petben

I am experiencing what is apparently quite common - user applied policies in Intune not applying, or applying when not wanted (to users who are explicitly excluded from the policy). I have read some other posts which recommend to use device based policies only, as user polices are inherently erratic. This is fine, but what about policies like 'Prevent access to settings menus' or 'Prevent access to Powershell/Command' that you want to block for students, but allow for admins. Staff and students also have a different Edge homepage for example. Intune is OK, but IMO not fit for education (yet).

Hello, when users open Edge on an Intuned laptop they get the screen: Welcome to edge...you're almost setup, then it gives an option to sign into Google to continue. Like this: https://filestore.community.support.microsoft.com/api/images/cdd4b379-9dbf-4106-8e8b-e1e73cc5bcfb?upload=true https://www.thewindowsclub.com/wp-content/uploads/2022/08/sign-in-to-gmail-on-edge-1.png I have set the following settings in an Intune policy but it still shows these screens at first login (not the second login). Any help would be great Thanks Force synchronization of browser data and do not show the sync consent prompt Enabled Enable the default search provider Enabled Hide the First-run experience and splash screen Enabled Browser sign-in settings Enabled Allow notifications to set Microsoft Edge as default PDF reader Disabled Default search provider URL for suggestions Enabled Configure whether a user always has a default profile automatically signed in with their work or school account Enabled Allow importing of favorites Disabled Blocks external extensions from being installed Enabled Hide the one-time redirection dialog and the banner on Microsoft Edge Enabled Default search provider search URL Enabled Allow user feedback Disabled Allow pop-up windows on specific sites Enabled Allow QUIC protocol Disabled Control which extensions cannot be installed Enabled Define an ordered list of preferred languages that websites should display in if the site supports the language Enabled Default search provider name Enabled Enable guest mode Disabled Allow feature recommendations and browser assistance notifications from Microsoft Edge Disabled Enable profile creation from the Identity flyout menu or the Settings page Disabled

Hello, when we get new devices I want to 'reset' them without having to go through the initial wizard to get to Windows. During OOBE I can press Shift/F10 to get command prompt and the Internet says to run: systemreset -factoryreset but that doesn't exist. There must be a way to reset via command line?

Thanks, so I assume you also deploy Creative Cloud as it must be included in the package? How do u deal with wanting to allow auto update for acrobat, but not wanting to allow users to install new Apps through creative cloud? Is that combination even possible?

Hello, where are you getting the latest download of Acrobat Reader DC from? Maybe from the admin download page, but implies this is out of date (unless links are up to date) https://helpx.adobe.com/uk/acrobat/kb/acrobat-dc-downloads.html Maybe you create a package from your admin portal? Then u have to install Creative Cloud, which I don’t want to do really… Thanks

Hello, I am trying to enable the option for users to setup Windows Hello for some devices using Intune. Enrolment Profile (which would affect everyone) – Windows Hello - Disabled. (This should not force Hello but still leave it as configurable if the user want to) An Intune policy for the devices - Windows Hello - Enabled A REG key as well (just in case) to enable Hello but don’t start at login (in case the user doesn’t want to use it) [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork] "Enabled"=dword:00000001 "DisablePostLogonProvisioning"=dword:00000001 On a device which we know is Hello capable the message: “This option is currently unavailable” “Something went wrong” Has anyone got any advice to get Hello working? Thanks

Hello, I think we did. Noticed that if we remotely started the Windows Installer service the hanging install got going again. then we found simply putting a start service command in the install script still failed as the service seemed to stop randomly. so we put a block of script in that starts the service as a background job, monitors it, starting again if it stops. then a bit of output at the end. i'll be interested in your findings. I assume you have -full in the office install .xml to make it easier to see progress bar. # Start service $StartServiceJob = { While (1) { If((Get-Service -Name TrustedInstaller).Status -ne 'Running') { Write-Host "$((get-date).ToLongTimeString()) - Starting Trusted Installer service as it was not running. " Start-Service -Name TrustedInstaller Get-Service -Name TrustedInstaller } else { Write-Host "$((get-date).ToLongTimeString()) - Service already running..." } Start-Sleep 10 } } # Start-Job starts a background job on the local computer that runs a command without interacting with the current session. Start-Job $StartServiceJob # Install new version Write-Host "Installing new version of Office365" -ForegroundColor Yellow Start-Process "\\domain\msi\Office\Office365\Deployment\setup.exe" -ArgumentList '/configure "\\domain\msi\Office\Office365\Deployment\Office365Config.xml"' -Wait Write-Host "" Write-Host "Office install finished." Write-Host "Results from output:" Get-Job | Receive-Job Write-Host "Stopping and removing job" Get-Job | Stop-Job Get-Job | Remove-Job

