J_Worth

Ok. But I've got a machine with a Windows 10/11 Pro OEM license, however, when logging in as a user with a M365 A3 license, the machine doesn't "upgrade" to Windows 11 Education. Do I have to activate these machines with a Windows 11 Pro Education MAK before they will "upgrade" to Windows 11 Education?

Hello all, Another query regarding this fandangled cloud activation stuff. I have a device that when purchased came with a Windows 10/11 Pro digital license burned into the motherboard. I have reformatted with Windows 11 Pro, enrolled this device into Entra ID and Intune via AutoPilot. However, logging in as a user with a M365 A3 license it doesn't step up to the Windows 11 Education. Is the only way of "stepping up" these devices is to use Windows 11 Pro Education and activate this with a MAK and then it will step up? I was under the impression that a device purchased with Windows 10/11 Pro OEM license is eligible for "stepping up" to Education A3. Am I getting this confused? Thanks all!

Our OVS is due for renewal in June, so will definitely look at this. Thanks again.

Great - many thanks for confirming! Yes, agreed that it is inefficient, but for what Windows Education - Upgrade & Software Assurance product costs us on OVS-ES, for us its worth doing to ensure licensing/activation remains seamless etc. but still being able to get a lot of value add from M365 A3. Thanks again!

Hi all, I'm looking at taking advantage of the Microsoft 365 A3 licensing. However, I am still wanting to be able to use on-prem activation services (ADBA). Therefore, does anyone know if it's possible to have a CSP agreement with M365 A3 on it as well as a OVS-ES agreement with everything else such as server licensing, Windows Education Upgrade and SA product (which includes KMS activation of Windows)? I'm looking at going down a Hybrid licensing route initially so we can get the benefits of A3, however, keep with Windows licensing etc. that's quick an easy (I'm not planning on ditching our on-prem AD any time soon). Obviously I would remove Entra P1, Intune etc. from the OVS-ES agreement as that's all included with A3. Hopefully this makes sense and can work. Many thanks!

I finally got this working earlier - Microsoft support were useless. It's an issue with the Microsoft.AAD.BrokerPlugin not being provisioned at login. As soon as I ran a PowerShell command to fix this, logged off and back on, it all worked as expected and without any issues. More information here: https://call4cloud.nl/2023/12/the-0xd000000d-job-2-nutty-by-intune/ Apparently there's a automatic troubleshooter that runs to resolve this for Education and Enterprise SKUs, however, I'm not sure when it runs as during the troubleshooting it didn't seem to silently kick in and resolve the issue. I don't have any shared PC policies set.

If anyone can test my theory that would be great - delete the profile via advanced system settings and then log straight back in as the user who's profile has just been deleted. Does OneDrive sign in or does it get stuck?

Ok thanks - It's when I remove a profile via CP -> Advanced System Settings -> User Profiles -> Settings -> Select profile and delete that seems to break the automatic signing into OneDrive when the user logs back in again. I'm applying the OneDrive settings in exactly the same way as you - to the device and these are Hybrid. Interestingly, it seems to affect Microsoft Edge signing in as well - this is set to force sign in. When OneDrive doesn't automatically sign in, Edge also doesn't. Edge settings are still applied via user targeted GPO and this hasn't been touched.

I've not yet applied the Shared PC policy to this machine - when the user logs into the machine the first time it all works exactly how it should. When they subsequently log into the machine, it all works. However, if I delete the user profile from the machine, when the user next logs in it doesn't. They are Hybrid Entra ID Joined. Yep, both devices and users are synced correctly. The machine is enrolled into Intune without problems - device configuration is applying, endpoint policies and update rings are all applying and working. Even managed to get Intune Windows Feature policy sorted to push the device from Win 10 to Win 11 without any issues at all. I've got those URLs (except the https://device.login.microsoftonline.com URL) added to a group policy that's applied to user (I've not got any Intune user targeted policies - these are all still GPO and the way it's going likely to remain like that!!). I'll create a config profile and add those URLs and target it at the machine. Just to point out - I've never had any issues with any of this when the configuration was all applied via GPO - it's just since switching the OneDrive configuration to Intune that things have gone awry.

All the machines are connected to AD on-prem - I'm using Hybrid Entra ID Join and the machines are Co-Managed with Config Manager. It's got to be something to do with deleting a user profile and then logging back into the machine as that user - Intune doesn't re-apply the settings as it assumes that it's already been applied so won't apply again. How does everyone manage clearing stale profiles on Intune managed machines? I'm wondering if it's because I'm deleting the profile and then logging straight in as that user again - should I try waiting longer. I'm aware that Intune does reapply configuration profiles around every 8 hours. I've checked the device this morning in Intune and it still has the OneDrive configuration policy as showing as Succeeded; is Intune just not aware that these user profiles have now been deleted.

