dragged kicking and screaming into windows 11 era. a short tale

[KK20]

So. I have finally started dragging my network into the new age. Gone our our last Optiplex 760 (!!), 7010 and 7020. We now have 75% capable of running Windows 11. Thats a good enough tipping point. Out with full fat images deployed with FOG and in with autopilot and intune. We already utilised intune for our ipads and we had a few policies for desktops as a proof of concept, but even though we are hybrid everything relied on GPO. Let the pain begin!

 

• Take stock. We already use onedrive, filtering/monitoring is cloud based, papercut has mobility print and print deploy working already. AV is cloud based too. Hybrid works and we have a parity of 365 groups and OUs. 365 SSO works throughout and windows hello also works. A few test W32 packages install software for onsite machines and there are a few device policies too (with MDM win over GPO set).
  
• Autopilot is fairly easy to set up. I will be manually importing HWID and have a script already reporting these back for our onsite devices that are W11 capable.
  
• dynamic groups have been set up to leverage our Autopilot devices, I will initially roll things out slowly to avoid collapsing our internet. Microsoft connected cache will be empty at the moment.
  
• start the painful process of migrating our GPOs to comparable policies.
  
• ADMX import is a nice feature for chrome and adobe etc.
  
• GPO import is useless. For lightweight simply GPO it might be fine, dont even think about trying to import Chrome settings (Intune will helpfully migrate these to edge settings)
  
• Registry editing is a lesson in pain and suffering. Sweet jesus they couldnt have made it harder. I use WIN32 packages and good old batch files (quicker deployment and execution than PS1 files with my testing over the hundreds of machines).
  
• LoB and WIN32 will cause whiteglove pre provision errors. LoB and WIN32 will operate async so you can get msiexec trying to run simultaneously with errors. I have removed all the LoB installers and repackaged everything as WIN32 and msiexec command.
  
• WIN32 is that, x86. Dont forget to /reg:64 or sysnative as appropriate. You will get registry ooopsies otherwise.
  
• Intune is a lesson in patience, make a change - wait. change a file - wait. Deployments are not instantaneous
  
• dependency chains are the only way to get a semblance of execution order. The longer the chain the greater chance of failure. I only have a couple such as "install registry WIN32 as a dependency for the WIN32 application". There is no ordering.
  
• Runic divination appears to be the deciding order of installation from intune. I have yet to figure out how it sorts out what to install first.
  
• Be wary of app installation failures, intune will only retry a few times. Registry hacking can change this
  
• first logon will not have all your settings in place. Pupils will be able to mess about, change things, screw with start menus until intune has sorted its policies out. This is very different from GPOs
  
• Feedback on failure is nowhere near as good as GPO results wizards. There are scripts out there and they can even be run remotely but expect the results (remotely) in hours.
  
• Intune almost does away with loopback processing, this is inherently set to merge (effectively), this can make it a little easier to manage
  
• If you have teams then you can deploy to teams. Useful for software installations for students who have certain subjects such as tech or art.
  
• print deploy works fine.
  
• we are hybrid but I am only deploying new machines to azure only. This does not stop the devices being able to get an onsite hybrid token and access onsite resources but you wont have visibility in AD (you can set this up but I am looking to eventually phase AD out)
  
• GPO to WIN32 (registry) and device profiles took the longest time. Lots of searching. Many CSP policies are locked behind host OS version, lots are locked out of Pro. However in EVERY case I have been able to set the registry setting manually with a WIN32 batch file. Very very annoying. Obviously your licensing will determine this course of action - im setting up for the lowest common denominator even though at the moment I can upgrade to education version I intend changing our licensing for cheaper in the future, this will probably gave host pro licensing.
  
• Prototype device was surprisingly easy to set up and took a surprisingly long time to white glove pre provision - 31 mins per device. I would estimate 4gb of apps on normal machines. Our adobe CC machines took close to 2 hours to provision with their 10gb packages.
  
• logon times are now measured in "instants" rather than seconds.
  
