cdwyersandysecondary

Yes It’s very frustrating that they haven’t included functionality for login and startup scripts in Intune, the fact it has to be done in a janky way is ridiculous.

Hi. If you want recurring reg keys to change via a script, you need to use the task scheduler or this method I’ve provided. Remediations can work but can only be set to per hour at a minimum so is not quick enough for what we need. There is no other way to run recurring scripts on login unfortunately, that’s why I created this method.

Hi mate, our entire infrastructure is powered off of ubiquiti switches, the interface within UniFi is great and really easy to navigate, configuring VLAN’s is a breeze and also; if you end up going down the ubiquiti route for cameras, AP’s etc etc, it’s all under one central pane of glass. We do actually have a fleet of Aruba switches also that manage our Aruba wireless, we wanted ubiquiti wireless as per our other site, but the governing body denied it and put Aruba in. They work absolutely fine, but the management of them is awful compared to UniFi. Absolutely all over the place, plus the cost and then yearly fee per device if you want them enrolled in Aruba central. 4 years and going strong with ubiquiti, don’t be put off by people who haven’t actually used them, saying they’re rubbish. Look at their new RGB switches too, you can light the ports up different colours depending on the assigned VLAN’s on the port.

We have embraced it as we feel it’s almost inevitable, from my own perspective I feel it’s better to educate on the pro’s and con’s and repercussions for misuse, rather than blocking it entirely. Just my two pence!

Hi there, thank you! They are only given this at the start of the script for the files to copy across, it then sets it back to read and execute at the end of the script for security.

In the sphere of Intune device management, effectively and seamlessly deploying logon scripts has always been a challenge, until now. I'm thrilled to unveil a pioneering solution that is the first of its kind: an Intune package designed to deploy logon scripts through local group policy encapsulated within a Win32 app. This innovative approach combines the robust management capabilities of Intune with the flexibility of local group policies, offering an unprecedented level of control and customisation. Key Features of My Intune Package: Seamless Integration: Utilising local group policy within a Win32 app, this package ensures smooth and efficient deployment of logon scripts across Intune-managed devices. User Experience: Designed to be transparent to the end-user, scripts execute silently in the background, enhancing productivity without any interruptions. Customisation and Control: Tailor desktop settings, UI preferences, and system configurations with precision. From managing shortcuts and setting dark mode to optimising system performance, this package offers extensive customisation capabilities. Security and Compliance: Concluding with the setting of PowerShell execution policies to 'Restricted', this solution enhances device security, safeguarding against unauthorised script executions and potential vulnerabilities. This ground-breaking solution is the result of extensive research, development, and testing, aimed at bridging a significant gap in Intune device management. By leveraging this package, IT administrators can now enjoy a level of script deployment functionality that was previously unattainable, streamlining device setup and configuration processes, and ensuring a consistent user environment across all devices. I am proud to offer this package for download, inviting IT professionals and Intune administrators to revolutionise their device management approach. Embrace the future of Intune management with our innovative solution, and elevate your organisational device management strategy to new heights. Download: https://github.com/cdwyer-240395/Intune-Scripts-Packages Disclaimer: The information provided in this document, including the Intune package for deploying logon scripts through local group policy, is offered "as is" without any warranties or representations, express or implied. While we have made every effort to ensure the accuracy and completeness of the information contained herein, we do not guarantee that the package will function as intended in every environment or configuration. Users should exercise caution and conduct thorough testing in a controlled environment before deploying the package in a production environment. We accept no liability for any damage or loss, including but not limited to data loss, financial loss, or interruption of business activities, arising directly or indirectly from the use of this package. It is the responsibility of the user to comply with all applicable laws and regulations, including those relating to software licensing, data protection, and privacy. The use of this package may require modifications to system settings or configurations that could affect device performance or user experience. Users should ensure they have the necessary technical expertise and permissions to make such changes. By downloading or using this package, you acknowledge that you have read and understood this disclaimer, and you agree to be bound by its terms.

I have now uploaded everything needed to Github: GitHub - cdwyer-240395/Intune-Scripts-Packages I have adjusted the install script so that once the logon scripts are deployed, it changes the permissions back to read only, as per some people's concerns about the 'Everyone' permission on the folders. Enjoy!

I am back in work tomorrow, I’ll simplify the whole process and send over a package containing the login script that has this in, as well as the rest for you to use if you want to!

No, because powershell scripts in Intune only run once per user/per device. I need my script to run every time a user logs in. As apps get pushed out/installed, their shortcut appears on public desktop, the login script clears it every time and only puts back the files and chrome shortcut. Applications that get started from a server location also need to reliably start on every login. I do wish they made this functionality natively in Intune but it’s just not there, for whatever reason.

Do all what?

Intune doesn’t use group policy. Intune is built around scripts and win32 apps, it’s a lot harder to manage and maintain.

