slowly completing our rollout of Intune devices, but we have some 'challenging' students:

We have locked down several parts of the system over and above the normal UAC prompts to install things to system.

However we have the following things that still need resolving:

 

1) Locking down the personalize part of the settings for lockscreen and desktop (yes unbelieveably).

2) Stopping "User installable apps" such as Discord/Browsers from installing to C:\Users\username\AppData\Local\... (currently working on an Applocker Policy for this to stop MSI and EXE running from C:\Users\*\AppData\Local\ etc

3) General Dicking about creating hundreds of desktop shortcuts etc (not sure we can solve this!).

 

Any suggestions/recommendations for points 1 and 2 would be good or settings in Intune we can lock it down.

 

Thanks

[dsmith8]

For point 1 you probably want to look a custom URI setting to hide the settings pages (/Device/Vendor/MSFT/Policy/Config/Settings/PageVisibilityList) then you can hide the personalisation page, you can also deploy a setting to prevent users changing the wallpaper I believe this is a device restriction - Hide settings pages in Windows 10 with Microsoft Intune | Peter Klapwijk - In The Cloud 24-7 (inthecloud247.com)

 

2 You can export the applocker policies from GPO and import them to intune. How to implement AppLocker with the Intune | Askme4Tech

[FN-GM]

3 - Redirect the desktop to a folder that they don't have permission to modify. I used to use a local folder on the C drive.

[_techie_]

Sadly with OneDrive auto backup on, (and desktop being a folder that gets automatically backed up) this whilst a great suggestion won't work....

Thank you though!

[Ratcliffepg]

I have a powershell script that deletes desktop shortcuts at logon

[FN-GM]

Sadly with OneDrive auto backup on, (and desktop being a folder that gets automatically backed up) this whilst a great suggestion won't work....

Thank you though!

 

Ah. Didn’t realise you had that on.