Intune and assigned users

[DavR]

34 minutes ago, mdrabble said:

Laptop reboots and then get to the welcome page - School landing page, ready for user to sign in and start the Intune process.

 

User logs in and then the ESP kicks in, completed the Device Prep stage, no issue

Device setup, it skipped the apps

User Setup, again skipped the apps and then finally you would complete the Windows hello and get to the desktop, where apps would then start to install

 

I'm assuming you're starting at an OOBE page, or the ESP wouldn't otherwise run. 

 

So this is on a fresh device, which you've only just uploaded the hardware hash for. How are you targeting your apps? Are you using All Devices, or, do the devices need to be a member of a specific group? Could it be that that the group membership isn't there in time for the step which enumerates which apps need to install, hence an ESP with zero apps in it?

 

By the time you hit first logon, the membership could have been set correctly, and thus apps install. This might also explain why on a rebuild, using the same Intune device record, the ESP runs and the correct apps install (or at least try to), because by this point device group memberships are correct.

 

Quote

Using Intune, I then selected the laptop and select fresh start, laptop reboots, goes through the clean up process and then back to the welcome page ready for user to sign in again.

 

This time when the user signs in, on the Device setup stage, it recognises apps to install and then gives and error 0x800700c1 which I think is to do with Win32 apps, when I expand things, I see error 0x0000000

 

What I don't understand, is why is this error not showing on the initial setup and skips the apps (I am guessing it skips the apps due to the error) - but then why install the apps when at the Desktop???

 

At a guess, I'd say this was a secondary problem. One of your apps is failing, but they won't tell you which one, because that would be too easy. You can troubleshoot which app/s fail by seeing how many are installed at first logon, or, my preference, going through the Event Logs | Application to read the Windows Installer logs, telling you which apps installed and when.

[mdrabble]

 

5 minutes ago, DavR said:

I'm assuming you're starting at an OOBE page, or the ESP wouldn't otherwise run. 

 

So this is on a fresh device, which you've only just uploaded the hardware hash for. How are you targeting your apps? Are you using All Devices, or, do the devices need to be a member of a specific group? Could it be that that the group membership isn't there in time for the step which enumerates which apps need to install, hence an ESP with zero apps in it?

 

By the time you hit first logon, the membership could have been set correctly, and thus apps install. This might also explain why on a rebuild, using the same Intune device record, the ESP runs and the correct apps install (or at least try to), because by this point device group memberships are correct.

 

Apps are a combination of all devices and then dynamic device group.

 

You would have thought that the apps set for all devices would appear on the Device setup at the very least.

 

The Dynamic group is fully populated with the laptops with the device tag via this rule -

(device.devicePhysicalIds -any (_ -startsWith "[ZTDid]")) and (device.devicePhysicalIds -any (_ -contains "[OrderID]:Staff"))

 

I have done it this way just in case we add any student Intune devices at a later day and saves me having to make changes later on (if that makes sense)

 

On the Dynamic group, 

 

20 minutes ago, DavR said:

At a guess, I'd say this was a secondary problem. One of your apps is failing, but they won't tell you which one, because that would be too easy. You can troubleshoot which app/s fail by seeing how many are installed at first logon, or, my preference, going through the Event Logs | Application to read the Windows Installer logs, telling you which apps installed and when.

 

Did Shift+F10 ran event viewer, went through different areas and could find no error at that time when the deployment failed.

 

I'm going to remove all apps and then assign them one by one - I'm clutching at straws now.

 

I just don't understand why apps deployed out the correct way during the trial i ran - I must have changed something and not realised it which is more likely to be the case.

[buzzard]

8 minutes ago, mdrabble said:

 

 

Apps are a combination of all devices and then dynamic device group.

 

You would have thought that the apps set for all devices would appear on the Device setup at the very least.