Interesting development here - it would appear as though if you delete a user profile from the machine and then log back in as that user, the Intune policies don't apply. When looking within the Intune admin console, it still shows the OneDrive configuration for that user (of which the user profile has been deleted) and still being successfully applied to the machine. It's as though somewhere on the machine it still knows that this particular user logged into it and that the settings are still current so it doesn't apply them again. I'm also confused that a policy targeted to the machine gets stored against each user. For example with GPO, if we delete a user profile and that user logs back in, the GPO policies are applied immediately. Am I just missing a trick here? Does Shared PC mode (with OneDrive Sync enabled) solve this issue?

Can you clarify how you went about creating the profile? I created it by clicking "Templates" - "Administrative Templates" and then configuring these settings as required targeting Computer Configuration.

I've got all that enabled except from the Silently move Windows known folder to OneDrive. I'm wondering if the issue is because the machine itself doesn't have a primary user attached so is marked as shared?

Sorry! It's Windows 11 23H2

Hello all, Has anyone on here managed to successfully get OneDrive to work reliably and every time when it's configured using a Device Configuration profile via Intune? The machine shows that all the settings have been applied successfully, however, when a user logs in, OneDrive will not automatically sign in. It will sign in if you manually do it, but that defeats the object of setting it to silently sign in. This is also a very much needed policy as I can't have students and staff having to manually sign into OneDrive client whenever they log into a machine. I've noticed that there's also no entry under Accounts -> Access work or school that says "Connected by username@domain Connected to school name's Entra ID". This issue seems to affect the silently signing in of Edge as well. When a member of staff logs in, Edge prompts to sign into a profile rather than just working. I've reverted back to Group Policy (except for a single test machine) as at least that's reliable and works each and every time. Should it really be this difficult to get working using this "modern way" of managing machines!? I'm all for going with Intune, but this sort of (basic!) thing just makes me have no faith in it. How can I trust it to work for our 700-odd machines, of which most have many students logging onto them throughout the day!? Any help/advice gratefully received - I've got an open support ticket with Microsoft about this as well. Here are the settings for OneDrive: Thanks all!

Hello, I am trying to setup HAP+ at another school so they can make use of the room booking system. However, for some reason every time a member of staff logs in, it throws the "Unauthorised" error. I have tweaked the Booking System web.config as follows: Staff can login and get to the landing page, but when they go to click "Booking System" it then just shows the unauthorised page. If I log in as a user that's a member of Domain Admins, it works without any problems. I've also noticed that although I've restricted access to setup.aspx to Domain Admins, all users can still access this. Is there an IIS role that's missing? Many thanks in advance.

It was this! More investigation by analysing the Minidump file showed wdfilter.sys as being the culprit. Temporarily disabled Windows Defender and the server is holding up now! Phew! Now to get Windows Defender reinstated...

Full restore hasn't worked and I've even changed the SCSI controller to Paravirtualised. I'm hoping the school has some support from VMware so I can open a case with them.

Thanks all for the responses. I've reinstalled VMware Tools to no avail. I've migrated the VM across to another host. I've also restored the entire VM to a point at which it is known to be working/stable and the BSOD (attempted write to read only memory). Granted I did just do a quick restored of the VM - perhaps I need to try a full restore instead.

Unfortunately not. The VM has been running for a while without any issues. It started to play up at the start of the week - same time as the school's old IT Support contract finished (coincidence?)! I'll take a look at Windows Defender and see if that's the cause. Many thanks.

Hello everyone, I have recently started to provide support to a small secondary school. They have a Server 2019 VM running on ESX and it's just started to Blue Screen. The VM is running the school's RD Gateway. The BSODs are either SYSTEM_SERVICE_EXCEPTION or ATTEMPTED_WRITE_TO_READONLY_MEMORY and it also shows NTFS.sys. Has anyone else come across this before and if so, how did you go about resolving it? Many thanks in advance.

I created a Microsoft 365 PowerApp which reads student/staff info from a master SharePoint list. Has logic in it to prevent reg if student/staff have not got consent. Also prevents the same barcode from being registered twice etc. Once registered (registration assistant selects student/staff's name and scan barcode), it creates a record in another SharePoint list. Form fields reset and process repeated. Results recorder then scans barcode from test. PowerApp returns the student/staff record for that barcode and they can select the appropriate result. They then click save and it updates the record in the SP List. Fields then reset and process repeats. Works well.

Hello - would you be willing to share this at all?

Hello everyone, I have been getting our end user configuration all sorted for Windows 10 and have the Start Menu layout, mandatory profile (I know!) and default associations all working absolutely fine. However, I cannot for the life of me get the Taskbar Pinned shortcuts to appear - they are listed in the StartLayout.xml file as appropriate so I'm not sure what's going on. Also, how can I get the OneDrive sync client installing for a user when they login using a mandatory profile? Is there any way? Any help with these couple of issues would be greatly appreciated. Many thanks.