Intune Policies - User/Machine & Co-Managed Devices

[CHiLL]

We have all of our student DFE laptops on Intune and since it was during the pandemic, it was all done in a rush and a that'll do approach, especially since we hadn't used the Windows management side of Intune before. I'm now looking back over our configuration and trying to decide how best to manage all our policies. Specifically that we have a group that contains all our DFE devices and all our machine and user policies are directed towards that. This has the knock on effect that machine policies are affecting all users that use the machine, including admins (such as disallowing the C: drive, USB drives, etc). In a traditional AD environment, your machine settings were targeted towards the machine OU and the user settings were targeted towards the user OU. While I can do this in Intune, I want to clarify a couple of things:

 

1. Our on-site devices are co-managed, with SCCM being the specified/preferred MDM in the co-management settings. I want to be sure that for example, if I apply a user setting to our "All students" group in Intune, that will only affect the users on the DFE laptops and not the on-site machines. It's my understanding that this is the case, since SCCM shouldn't allow Intune policies to apply, but it's not something I'm entirely sure about.
   
2. Has anyone attempted to import their existing on-site group policy settings into Intune and did it work? I'd rather not reinvent the wheel, since we already have known working settings and restrictions on-site.
   

[KK20]

you can exclude policies. Much in the same way as a GPO with loopback processing - think of intune "assignments" as always having loopback processing enabled, a group in intune can consist of users or devices. So you could have configuration profile targeting a device group but excluding "priviledge users". Then another configuration profile targeting the same device group but excluding non privilege users etc. For installations though, be careful about the context of system/user and remember that WIN32 is exactly that, a 32 bit installation process with all that entails (WOW6432 nodes as default, program files x86 etc. Not a problem but be mindful). If you arent hybrid, dont forget NTP (like I did).

 

I originally tried to import GPO and tweak but the import is a train wreck - there are limited crossovers and a lot of deprecated and "suggested" transfers - dont take that 100% compatible GPO->Intune import as gospel, make sure you read what it has transferred and what it has SUGGESTED as a compatible option! It was a painstaking approach but in the end I recreated my configuration profiles from scratch. Expect lots of pain and suffering if you use a lot of registry edits. You can import ADMX though to mitigate registry edits somewhat.

 

https://www.edugeek.net/forums/o-s-deployment/236715-dragged-kicking-screaming-into-windows-11-era-short-tale.html

Edited March 1, 2024 by KK20

[CHiLL]

you can exclude policies. Much in the same way as a GPO with loopback processing - think of intune "assignments" as always having loopback processing enabled, a group in intune can consist of users or devices. So you could have configuration profile targeting a device group but excluding "priviledge users". Then another configuration profile targeting the same device group but excluding non privilege users etc. For installations though, be careful about the context of system/user and remember that WIN32 is exactly that, a 32 bit installation process with all that entails (WOW6432 nodes as default, program files x86 etc. Not a problem but be mindful). If you arent hybrid, dont forget NTP (like I did).

 

I originally tried to import GPO and tweak but the import is a train wreck - there are limited crossovers and a lot of deprecated and "suggested" transfers - dont take that 100% compatible GPO->Intune import as gospel, make sure you read what it has transferred and what it has SUGGESTED as a compatible option! It was a painstaking approach but in the end I recreated my configuration profiles from scratch. Expect lots of pain and suffering if you use a lot of registry edits. You can import ADMX though to mitigate registry edits somewhat.

 

https://www.edugeek.net/forums/o-s-deployment/236715-dragged-kicking-screaming-into-windows-11-era-short-tale.html

I've decided I'll create some new policies from scratch and test them on a test group. Since Intune can now effectively manage devices the ADMX way using the Settings Catalogue...is there any need or requirement to use Templates any more? Or should I just configure via Settings?