Intune and ICT suites

[localzuk]

How are those of you who use Intune for deploying Windows and apps doing this reliably in a shared suite context?

 

Specifically, how do we get them to reliably go from clicking to wipe or fresh start, to having all the apps we use installed by the time the login box appears? At the moment, we've been living with the devices installing stuff after login, but it is slow, and unreliable - and can mean some stuff doesn't appear until students are already using the machines. Not ideal for teaching and learning.

 

Combine that with the random time it can take to actually trigger to install something, unless we go into Company Portal and click Sync (as Sync in Intune itself seems to be fairly useless), there's no simple way for us to trigger it all to install.

 

I am trying to build it to install during ESP, but some of our apps seem to not like installing during that stage - we get things like 0x87d104c - but those same apps install fine after ESP.

So, what are you all doing to go from wipe/fresh start -> everything ready in a suite?

[RobFuller]

For shared devices we target apps at the machine so device groups rather in user groups so we know all the applications are already installed on the machine.

[ovenchips]

Following this as curious to see any answers or suggestions. We're refreshing all of our installs over the summer from MDT/GPO to InTune, and the tests so far have not been inspiring, same issues as you (and plenty others!) mention with slow installs, seemingly random syncs / install triggers, it's a nightmare and every machine in a suite ends up in a different state after leaving them for a few hours.

[localzuk]

1 minute ago, RobFuller said:

For shared devices we target apps at the machine so device groups rather in user groups so we know all the applications are already installed on the machine.

All our apps are device targeted, but Intune does not have any mechanism to ensure timely installation. For example, we reimaged a suite using our current setup last week. The machines did not start installing the post ESP apps until I manually logged in to the machines. They sat their at the login screens, doing absolutely nothing. Even after 3 hours, none of them had started installing the device targeted apps.

[Squelch]

IME it's not a good idea to install too much during ESP. My ESP installs Office and ScreenConnect (for remote access) plus a few other minor bits and pieces. ESP can and will fall over if you ask it to do too much. Each computer takes around 30 to 45 mins to install all software after ESP has finished. In total, I would estimate that a computer will fully build in approximately 90 minutes. I used a summer holiday to rebuild every computer in the school.

 

I very rarely wipe a device. I usually just rebuild from scratch.

I would say having fast internet is essential for Intune as it will reduce the time needed to build/rebuild/whatever.

 

Also, restarting a device will often trigger apps/policies to apply.

 

[lparry]

Another important ESP note - don't try and install LOB apps (MSI's etc.) as it can and probably will cause you issues - see quote from Andrew Taylors blog below as he is much better writing it down than me!

 

Quote

Now the bit you are here for, why does it cause issues? 

 

When you deploy a Win32 app, it uses in the Intune Management Extension (IME) to grab the app details, kick off the installer, wait for the exit code, detect it and then trigger the next one.  All nice and straight forward and you know the IME is putting them all in a queue for you.

 

MSI LoB on the other hand is just sent straight to msiexec on the device.  Intune will stagger your MSI LoB installs, but it has no awareness of them so will add your Win32 ones soon afterwards.

 

If you are lucky, the apps will have completed installing before the first Win32 hits, but if not, your Win32 app will start the installer, trigger msiexec which will get extremely unhappy because it’s already in-use.  We’ve all seen the familiar “there is already an installation in progress” screen, only this time it’s in the SYSTEM context AND during ESP so no-one sees it at all.

 

But we are the same as @Squelch pretty much - We don't push any apps during ESP stage and find they are good to go in a hour or so unless its a computer with the Adobe suite as that can hang!

Edited June 5 by lparry
Missed a word!

[localzuk]

We don't use LOB at all. All our apps are Win32.

 

Someone has suggested that we switch to "All Devices" for app deployment with filters instead of targeting apps with groups.

 

So I will give it a go, move most apps out of ESP again, and try targeting with filters instead. The problem is the word @Squelch used there. "often". Restarting will "often" trigger... We don't need often. We need reliability. We need to be able to trigger reinstalls for a suite, and it 100% be finished and ready for teaching at the end of the process, without us having to intervene or random machines not synching and getting their full set of apps.