 

The Dynamic group is fully populated with the laptops with the device tag via this rule -

(device.devicePhysicalIds -any (_ -startsWith "[ZTDid]")) and (device.devicePhysicalIds -any (_ -contains "[OrderID]:Staff"))

 

I have done it this way just in case we add any student Intune devices at a later day and saves me having to make changes later on (if that makes sense)

 

On the Dynamic group, 

 

 

Did Shift+F10 ran event viewer, went through different areas and could find no error at that time when the deployment failed.

 

I'm going to remove all apps and then assign them one by one - I'm clutching at straws now.

 

I just don't understand why apps deployed out the correct way during the trial i ran - I must have changed something and not realised it which is more likely to be the case.

On the app installs, did you say you are mixing w32 and LOB? I have had these clash as the processes run simultaneous so that's why I wrap everything in w32 these days. Is the user you're signing in with allocated an Intune licence?

[DavR]

7 minutes ago, mdrabble said:

Did Shift+F10 ran event viewer, went through different areas and could find no error at that time when the deployment failed.

 

I'm going to remove all apps and then assign them one by one - I'm clutching at straws now.

 

I just don't understand why apps deployed out the correct way during the trial i ran - I must have changed something and not realised it which is more likely to be the case.

 

Honestly, I've had apps working just fine, that then started to cause errors when running during ESP, it's a pain. The latest batch I had were some print drivers, which didn't fail, they just hung, and hit the 30 minute timeout I had set on the app. Could timeouts be your issue rather than hard errors?

 

Here's a thought - you can look at which apps have failed to install in the Intune console. It can take a little while to register, but under individual apps, you can look for install failures, and the error codes attached. 

[DavR]

12 minutes ago, mdrabble said:

Apps are a combination of all devices and then dynamic device group.

 

You would have thought that the apps set for all devices would appear on the Device setup at the very least.

 

The Dynamic group is fully populated with the laptops with the device tag via this rule

 

I wonder, for testing, could you put a delay then a reboot, between the hashed uploading in your TS, and the user logging in? I wonder if this might give it time for the device group memberships to complete. 

 

Alternatively, I suppose it could be that Intune membership "proper" doesn't complete until after the OOBE runs. Would be a pain if that's the case, but I wouldn't discount it yet.

 

[mdrabble]

2 minutes ago, buzzard said:

On the app installs, did you say you are mixing w32 and LOB? I have had these clash as the processes run simultaneous so that's why I wrap everything in w32 these days. Is the user you're signing in with allocated an Intune licence?

 

Yep, mixture of LOB, Win32 and Store Apps - I knew there could be issues with LOB apps stalling but didn't realised they would try and run at the same time as Win32 apps.

 

All users have A3, so they have Intune Plan 1 as part of it.

[DavR]

This thread on Reddit seems to describe a similar problem to yours. The solution proposed seems to be "disable co-management".

 

 

Quote

It started working as expected after changing the co-management policy to enable the setting “Override co-management policy and use Intune for all workloads.”

This seems like a workaround to a limitation in the functionality rather than a good solution.

 

[mdrabble]

Just checked and haven't got co-management enabled.

[DavR]

This is a long shot, but do you have more than one ESP page configured? Could it be you're getting the system default ESP page, because the one you want to run is published to a device group that is not yet populated?

 

I'm still thinking it's something around device groups / Intune membership not being "there" or correct in time. But that doesn't explain why apps you've deployed to All Devices aren't showing up.

[mdrabble]

I do, yea.

 

Default which and one I imported from Microsoft

 

both Set to all devices -

Default wont let me remove it and is assigned to all user

 

_MSFT - assigned to all devices

 

Interestingly, as I took screenshots, I noticed the default has all users assigned and assignment to all devices, where as the MSFT is just assigned to all devices

 

[DavR]

I wonder if it's delivering the wrong ESP page?

 

You could try making a visible change on the default page, and seeing if that's the one that comes up first time round. 

 

Maybe your custom ESP page need to be deployed to users as well as devices. 

 

There aren't many settings in that ESP page - you could drop the custom one and put those into the Default, and see what difference that makes.

[mdrabble]

Bit of an update

 

I'm going back to the very basics to test things.