I think I see the idea with WUFB and the uninstall button. I assume devices are on Oct 24 update and uninstall rolls them back to sept 24? Right…? So, 2 questions - can I see a list of the devices and what date version they’re running, so we can track progress of updates and uninstalls if necessary? - I can see this being ok for monthly cumulative updates but how would you prevent/decline/remove a single troublesome security update that presumably can still be released by MS and installed on a daily basis? Thanks

Hello, has anyone any experience of the Stonebook Edge-R Laptop. Stonebook Edge, EZ2R5A, r5-7520U, 16GB DDR5, 250GB SSD, iGPU, Win11 Pro STF On paper it has it's good points: - semi rugged - cheaper than the pro - sleep state 0 compatible but also: - smaller screen - old/low spec processor Anyone using these for general AEN use; office, Web, acrobat, read/write software and Sophos? Any thoughts?

I have this working now. I created a 'Bypass allowed staff' group and created a policy with quota above pretty much everything else.

Thanks, I am testing this now, I have setup the quota and created a filter policy with an action to apply to the quota, but the user is still seeing our default block page, do I need to set up something else?

We need to allow the safeguarding lead to temporarily but regularly unfilter the Internet to investigate the filter alerts they receive. I created an 'Administrator Bypass' block page and a user account for them on Smoothwall. They are presented with a 1 minute/5 minute/30 minute bypass option when they hit a filtered page, but it only seems to unfilter that single web page. Source images etc do not display. we really need a completely unfiltered browsing session for that time period. Any ideas how we can do this? (It is also worth noting that the Smoothwall authentication script runs continually in the background so giving them a different Smoothwall user account (username - 'JOHSMI_Unfilter' or something) to log in with may not be an easy fix as they will be logged into Windows as their usual staff account and the script will be authenticating them as that user.)

Yes, got round this by not bothering with a Capture. Download ISO from MS and just import it, anything else traditionally done before capturing (e.g. .NET 3.5 feature) can be done via the usual software install methods/scripts.

Trying to capture a Win11 24H2 image (new Windows 11 version) but during Sysprep it fails with: SYSPRP Package - Microsoft.Copilot_0.4.2.0_neutral__8wekyb3d8bbwe was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image. So, I have removed Copilot from that user: # Find and Remove Get-AppxPackage | where Name -like *copilot* | Remove-AppxPackage # Check this returns nothing Get-AppxPackage | where Name -like *copilot But the same error is coming up, I don’t have any other users on the capture image. Any ideas where sysprep is finding this installed software?

I got a quote for Manage Engine and their Update/Vulnerability solution was £9000\year.... So, looking at Patch my PC, their site says you can deploy 3rd party software through WSUS which I guess is good, but more importantly will it: Replace WSUS Find and recommendation remediation on vulnerabilities in all our software, drivers etc? Thanks for the info before I go for demos etc.

We are looking at getting WSUS and it's resources offsite. What would you select in that policy to say: YES for Quality Updates from WUFB NO for Driver Updates from WUFB How about Security updates that traditionally in WSUS will be set to auto approve? I also read that specific KB updates can not be removed/blocked using WUFB. Maybe things have changed.

can Lansweeper actually push out updates or is it purely for identifying them and then IT would deploy with the usual tools, WSUS etc?

Reading the latest DFE guidelines says: IT support must complete security updates (known as patching) to operating systems, applications and firmware, including configuration changes, within 14 days of the release of the patch where the vulnerability is. Some searching found many bits of old software floating around, some with many CVE's and all that we don't have any reporting on. So we are looking at updating/patching/reporting beyond WSUS/WUFB. We had a demo from Action1 , patch management software that looks great, it has a few other hardware audit and power mgmt features, but for our 500 workstations it's £4.5K, quite a bit for what it does. Has anyone persuaded their schools to purchase Action1 or have any recommendations for alternate solutions? Thanks

In fact logged in as me I am not using a redirect start, and the apps are still not found

we are yes, is there a work around for that?

Hello, I have deployed an almost vanilla win11 image (plus software obvs) to our workstations but Apps like 'Snipping Tool' and 'Clock' are not there. My office machine has these, I think I installed this from an ISO downloaded off the same MS licensing site as the image was built from. Any ideas why and how I can push out Windows (store? is it still) Apps using GPO? Thanks

The connection works fine from the vscode built-in pwsh terminal (extension disabled), but unless I misunderstand this would not allow me to run blocks of PS script?

Thanks, I thought to run PS in VSCode requires the PS extension?

Hi Steve, could you please elaborate a little more?

thanks, where do I check that please?