[Boredguy]

I like being called Someone

[localzuk]

6 minutes ago, Boredguy said:

I like being called Someone

Hi Someone! Haha.

[psydii]

8 minutes ago, localzuk said:

We don't use LOB at all. All our apps are Win32.

 

Someone has suggested that we switch to "All Devices" for app deployment with filters instead of targeting apps with groups.

 

So I will give it a go, move most apps out of ESP again, and try targeting with filters instead. The problem is the word @Squelch used there. "often". Restarting will "often" trigger... We don't need often. We need reliability. We need to be able to trigger reinstalls for a suite, and it 100% be finished and ready for teaching at the end of the process, without us having to intervene or random machines not synching and getting their full set of apps.

There's a reason Configuration Manager is included with Intune. 😂

[localzuk]

Just now, psydii said:

There's a reason Configuration Manager is included with Intune. 😂

I don't think it would be ideal me setting up Config Manager just before I leave... "Here's a complex beast, enjoy, I'm off to Poland".

[Squelch]

I was also initially frustrated with Intune, after a couple of years of using it I am more relaxed. Nobody wants to wait around for apps to install but they really don't take long.

I still use groups to target apps and policies. I know that I should have moved on but it works and it's what I'm used to.

[psydii]

Unless you can figure out the correct blood sacrifice and incantations, you are probably going to need a 3rd party product to meet your "all apps installed perfectly in a predictable, compliant timeframe" requirement.

Here's a deep dive on the timings of various Intune managed processes:

Intune Timing Demystified: The Truth About Intune Sync Intervals

 

But more importantly, will you be updating your handle to be localzpl ?

[localzuk]

3 minutes ago, psydii said:

But more importantly, will you be updating your handle to be localzpl ?

Maybe, you never know.

[localzuk]

24 minutes ago, psydii said:

Here's a deep dive on the timings of various Intune managed processes:

Intune Timing Demystified: The Truth About Intune Sync Intervals

 

An interesting article, that explains a lot. Except for justification. Why Microsoft thought this architecture was acceptable. When other MDM solutions work in a much faster, and much more reliable manner. Take MDM interaction with iOS devices. If I deploy an app to a group of iPads - if they're switched on and on wifi, they'll have that app in moments. If I change policy? They get it nearly instantly. 

[DrCheese]

Yes, this is what I can't understand. MS have built intune ON WINDOWS primarily for 1:1, because that's how they function. In their world, shared PCs aren't really a thing. So it doesn't matter if changes aren't instant, they'll hit the user eventually & then it's done

 

But even tho, not being able to whack out changes quickly is incredibly painful. For starters, it makes testing & refining a config really painful/long. I'm sure we've all sat in GPO before, rebooted/relogged a PC to watch our changes hit. Intune you sometimes have to wait for hours, even if you try to force it.

 

It's just stupid - As you say, iOS is instant. Google can do it also with Chromebooks (Those are a thing of beauty) & sending a command will apply straight away.

 

I discovered all these issues people have said above in 2020 when we rolled out our lockdown laptops with it. I held off doing it on our normal PCs back then, hoping all this would improve but it really hasn't - It's still a hot pile of garbage.

 

That they haven't fixed Machine level NPS yet is also insane (How you can't have an intune only device join a local WiFi network with NPS)

Edited June 5 by DrCheese

[itskdog]

20 minutes ago, localzuk said:

An interesting article, that explains a lot. Except for justification. Why Microsoft thought this architecture was acceptable. When other MDM solutions work in a much faster, and much more reliable manner. Take MDM interaction with iOS devices. If I deploy an app to a group of iPads - if they're switched on and on wifi, they'll have that app in moments. If I change policy? They get it nearly instantly. 

 

Apple's MDM protocol is a push-based one, powered entirely by silent push notifications that tell the device what to do - the MDM has to initiate contact to the device to do anything.

