Intune - Shared Device Deployment

[CyBeRkId2002]

Hi all,

 

We are currently finalising settings for our student users on Intune using shared devices (Laptop Trolleys or IT Suites).

 

We are 90% of the way there and seems to be working great... Onedrive provisioned with KFM, taskbar sorted, Edge sign-in, fast logon (about 30 seconds)

 

None the less, there are a couple of things I would just like to tighten up if at all possible! The main issue we have is that there are a number of User based settings we push out, either via Powershell scripts or Proactive Remediations. Examples are:

 

• Disabling CMD, Regedit etc.
  
• Removing some bits off the taskbar
  
• Removing the last couple of Windows pre-provisioned apps we cant take out at device level
  
• Registry change to speed up Onedrive shared library provisioning speed
  

 

This works fine, but can take a short-while to kick in. Typically this is just a minute or so, but wondered if anyone had found a way to get this to apply immediately at logon, effectively not logging them in until ALL policies have applied?

 

Also, OneDrive needs to be pre-provisioned before sign-in... how are people typically doing this? We have a script that creates user accounts, has a 400 second delay (to ensure the licence gets assigned to the user) then runs the Request-SPOPersonalSite command. This works, but wondered if there was a better solution?

 

Any help or tips from experienced Intuner's would be appreciated!

[tapb]

Windows 10 or Windows 11? What Edition?

[CyBeRkId2002]

It was Windows 11 Education. Now pretty much sorted. Managed to do all of this via a logon script of sorts (scheduled task actually) and works pretty solidly! Seem to have shared devices about sorted.

[snagrat]

It was Windows 11 Education. Now pretty much sorted. Managed to do all of this via a logon script of sorts (scheduled task actually) and works pretty solidly! Seem to have shared devices about sorted.

 

How are you deploying the scheduled tasks?

[CyBeRkId2002]

A package pushes out the script to the client device, and we then have a proactive remediation which schedules the task. In all honesty though the scheduled task could be configured as part of the package and I half wish I had done it that way.

[snagrat]

A package pushes out the script to the client device, and we then have a proactive remediation which schedules the task. In all honesty though the scheduled task could be configured as part of the package and I half wish I had done it that way.

 

And the schedule task just runs at login?

 

I haven’t had the need to do anything like this yet, but it is an interesting way to do things that are otherwise not possible via the Intune policies yet

[mf13tch]

• Disabling CMD, Regedit etc.
  
• Removing the last couple of Windows pre-provisioned apps we cant take out at device level
  

Possibly block these using an AppLocker policy? They apply very quickly and as long as the end users that share the device are subject to the same policy it won't be changing between users.

You can configure Applocker using Custom Device Configuration (OMA-URI) templates:

Support Tip: Using AppLocker to create custom Intune policies for Windows 10 apps - Microsoft Tech Community

Edited September 13, 2022 by mf13tch

[_techie_]

We experienced similar issues to yourself, enforcement of policies takes a few moments to apply, by which time students have already done the damage!

We eventually went to a hybrid domain join setup, where enforcement of policies applies via GPO still. Ti

This seems to be a lot more reliable and speedy than Intune when hot-desking and sharing devices.

When using 1:1 devices the issues seem less of a problem, as repeated logins just get enforced okay.

Newer devices we have also seem to work better, probably due to better performance.