• remediation scripts will fix some issues around WIN32 packages buuuuuuut you need this licensed. We dont.
  
• Get-AutopilotDiagnosticsCommunity is an excellent script to get status on profiles, apps or configurations that cause error either preprovisioning or OOBE first logon.
  
• 5x WIN KEY will get you the technician pre-provision secret screen when you have the OOBE branded logon page
  
• shift +F10 will get you a CMD prompt at the same OOBE branded logon screen, you can then POWERSHELL and install the Get-AutopilotDiagnosticsCommunity script, copying the results to a USB pen. This saves OOBE if you only want to fault find preprovisioning.
  

 

In short, registry manipulation is *awful* in intune. GPO -> policy and registry will take a long time. I have Winget working as a system context, this will be a game changer when I can get a cache server running (without a cache, having all machines updating apps simultaneously will be hell) however this is prototyped ona small number of machines. Two months start to finish from test machines, test rooms, full roll out. The rollout was a fortnight, the majority of time was GPO migration. Overall it was very smooth and had fewer issues than I thought it would have.

Edited February 8, 2024 by KK20

[PotNoodleTech]

Intune and Win 11 seems a big step backwards. I'll be holding off on Win11 for as long as I can.

[DalekSec]

Intune / W11 / Autopilot is great from scratch, not great if you have a legacy environment with tons of GPOs

[simpsonj]

Just out of interest, where did you learn how to do this? Any particularly good websites or video tutorials out there? It's been on my todo list for quite some time, but I've not found a good 'Getting started' guide.

[mavhc]

Pay Microsoft every month to have a worse way to control their computers? I'll stick to having a server

[KK20]

Just out of interest, where did you learn how to do this? Any particularly good websites or video tutorials out there? It's been on my todo list for quite some time, but I've not found a good 'Getting started' guide.

 

Only a couple of sources. Microsoft mainly, they have an excellent set of how to guides - I didnt watch a single video. I did google originally but there was a lot of Windows 10 guides plus out of date material. Microsoft also have huge grids of CSP and their licensing. Luckily some of these also have registry entries so you can ignore the CSP. For registry hacks I used my own knowledge, most of this hasnt changed since windows 10 (setting background colours is still HKEY_CURRENT_USER\Control Panel\Colors wallpaper is still HKEY_CURRENT_USER\Control Panel\Desktop etc).

 

It is very easy to set up, this is because there are not a lot of ways of doing things so there are only a few places you add configurations. Even so, Intune doesnt make it easy. For example, if you want to do the following:

 

Set the start button to the left :-)

Change search bar to an icon only

Remove copilot button

Pin office apps to the quick start menu

Pin chrome to the taskbar

Change lockscreen and logon screen to a corporate background

remove adverts and "search insights" on lockscreen

 

in the old days all the above could be done in a single GPO except you needed an XML for the taskbar and start menu layout. Roll onto intune:

 

1) You can create a single frankenregistry batch file to do the lot. Encompass this into a WIN32 app using your intimate friend intunewinapputil.exe and assign to groups. This is actually the neater option! Plus the largest pain to keep up to date. Reports on "app installations" is very good so you can also track which machines have them and status of "installation".

2) Create TWO configuration profiles and one WIN32 app - this is because not all the settings are exposed to CSP, plus desktop wallpaper and lockscreen CSP will not work with pro version whereas registry will. Why two configuration profiles? Because one is a "settings catalog" and one is a custom URI. You cannot mix the two in one profile so two profiles it is. Configuration profiles do not have quite the same reporting granularity of installations but you can still see where the system is up to.

 

Other oddities abound so far. If I set the keyboard to be UK on the OOBE then the pens will not activate handwriting in word. I need to set as US and then have a policy to set as UK. This is the only way I can get a UK keyboard with "@ in the correct place AND have ink to handwriting "draw pen" available. Whether that is an OOBE, intune or general MS problem (or even a surface problem) I do not know.