 

By contrast, the OMA-DM protocol that Windows uses is device-initiated like Group Policy, but Intune is able to try to remotely trigger a sync via a silent push notification.

 

There is an issue where the Intune Management Extension (IME - manages Win32 & Store apps, plus remediation scripts and a few other bits that OMA-DM can't do) won't check for apps immediately after ESP, and instead it requires either a logoff/logon, reboot, or waiting 60 minutes for the routine fallback sync.

 

You accurately noted that the Sync button in Intune and the Sync button in Company Portal behave differently, as IIRC the one in Intune only sends a notification to OMA-DM (the same as clicking Sync from the "Access work or school" page in the Settings app), not IME, while the Company Portal button does trigger an IME sync (though I'm not sure if it triggers an OMA-DM sync)

[psydii]

Quote

Why Microsoft thought this architecture was acceptable. When other MDM solutions work in a much faster, and much more reliable manner. Take MDM interaction with iOS devices. If I deploy an app to a group of iPads - if they're switched on and on wifi, they'll have that app in moments. If I change policy? They get it nearly instantly.

Store Apps are they key I think. Microsoft bet Windows' future on metro/modern/appx and intune was built for that.  IOS and Android *only* had those style of apps. Microsoft's bet didn't pan out, and Intune has struggled every since.

 

[altecsole]

I feel your pain. This situation is what's stopping us from embracing Intune more fully. We use it for laptops, which just have Office and Sophos installed, but I don't feel we can comfortably move our other stuff over. We use PDQ Deploy & Inventory, so app installation and automatic update is really easy. We could look at PDQ Connect, but the price increase is a barrier. 

[localzuk]

9 minutes ago, psydii said:

Store Apps are they key I think. Microsoft bet Windows' future on metro/modern/appx and intune was built for that.  IOS and Android *only* had those style of apps. Microsoft's bet didn't pan out, and Intune has struggled every since.

Honestly, a shame. Microsoft's store app stuff is so much simpler to deploy. I just wish they hadn't messed up the paid apps stuff for businesses. Store for Education/Business was clunky but it worked. It just needed another iteration to get right - or build directly into Intune.

[Synkrox]

I push apps to the device through intune - prefering store/winget apps if possible - although I run a pretty lean software pack and thankkfully have binned all the science teachers 16 bit simulation software 😂

 

Then I use this to keep everything up to date:  GitHub - Weatherlights/Winget-AutoUpdate-Intune: WAUaaS daily updates apps as system and notify users. WAUaaS brings you WAU in a service like pattern that can be deployed and configured by Microsoft Intune (or other MDM solutions). · GitHub

 

do feel your pain though - back in the days of GPOs and machine startup scripts I had that stuff absolutely bulletproof and nailed down. It ran like a swiss watch.
Like the move from everything on-prem to cloud, there's noticeable slow down, but it does work eventually.

[psydii]

3 hours ago, localzuk said:

I don't think it would be ideal me setting up Config Manager just before I leave... "Here's a complex beast, enjoy, I'm off to Poland".

not ideal, but maybe the only "free" solution?   ...if you use it for *only* deploying software, get all the collections set up for them, and a write a  little "how to deploy software" guide then it will be fine for probably at least 18 months which is plenty of time for them to find their feet, break it and take ownership of the sccm replacement project.

 

 

 

 

Edited June 5 by psydii

[localzuk]

OK, so, switched everything to being deployed via All Devices, with filters, for a test device over the weekend. 8 apps in ESP as mandatory. Left it running.

 

Arrive this morning and the device has installed the ESP apps, but nothing else. This is what I mean about unreliable. Surely with the timings linked above, it should have checked in for app deployments and deployed the rest? Even after logging in nothing happens until I go into Company Portal and click the magic sync button...

[Squelch]

For me, nothing will install after ESP until the first login.

[DrCheese]

This recent reddit thread sums up a lot of how I feel about Intune

 

https://old.reddit.com/r/sysadmin/comments/1tvks8e/intune_is_not_fit_for_purpose/

 

It's just... rubbish.