petben

Thanks jamesrhart, can you please say how you get it into Intune? I am going to follow something like this: https://www.vansurksum.com/2020/02/24/a-guide-to-implementing-applocker-on-your-modern-workplace If you can include a few screenshots that would be really helpful, what OMA-URI string do you use for the EXE rules? Thanks

After some research I’m going to try to create an app locker policy, export the xml and create an Intune policy. I need to ensure the application identity service is running, can services be managed in Intune as a built in setting, or is that again require running a PS script to set this to started and automatic?

Has anyone had success blocking .exe using Intune? I want to prevent users running .exe from their user documents, download folder etc. Any help with a process would be great.

One thing I have noticed is that even though the Office 2019 pro plus entry disappears from control panel/installed programs once I run the office 2021 installer the office 2019 shortcuts and programs still work, is it so closely related so that is expected?

Thanks RLR that XML works fine...

yes, it was installed via setup.exe so is there a simple /uninstall siwtch or something, some sites talk of creating an uninstall.xml..?

I have used the usual Office Customization Tool to create a simple test Office 2021 install. https://config.office.com/deploymentsettings I have the setting enabled "Uninstall any MSI versions of Office, including Visio and Project" and it puts a entry in the install XML. When I try and run the install on a computer (which has Office 2019 installed on it - as all machines will do and which was installed via the same method) I get the error below, any ideas?

Hello, we have a Storage Spaces Direct 2 node test cluster. We are finding that if we put one node into maintenance mode (drain the VM's to apply Windows updates or similar) the size of the rebuild data is HUGE after just a few minutes. We have 4TB in total of test VM's on the cluster and after 20 mins of running on a single node and not really doing much to the VM's S2D reports ~1TB of changes to be written back, we can literally refresh the PowerShell command and watch it jump up in size in multiple GB's. Has anyone else found this, there doesn't seem to be any settings for write back block size or any other settings. Thanks for any info

Hello, we are reviewing how students in school can report on bullying/abuse incidents. Not sure anonymous is the answer, that feels open to false reporting. Does anyone use proven systems or procedures? Thanks

Hello, if anyone is still monitoring this thread. I trialled foldr, very impressive but it is (from Foldr) £3500 Year 1 and £1800 onwards. Can anyone recommend a supplier who will supply that cheaper? Thanks

We spoke to someone at Smoothwall and came to the following conclusion: 1. Use VLANs if you can, if you do then you do not use the secret knock method 2. Apply the 'Multiple Browser' script even if just using a single browser (we are using Edge) 3. Install the Unified client software (there is an Intune ready file supplied) 4. With this setup if students run a shortcut to start the browser with no extensions it logs them off. Everything is supplied by Smoothwall and seems to work fine, but the documentation is incorrect.

ibpalle - Can you please post a link to the latest Smoothwall instructions for installing cloud filter?

I don't understand the article then, that is absolutely not what it tells us to do. The 'Secret Knock' should be enabled on the Smoothwall Firewall & Filter to permit Cloud Filter devices to request filtering bypass from the on-prem solution where VLANS are not feasible. Option 2: Secret Knock Where VLANs are not feasible, or are in use but shared with non Cloud Filter Devices (BYOD networks, general WiFi, etc) then the Secret Knock should be configured. VLAN's are feasible on our network. We have a dedicated VLAN for these devices. Thanks

OK, it is recommended to use VLANs and have no filtering other than the extension: https://kb.smoothwall.com/hc/en-us/articles/360015978080-Smoothwall-Filter-Firewall-Preparing-for-Cloud-Filter-to-avoid-Double-Filtering Where the Smoothwall Firewall & Filter is deployed with VLAN interfaces created, you can add the new VLAN to the Smoothwall without a Proxy Authentication policy, therefore all traffic from that VLAN (using the Smoothwall as the gateway) will go unfiltered by Guardian and go straight out to the Internet via the Firewall module. anyway, do you know how in the OS to prevent running the browser with extensions disabled? and prevent running browsers off USB? Thanks

Hello, I am testing Smoothwall Cloud Filter on a few student laptops (managed by Intune) and the Edge browser extension that Smoothwall installs for filtering works, as do the recommended polices to make it forced, disable Private browsing etc. But I am feeling very uneasy about removing all other filtering for these devices (recommended by Smoothwall to prevent 'double filtering') My first attempt to run Edge from a shortcut with extensions disabled works fine and gives the user complete unfiltered Internet access. I bet there are other ways. "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-extensions can anyone recommend how to stop the above and any other gotchas they found where users can get round the filtering? Thanks

strange, the device status is succeeded. The policy is also applied to devices: "...To allow multiple users to be provisioned to a device, specify that the Windows Hello for Business policy be applied to the devices. If the policy is applied only to users, only one user can be provisioned to a device." you didn't do anything in Azure or you know of any other setting in Intune that may be disabled? Thanks

Has anyone got Windows Hello enabled on their Intune devices? I have Hello disabled in the Intune Enrollment profile, but enabled in a device Identity Protection profile. Yet still when logged in it says: 'The option is currently unavailable' in the sign in options. any ideas? Thanks

What a load of crap the App is, every time you close/open the App you need to sign back in with Office365 and create a passcode, no SSO. OK I suppose on a workstation, but on a mobile device with an onscreen keyboard it will be annoying to the point of being unusable.

We want to install the SIMS Teacher App on a few Surfaces (manged by Intune) that various staff use when out on 'behaviour duty'. I can direct them to install the SIMS Teacher App from the MS Store but everyone who logs in gets asked for a device and user activation code. Is there any way to run this on a multi user device without having a device code for every user? Is there any way to deploy this App? Other ideas... Thanks

Is this cloud filter purchased and configured in addition to our existing onsite smoothwall filter? Sounds possible, any catches?

It needs to run the smoothwall authentication script which is a script that authenticates the current user so they get the correct filtering rules.

Thanks, that works now. On the same note can you clear up the Q if we want a script that runs whenever anyone logs in how can we do this with Intune? The 'Script' part of the this MS doc - https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension "..The Intune management extension agent checks with Intune once every hour and after every reboot for any new scripts or changes. Once the script executes, it doesn't execute again unless there's a change in the script or policy. If the script fails, the Intune management extension agent retries the script three times for the next three consecutive Intune management extension agent check-ins..." so that implies you can't have a script that always runs (like an AD log on script)?

I have incorrectly set an education Intune profile on my Windows devices that 'Block access to administrative apps' (registry, PowerShell, CMD). I found this prevented some desired scripts to run, so I want to now allow these things. There is no 'enable' or 'do not block' in the policy and even after removing the policy I am finding the devices are still being affected - 'This App has been blocked by your system administrator'. How can I remove this setting? Is it a reg key that has been set and even when the block policy is deleted the registry key remains as set?

Hello, we are slowly seeing a propagation of an error with Teams showing the user 'Something went wrong' message when signing in. This is now also being noted in OneDrive and a bit of Outlook. Teams logs have a fairly consistent error: warning -- wamAccountEnumService: [AUTH] WAM enumeration response for AAD accounts was non-success. Status: 3. ErrorCode: 80080300. We use AADConnect to sync our AD to Azure, nothing obvious here. Has anyone seen this or has any ideas? Thanks

Thanks all. This works now. The thing I’m not understanding is if the ‘link 1’ or ‘link 2’ setting is the physical link between stacked switches then why when you stack 2 switches with 2 cables all the stacking ports are configured as link 1? (3 switch stacking makes sense, configured with 1 port link 1, the other link 2)