 

Imaged laptop via USB and then uploaded the hardware hash using GetAutoPilotInfo -online

 

Waited until Dynamic groups updated, checked and then proceed with the initial sign in and ESP completed exactly as expected - app installed at the device stage. - Assigned to AutoPilot Group only and installed 10 apps perfectly - Success!!

 

Repeated the process, USB install and then ran the SCCM scripts - device is added to an additional group for Staff Devices, which installs an additional 8 apps. - Installing apps give an error, so it narrows down to an issue with 8 apps but looks like the app issue is a secondary issue as your suggested @DavR

 

Issue appears to be SCCM image related it would seem - or possibly network related as currently working from home as not 100%

 

I have a VM of an SCCM image on my laptop with checkpoint so I can play with that but now at least I know the Intune process works, it image related (or so it seems)

 

Need to do some more test but will update once I know more.

 

Cheers

Mark

 

[mrstrong]

only just started looking (again!) at intune but one thing I noticed is your ESP _MSFT is only assigned to all devices.

 

In my initial test of a User-driven enrollment, I had to assign the ESP policy to All devices and All users to get it to "work" 

Maybe as the process is tied to the user signing in during the OOBE ?

[DavR]

Sounds like the logic of your process is correct, at least, so that's good to know.

 

Best of luck with the troubleshooting!

[mdrabble]

51 minutes ago, mrstrong said:

only just started looking (again!) at intune but one thing I noticed is your ESP _MSFT is only assigned to all devices.

 

In my initial test of a User-driven enrollment, I had to assign the ESP policy to All devices and All users to get it to "work" 

Maybe as the process is tied to the user signing in during the OOBE ?

Have since removed that and moved everything to the default ESP, so it is assigned to all users and all devices.

[mdrabble]

Well, USB to install Windows 11 has done the trick!

 

Managed to Intune 8 laptops without issue and then suddenly app error on approx 12 laptops and 4 with random app issues, so I am just starting those again.

 

At some point I need to look at what SCCM is doing to the image.

[DavR]

I was thinking of going down the USB stick route for our setup, as either that or using the factory deployed OS image seems to the supported configuration these days. But I'm keeping hold of MDT for OS deployment for now, USB installs seems a backward step. It's obviously fixed something in your setup though, so can't complain there!

 

1 hour ago, mdrabble said:

Managed to Intune 8 laptops without issue and then suddenly app error on approx 12 laptops and 4 with random app issues, so I am just starting those again.

 

Classic Intune deployment 😂

 

[mdrabble]

Well to try and speed things up for staff, I’ve set myself as a deployment manager and I’m going through the ESP when doing virtually all the config etc so staff just have to log in and do the windows hello and all done.

 

There a couple of apps that are being problematic so removed them from the deployment - adding device to WiFi using a preshared key as not had the time to sort certificates and Sims.net

 

both are powershell scripts which run fine manually but not when run from intune as a required app or downloaded from company portal.

 

At least I can managed on USB for now and then can take a look at the deployment side later on.

 

thanks for all your help @DavR it be very much appreciated:-)

[DavR]

Glad to hear it @mdrabble. You're very welcome 😁

 

Re the WiFi, when you get a chance, this is dead easy to do as a settings profile - https://learn.microsoft.com/en-us/intune/intune-service/configuration/wi-fi-settings-configure

 

SIMS .Net though.... yeah, I remember that being a pig to install. 

[mdrabble]

2 minutes ago, DavR said:

Glad to hear it @mdrabble. You're very welcome 😁

 

Re the WiFi, when you get a chance, this is dead easy to do as a settings profile - https://learn.microsoft.com/en-us/intune/intune-service/configuration/wi-fi-settings-configure

 

SIMS .Net though.... yeah, I remember that being a pig to install. 

Yea, discovered the wifi last night after thinking there must be a better way 😄

 

The annoying thing with sims, is that the installer works fine manually but not when deployed.

Another annoying thing I have just discovered, that since blocking access to cmd and powershell for users, Papercut Deploy no longer runs as the batchfile withing the programs folder is blocked from running.