 

Intune / W11 / Autopilot is great from scratch, not great if you have a legacy environment with tons of GPOs

 

Yeah, we have literally hundreds. I logged on as one of each "user class" we have (primary, secondary, VI, staff, admin) and ran a results wizard, started at the top setting, copied to a spreadsheet, made common profiles and settings first, then tweaked individuals. Soul destroying but at least I only have to do this once. The REAL test was getting those settings to work onsite in place of GPOS!

 

One thing I did forget, we still have onsite documents with GPO redirection. Despite having quotas screwed down and onedrive being the default, the machines do have a script that creates a shortcut on the desktop to their own documents folders. Users grumble but im not even contemplating mapping something to this ancient resource that I want to get rid of.

Edited February 8, 2024 by KK20

[psydii]

Other oddities abound so far. If I set the keyboard to be UK on the OOBE then the pens will not activate handwriting in word. I need to set as US and then have a policy to set as UK. This is the only way I can get a UK keyboard with "@ in the correct place AND have ink to handwriting "draw pen" available. Whether that is an OOBE, intune or general MS problem (or even a surface problem) I do not know.

 

I'm fighting a similar problem right now. Some (but not all?!) devices will randomly decide to believe they are US based, and often mess up time and the autopilot process. We've got a similar policy as you that fixes any laptop that did manage to get through into a managed state with the regional settings wrong.

 

There doesn't seem to be rhyme or reason to it - seen it in laptops that we manually added to autopilot during oobe, and devices configured by the reseller. Most are fine, but some go weird. So so so strange.

[RLR]

I'm just getting into setting up some test machines with Autopilot and Intune. Trying to go mostly cloud based with as much as possible.

 

A couple of questions people might be able to help me with

 

Are you using shared devices or are your windows machines 1:1?

If you are using shared devices, how are you setting the correct filtering to the right user?

 

 

We have some software such as sibelius that uses a network license server. You mentioned you use a token to allow some internal access. Are you able to go into more detail about this?

[KK20]

Entra only device in a hybrid environment, install entra connect. If you use FIDO2 keys you need to add some additional parts (I had already done this as we use FIDO2 keys for our 4 and 5 year olds - much easier than getting them to type their names! They are handed out and handed back after their IT lessons, well worth the hour the teaching assistants do at the start of the year registering each FIDO for new intake.):

 

https://learn.microsoft.com/en-us/entra/identity/devices/device-sso-to-on-premises-resources

 

Not all are 1:1 (some are, some arent), people log out and log in as necessary "primary user" is the first logon, we use a "deploymentuser" account - a regular account for shared machines to register and get out of the OOBE, after that you can log in as "other user" or log out as necessary the same as any normal PC of old. Im not sure what you mean by filtering. 365 SSO works as expected, we use securly suite and that picks up whatever user has logged on, as does our watchguard.

 

I have kept our "new" devices as pure cloud entra registered only. DSREGCMD /STATUS shows only AzureAdJoined as YES bu OnPremTgt is also YES %username% is populated correctly and there are no popups or credential issues with \\profileserver\documents_share\%username%\documents for example.

 

I note you say sibelius, yes we also have a license server and that worked without tweaking but only onsite (for obvious reasons). I am trying to get an always on VPN running but that has proved elusive for the time being. I can certainly add a manual VPN without issue.

 

There doesn't seem to be rhyme or reason to it

this is very common with MS products, if you initially install something without EN-US then you hit problems later, this used to be a massive problem with SQL server. You always installed EN-US and worried about the proper language later. It seems that OOBE can do this too, once you get past the OOBE then an EN-GB keyboard configuration profile fixes everything. Of course the user gets an @ on the 2 key for their OOBE...

Edited February 8, 2024 by KK20

[Chuckster]

My organisation is Hybrid and they've had great difficulty getting Windows 10 working the way they want it to, especially with legacy systems etc.

