InTune Settings > Shared / Staff / Pupils

[garethEds]

Hi All,

 

I've been reading everything on here I can find on InTune and I'm still a bit confused with (or annoyed at ) myself in that I cannot get to grips with how configuration policies work an reach the machine. I get it all on an on-site domain GPO in place setup, but I cannot see how it works from the cloud.

 

On our current domain we have:

 

Machine GPOs; Staff user GPOs and Pupil GPOs. We all know how they work.

 

So how does it work on InTune.

 

I have machines in groups and I can allocate a configuration profile full of settings to that group. We have been told that machines can be staff or pupil machines with specific settings. But this is not what I want. We have shared devices where pupils and staff could log in whenever they want. Why do I get the feeling this cannot be done with InTune?

 

If a student logs in using their InTune credentials - do their settings get downloaded from InTune and applied when they login? Or are the 'pupil' settings already on the machine and update every now and again? What if a staff member comes along and logs in? Are the staff settings then downloaded each time?

 

Does this make sense? I'm feeling a bit thick.

 

Cheers

 

Gareth

[CHiLL]

Microsoft have introduced ADMX support into Intune and from my (so far short and limited) testing, it works fairly well and organised almost identically to your on-site GPOs. You can sort of thing of your on-site OUs as Intune's groups, where you can create a group containing devices and another containing users. You configure your Intune profiles as required and assign them to the necessary groups. You can access these ADMX settings in Intune > Devices > Windows > Configuration Policies > Create > New Policy > Platform: Windows 10 and later > Profile type: Settings Catalog

 

Settings Catalog is the new ADMX templates and Templates are the older/original Intune style ones. There is also an option to import existing on-site ADMX policies into Intune, but I decided against that, there are a number that are configured for on-site resources and a lot of old and probably no longer required settings from previous versions of Windows. I decided to spend the time and go through each category in the Settings Catalog and apply as necessary.

 

In terms of how does Intune communicate with the device - it's a bit whimsical. The device uses the "intunemanagementextension" application/service to communicate, pull settings/apps, etc. However, there's no ability to see what it's doing or any meaningful logs. You can push the Company Portal app to manually sync, get your published apps, etc...but I've found it's unreliable at deploying/installing on clients.

 

As I'm still in the testing phase of these ADMX templates, I have created some test groups:

• All Workstations - Has a policy that includes Computer Configuration settings I want all machines to have assigned to it
  
• Staff Workstations - Has a policy that includes Computer Configuration settings I want staff machines to have assigned to it
  
• Student Workstations - Has a policy that includes Computer Configuration settings I want all student machines to have assigned to it
  
• All Users - Has a policy that includes Computer User settings I want all users to have assigned to it
  
• All Staff Users - Has a policy that includes User Configuration settings I want all staff to have assigned to it
  
• All Student Users - Has a policy that includes User Configuration settings I want all students to have assigned to it
  

Edited March 15, 2024 by CHiLL

[garethEds]

Microsoft have introduced ADMX support into Intune and from my (so far short and limited) testing, it works fairly well and organised almost identically to your on-site GPOs. You can sort of thing of your on-site OUs as Intune's groups, where you can create a group containing devices and another containing users. You configure your Intune profiles as required and assign them to the necessary groups. You can access these ADMX settings in Intune > Devices > Windows > Configuration Policies > Create > New Policy > Platform: Windows 10 and later > Profile type: Settings Catalog

 

Settings Catalog is the new ADMX templates and Templates are the older/original Intune style ones. There is also an option to import existing on-site ADMX policies into Intune, but I decided against that, there are a number that are configured for on-site resources and a lot of old and probably no longer required settings from previous versions of Windows. I decided to spend the time and go through each category in the Settings Catalog and apply as necessary.

 

In terms of how does Intune communicate with the device - it's a bit whimsical. The device uses the "intunemanagementextension" application/service to communicate, pull settings/apps, etc. However, there's no ability to see what it's doing or any meaningful logs. You can push the Company Portal app to manually sync, get your published apps, etc...but I've found it's unreliable at deploying/installing on clients.

 

As I'm still in the testing phase of these ADMX templates, I have created some test groups:

• All Workstations - Has a policy that includes Computer Configuration settings I want all machines to have assigned to it
  
• Staff Workstations - Has a policy that includes Computer Configuration settings I want staff machines to have assigned to it
  
• Student Workstations - Has a policy that includes Computer Configuration settings I want all student machines to have assigned to it
  
• All Users - Has a policy that includes Computer User settings I want all users to have assigned to it
  
• All Staff Users - Has a policy that includes User Configuration settings I want all staff to have assigned to it
  
• All Student Users - Has a policy that includes User Configuration settings I want all students to have assigned to it
  

 

Thanks for the reply. A the moment I am on the 'All Workstation' part of things. However I am experimenting with an 'All Staff Users' policy, but my question was - when does this get put on the machine? Is it at logon time?

 

G

[CHiLL]

Thanks for the reply. A the moment I am on the 'All Workstation' part of things. However I am experimenting with an 'All Staff Users' policy, but my question was - when does this get put on the machine? Is it at logon time?

 

G

Sorry, I went all out on that post.

 

Syncing and applying things is where I'm not sure on. I know there is a "PushLaunch" scheduled task under Task Scheduler Library > Microsoft > Windows > EnterpriseMgmt > GUID > PushLaunch, but I don't know when it runs or what the triggers are. Supposedly, you can run this manually to force a sync (or use this Powershell command:

Get-ScheduledTask -TaskName "PushLaunch" | Start-ScheduledTask

However, I can't tell if it's working and syncing. The machine I'm testing with isn't reporting into Intune according to the Intune console, so I might be dealing with another issue too.

Edited March 15, 2024 by CHiLL