Yes, it would be. The script and whole process works without that part, it’s only the detection rule that doesn’t for whatever reason. Detection fails in Intune but everything still works. I should state here in the post that you should either: - add a part to remove the everyone permission as soon as the script ends. - not use the everyone permission at all and use a different detection policy. They can’t actually traverse to the folder that has the scripts in as inheritance isn’t enabled on it, they will get a UAC prompt if they go any further than just the top level directory folder, but I have yet to mess around and see how easy this is to break as a student, so the points above still apply.

Sure! Our login script: - clears public desktop (removes any app shortcuts that get added when apps install themselves) - creates a ‘My Files’ and ‘Google Chrome’ shortcut on to the public desktop once cleared. - left aligns task bar - sets dark mode In the taskbar only (not explorer) - starts some necessary applications - adds a reg key and proxy setting for our internet filtering solution. Think that’s about it. May be a few other minor tweaks in there but they’re the key ones.

Oh absolutely, there are certain things in Intune that just make absolutely 0 sense. Not including native recurring login scripts within intune is one of those things. For the most part, everything I need to do I have now figured out in intune, but is a lot of it easy? Nope. Could a lot of it be done far simpler in group policy on prem? Yep. I moved to Intune and full azure so that our system is available from anywhere on our devices with no need for a VPN or remote system. Just open laptop, connect to wifi, login and get the full experience as if you were on site. For me, that makes it worth the hassle, but other peoples requirements will be different!

Hi all. Had a breakthrough today. Went full azure, Intune and autopilot last year. All has been good apart from one thing... no native logon script support. We've tried all the janky methods and settled on Task Scheduler for some time, but it's unreliable. Queue last week, I thought 'There must be a better way!' Lo and behold, there is. I've also not seen anyone else try this, not even in obscure forums deep on the internet (I tried everything to find a good method before!) so this may be the first documented method for this and it's also the BEST way hands down. 1. Firstly, you need to configure Logon Scripts in Local Group Policy on a test/admin PC, by going to: User Configuration > Policies > Windows Settings > Scripts. 2. Add all your logon scripts in here, the same way you used to when you managed your site with Group Policy (except locally) then hit apply. 3. Once you manually add those logon scripts via local GP on a test machine, it will create and populate a folder in "C:\Windows\System32" called "GroupPolicy" 4. Copy the entire "GroupPolicy" folder somewhere else. I copied to Desktop and put it into a folder called "LogonScriptsApp" 5. Open the "GroupPolicy" folder you copied off and make sure the scripts you added can be found in "GroupPolicy\User\Scripts\Logon" if not, move them into this folder. 6. If you had to manually add the scripts to the "Logon" folder, navigate to "GroupPolicy\User\Scripts" and open the file "psscripts.ini" 7. Ensure the .ini file is laid out in this format (I have called the scripts "yourscript1" and "yourscript2" for the purpose of the demonstration): [Logon]0CmdLine=yourscript1.ps10Parameters=1CmdLine=yourscript2.ps11Parameters= 8. As you can see, it should just say CmdLine=*scriptname* - if it has a path before the name of the script, it's not looking in the "Logon" folder discussed above. It must be looking in the Logon directory because we are going to wrap all of this into a Win32 app. 9. If you need to, once those scripts are copied into the "Logon" folder, edit the .ini file and ensure there isn't a path string before the script name and then save the .ini file. 10. Now, you need to make a PowerShell script that will copy all the files from the script root into the "Windows\System32" folder and create/replace the "GroupPolicy" folder and all it's contents, taking ownership of it and setting permissions to allow the file replace to take place. Here is the script below I used to do this, you can copy this exactly as is: # Take ownership and set full control permissions for 'Everyone' on the GroupPolicy folder$destinationFolder = "$env:windir\System32\GroupPolicy"takeown /f $destinationFolder /r /d yicacls $destinationFolder /grant Everyone:(OI)(CI)F /t# Define the source folder based on the script's location$sourceFolder = Join-Path -Path $PSScriptRoot -ChildPath "GroupPolicy"# Use robocopy to mirror the directory structure and files, replacing the destination contentsrobocopy $sourceFolder $destinationFolder /MIR /COPYALL /R:5 /W:1$GroupPolicyFolder = "C:\Windows\System32\GroupPolicy"$acl = Get-Acl $GroupPolicyFolder$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","Allow")$acl.SetAccessRule($perms)Set-Acl $GroupPolicyFolder $acl 11. Save this script as "install.ps1" and put it into the "LogonScriptsApp" folder on the Desktop (Which should also contain the copied off "GroupPolicy" folder and all it's contents as discussed earlier) 12. Now use the win32 app packaging tool to package the app. The source folder is the "LogonScriptsApp" folder on the Desktop and the setup file is the script we just saved as "install.ps1" 13. Upload the new app to Intune, name it etc. and then use this for the install command: %windir%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "install.ps1" This is super important because if you don't run PowerShell from the "sysnative" directory, the script will run and move the files into the SysWOW64 folder instead of System32 because of file redirection restrictions in Windows. 14. Ensure you deploy in system context and not user and also in the 64 bit context, then use one of the script files in the "Logon" folder as the detection rule. 15. You will now have fully native logon scripts using local GP on every machine you deploy to. This method simply uses the native logon scripts functionality from Local Group Policy/Group Policy and so is very reliable. So far, for us it has worked every single time. I really hope this helps somebody and if you have any questions please ask.

