Langella

Yes, it is worth it. Intune has changed a bit the last 2 years. Start small, create the same rules you have in AD that you really wanted to keep and try on test devices, then slowly grows the number of laptop based on your organization. You may need to still leave your AD on for other applications or SMB you still use but they work fine with Intune only devices. The good thing about shared devices in Intune and Windows 11 is that you have more options to make them safer and improve the turnaround time.

We deploy an XML with what we want their Task Bar and Start Menu to look like. They can change and adapt to their needs if they want. We do not block students to put stuff on their desktop, If its easier for them to do it why blocking it? We do have One Drive backup off which brings back the Desktop, Documents and Pictures to their compute, so no redirection scripts are required. In relation to the shortcuts you need to deploy for School applications you can drop them in their browser Favorites or create a SharePoint Intranet to get displayed when they open their browser.

We were hybrid and we now have 70% of the fleet fully autopiloted. It takes time to set it up but there are some good policy templates out there to help you start with. We are not going back to SCCM, the provisioning time went down and we have about 40% less students complaining over issues with their devices just because we were able to implement newer policies to lock the device down a bit more. Just the ability to run scripts almost instantly on any devices is the killer feature to be honest. ***edit - we have about 1700 devices ***

Hey, I got it working and SSO is working fine, uses do not need to sign in, BUT.... If devices are cloud only and you have no on-prem ADs users WILL need to authenticate manually, I mean, SSO will work but they will have to click on the login button in the Papercut PrintDeploy app to trigger the SSO. If you do have an on-prem AD like we still do, you need to set to Username/Password and click on Trust. Microsoft as an authentication method and "trust" dont work, and this is described in one of the Papercut KBs. You can drop the logs in this thread, it will help identify the issue.

Best way of troubleshooting this is exporting the logs when ESP error happens. you don't have to read all of them, just upload them to your favorite LLM and let them check what is failing, then you take a decision. I believe it will be faster this way

We never had anything with JAMF but we are migrating from AD to Intune, about 2000 laptops and 700 ipads. All iPads have been in intune for a year now and only 400 are fully cloud on intune. My opinion is that everyone should do it. It brings modern configurations and policies to endpoints which are now coming out with Windows 11. Negative side is the learning curve, packing Apps for deployment ( depending on the app) can be annoying and depending on your infrastructure ( eg Printers and Wifi) you may need extra investments.

Have you checked the certificates in your domain controller? Just fixed this today where logins were taking 3 minutes to happen, now 5 seconds. It turns out in one of the DC servers in the Certificate Store / Computer / Personal there was an User Authentication certificate for the domain expired.

I like this one GitHub - ChrisTitusTech/winutil: Chris Titus Tech's Windows Utility - Install Programs, Tweaks, Fixes, and Updates You can extract the powwershell commands that does the job and implement it via GPO / Intune

If this is just happening for both I'd try to remove the Snipping tool app for now, just for testing purposes. Get-AppxPackage *ScreenSketch* | Remove-AppxPackage You can install it back from Windows Store.

Hi Scifigirl, Perhaps a licensing issue? Do you have any screenshots you can share?

Thanks Smarties11 for the great tips but they didn't work 100% for me but they have given me an amazing start. I know its 2025 but we only had licenses for the version 21.2.0.3268 and the way I finally got this working was copying files from the %temp% and getting them installed with a nice Powershell Script. Monitored the %temp% folder as you suggested, but I've noticed I needed a few more VCRedist exe files and they were made available in different folders in %TEMP%, but it was easy enough to copy them around. vcredist_2008_x64.exe /q /norestart vcredist_2008_x86.exe /q /norestart vcredist_2010_x64.exe /q /norestart vcredist_2010_x86.exe /q /norestart vcredist_2012_x64.exe /quiet /norestart vcredist_2013_x86.exe /quiet /norestart vcredist_2013_x64.exe /quiet /norestart vcredist_2017_x64.exe /quiet /norestart vcredist_2017_x86.exe /quiet /norestart in the Same %temp% folder, make sure you get the Sibelius.MSI (~600MB) For the fonts file, because it installs and remove from %temp% very quickly I was able to grab the file by using a test laptop. I did a manual installation then once installation is complete, I have gone to Control Panel/Uninstall or Change a program and click on Sibelius OpenType Fonts and click on Uninstall ( its ok, you are not uninstalling it) - Go ahead until UAC pops up, then voilà!! The Address where the MSI is will be displayed, in my case "C:\Windows\Installer\6599360a.msi" - Copy to your Intune folder and rename it. Make sure you create a folder and place all these files in it. You will need that to create your Intune.win package for Intune Since you are already using a test machine, make sure you grab the MSI Installation ID, which will be useful for the detection method, the best way I could find was going to the Registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and check the folders for Sibelius, in the folder you will find the key called "ModifyPAth" and the value should be displayed within {}. Copy that. Its time now to build the script. You can use mine, or make your. Here is the installation script and Uninstall, please note you will need to check the name of your files and change in the script. https://github.com/rodrigolangella/PublicPowerShell/blob/653bcbc7c2d859ce028ba35b6ca076434639ba68/Sibelius-Intune-Install https://github.com/rodrigolangella/PublicPowerShell/blob/653bcbc7c2d859ce028ba35b6ca076434639ba68/Sibelius-Intune-Uninstall [*]Compile that into a IntuneWin file [*]Create your APP deployment in Intune. I'm not going to teach you how to make this, but instead give you some recommendations on what to fill with. Make sure you fill the APP Version - This is important for future updates Install Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\sibelius_install.ps1 Uninstall Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\sibelius_uninstall.ps1 Add Return Code 1 ( Failed) - Since the script returns that if the installation fails for some reason. Detection Rule: Choose MSI and paste the MSI Code we have retrieved in our test machine. Paste it only the ID with braces, for example: {88351046-B557-40B9-8B6B-4D99072B755F}