 

Those higher up the chain of command have decided to bring everything back in house. Effectively, we'll have GPOs to manage Windows 11 devices. Cisco ISE providing VPN, filtering etc.

 

Additionally, we will use Autopilot for the provisioning of devices and SCCM + Intune to deploy applications and Store Apps.

 

Intune as a whole is slow and is nothing like the MDM solutions provided for Apple devices (Macs, iPads, iPhones) such as Jamf and Lightspeed, as they're instantaneous with deploying apps, profile configs etc.

[supportman]

What licensing did you buy to make this work?

[RLR]

My organisation is Hybrid and they've had great difficulty getting Windows 10 working the way they want it to, especially with legacy systems etc.

 

Those higher up the chain of command have decided to bring everything back in house. Effectively, we'll have GPOs to manage Windows 11 devices. Cisco ISE providing VPN, filtering etc.

 

Additionally, we will use Autopilot for the provisioning of devices and SCCM + Intune to deploy applications and Store Apps.

 

Intune as a whole is slow and is nothing like the MDM solutions provided for Apple devices (Macs, iPads, iPhones) such as Jamf and Lightspeed, as they're instantaneous with deploying apps, profile configs etc.

 

Yes, this is the frustrating part about intune how you have to wait around to see if the change or updates you make are working. Takes setting this up a long time!

[DWilson1997]

We are full cloud with W11 / Intune and it has resolved so many issues for us and would never want to go back to legacy on prem/GPO. You have to completely rethink your IT services from the ground up and ditch the legacy systems where possible

[mavhc]

We are full cloud with W11 / Intune and it has resolved so many issues for us and would never want to go back to legacy on prem/GPO. You have to completely rethink your IT services from the ground up and ditch the legacy systems where possible

 

What issues were you having?

[DWilson1997]

What issues were you having?

 

We had an old network which I inherited. Servers running 2012, poor GPO configuration, lots of 'patches' over the years. There was an expectation that IT wouldn't work and would be unreliable. I will say, the move to the 'cloud' is rarely going to be a cost saving.

[free780]

Out of Tune does seem to be slow. Only using it to push VPN configs via custom XML. On win 10 seems fine. But in Win11 there seems to be numerous issues.

You have to delete remnants of a VPN to amend a ccnfig.

I might look at using PowerShell scripts and a scheduled task. Seems a lot of work just to push VPN configs. Don’t want to use MECM which relies on VPN connectivity.

 

We had an issue where out of tune wouldn’t recognise some user licenses. It took 5 months to get resolved.

 

As for Microsoft now splitting some features as separate licences seems greedy.

 

Having no GPP or secpol is also an issue. GPO and MECM work well and you can find lots of logs to sort out issues.

[KK20]

fun problem of the week, or rather a rookie mistake by me this week. I needed to push a registry change to clients, so I spooled up a simple batch file with a bunch of REG ADD and REG DELETE in there (remembering to /reg:64 - yes I know I can "sysnative" but this is equally effective and saves me typing a longer string in the intune portion). WIN32 app deployed all seemed to be good, clients were reporting success and the registry changes could be observed. All good till I needed to wipe a laptop that was going to a new person, the wipe happened, all booted up, ran preprovision and FAIL! 0x80070001 a useless autopilot error code that could mean anything but generally means something didnt install in time (i.e. tried 3 times and failed).

 

My favourite go to script Get-AutopilotDiagnosticsCommunity -online will generally tell you what has gone wrong - it saves wading through the huge extension log. Sure enough my new registry file was failing to install. this made no sense as regedit showed me that it DID "install" as the registry changes were present. Looking through the extension log I saw [Win32App] lpExitCode 1 and realised what I had done: Batch files have %errorlevel% which is passed back to the intune installer - it expects a 0 as success. My batch file started with a few REG ADD but ended with REG DELETE - the last one did not exist so effectively the final %errorlevel% was a fail or 1. Reshuffled so that the delete are first and the add last fixed all.

 

Moral of the story, dont forget your %errorlevel% in batch files.