That would be amazing, thanks so much! More than willing to give it a go! If possible I would like to retain the look and functionality as is, I made a rod for my own back a little bit as my senior team love the way it looks! Lol. Thanks a lot for your help.

Hi there, yes it is. I added a spinner to delay the nav bar which has helped in the mean time, as it doesn't happen if you wait a second after the page loads. It's not ideal but sorted it for now. Here is the code for my header: /* Spinner Styles */ #spinner { border: 8px solid rgba(255, 255, 255, 0.3); border-radius: 50%; border-top: 8px solid #ffffff; width: 40px; height: 40px; animation: spin 1s linear infinite; position: fixed; top: 20px; right: 30px; z-index: 10000; opacity: 1; transition: opacity 1s ease; } /* Navigation Menu Styles */ #nav-menu { position: relative; transition: background-color 0.3s ease, border-radius 0.3s ease, padding 0.3s ease, opacity 1s ease; opacity: 0; z-index: 9000; } #mobile-nav-menu { opacity: 0; transition: opacity 1s ease; } /* Spinner Animation Keyframes */ @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } /* Blur Overlay */ #blur-overlay { opacity: 0; display: none; position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background-color: rgba(128, 128, 128, 0.3); z-index: 1000; backdrop-filter: blur(10px); -webkit-backdrop-filter: blur(10px); transition: opacity 0.5s ease; } /* Additional Overlay for Navigation Bar */ #nav-overlay { display: none; position: fixed; top: 0; left: 0; right: 0; bottom: 0; z-index: 9999; } #customPreloader img { animation: fadeIn 1s forwards; width: 1000px; height: auto; display: block; margin: 0 auto; } .students-word { font-family: 'Lato', sans-serif; font-weight: 600; } With the padding, are you referring to the way it moves down on hover with the pill? I want to retain this if possible just for aesthetics! Thanks so much.

Hi all. I have created a dynamic floating ‘pill’ effect for my navigation bar with Jquery, whereby the nav bar pops out on scroll and is encapsulated by a pill-like shape. It works fine at a base level, but I’m noticing that if you attempt to hover over the nav bar on a part that contains sub-menu’s, it will add a white space above the nav bar and duplicate the sub menu. It only happens if you try to use the nav bar whilst the page is still loading, if you leave it a few seconds for everything on the page to load, the issue doesn’t occur. I have tried loading the code in the header and the footer, no change. I have tried to hide the overflow of the nav bar and also tried adding hide overflow to the global css, I have tried adding code that notices if the sub menu is duplicated and deletes it Instantly, nothing works. Short of disabling the nav bar for a few seconds after page load, I’m not sure what to do. It doesn’t happen on mobile but if anyone is able to help and wants to test on pc: http://samq8.sg-host.com That’s the link to the site (it’s in development) If anyone needs it, I can get the entire jquery to show you. I’ve ensured there’s no conflicting css in the global (I think) and I’ve combined all my jquery into one incase having bits scattered was causing the issue, nothing has helped. Thanks!

Our process is - New devices: If manufacturer supports it, have them upload the autopilot hash’s. Assign scope tags (laptop, teacher, office etc) Log in and build (using user deployment as self deploy too unreliable) If manufacturer doesn’t support hash upload, we have an MDT task sequence that installs a clean wim of windows 11 (much easier as never need a ghost image, if you need latest version of OS, just swap the wim with the newest. All policies and programs installed during the autopilot process) Existing devices, we just fresh start and sign in.

Thank you! How do you find the interface, support etc? Any pro’s and cons? Are you using azure?

Thanks, have used smoothwall before briefly but had lots of issues with it as soon as it was rolled out. How is their support do you find?

Ah okay, I’ll take a look at this before I move elsewhere, thank you.

Hi guys, We are moving to azure AD and our current fortigate filtering solution will not suffice. Does anyone have any recommendations for internet filtering? We are a secondary school and will be fully cloud. I used to use lightspeed and liked it but have been advised it is not as good as it used to be! Thanks

Hi all, Absolutely stumped here. For background, I have installed the migration tool on our internal host server. I have replicated the servers absolutely fine, but when I go to do a test migration, i get error ID 170082 and failed with error code ‘HvrPreFailoverManagedDiskCreationFailed’ I cannot find any documentation on this error code at all, I have scoured for hours. Nothing on Microsoft’s official docs or anywhere else. If anyone has any ideas I’d really appreciate the help as I’m a bit stuck at this point. Many thanks!

Ah okay, do you use onedrive for business and map directly without iamcloud?