georgeescott

I’ve changed jobs since I last posted so won’t be able to provide much more info on the issue, but i heard that a BIOS update from HP (not the one via Windows Update) then initiated a TPM update and that resolved it for the HP 255 G8’s. Hopefully one of my previous colleagues will post here with more info on it and if the ticket is still open with HP for the other models affected. I assume latest BIOS from HP doesn’t work for the 255 G7’s. Worth logging a ticket with HP for them if they’re still under warranty.

Took them over a year to reach out after I submitted the form for canva education…. They’re contactable through [email protected] or [email protected]. Usually get a reply within a few days.

So... further to my previous post about affected laptops, we've recently purchased a non-DfE laptop that's also affected by this issue. The model is: HP 255 G8 (AMD Ryzen 5 5500U CPU, AMD TPM) INFORMATION_EK_CERTIFICATE Comes with TPM Version: 3.87.0.5 out of the box. No TPM firmware update via Windows Update or OEM Luckily this newer one is still under warranty so I've logged a case with HP today. I've asked them to update HP Commercial Notebook PCs - TPM Attestation May Time Out During Microsoft Autopilot Pre-Provisioning once/if they release a new TPM version. I've reported TPM issues with HP 245 G8, HP 250 G7, HP 255 G7 and HP 255 G8 to them. Let me know if any other HP models are affected.

We’ve encountered something slightly similar, where if you delete a cached user (assuming this is the first time they’ve used the device) on Windows 11, the next time they sign in, none of the SSO policies work. So users have to manually sign in to OneDrive/Edge/M365 apps etc. I wonder if some shared device policies have cleaned up cached logins or something? Or it’s a similar type of bug perhaps.

Might be possible doing it through M365 MyStaff https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/my-staff-configure

Yep, we're having this issues too. If you clear browser cache (or just the Media Foundation data), that seems to be fixing it for us on affected users.

Does your RDS server have the same ‘Site to Zone Assignment’ GPO settings as the rest of your devices? https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-custom#enabling-single-sign-on

Role: IT Security and Infrastructure Engineer Richard Huish College has a strong reputation regionally in its offer of a wide range of A level and vocational courses in Taunton and the surrounding areas in Somerset. We are currently seeking a permanent full time IT Security and Infrastructure Engineer. To provide first class IT support services across Huish with a focus on the security and robustness of all IT systems. This will involve maintaining and deploying solutions to facilitate safe and secure classroom and online learning, and secure access to support services. As well as ensuring that the Huish systems meet legal requirements and are kept working. Working within a highly skilled team, it will provide you with opportunities to expand your knowledge in all areas of IT. This post will also require a knowledge of project management and experience in deploying complex solutions. Richard Huish is a welcoming, supportive and exciting place to work, which promotes a culture of respect and high aspirations for both staff and students. · Salary: SP 21 – 23 (£35,451 - £37,385) · Hours: 37 hours a week, all year round · Contract: Full time, permanent · Closing Date: 26th September 2024 https://www.tes.com/jobs/vacancy/it-security-and-infrastructure-engineer-somerset-2109687

This is workplace join effectively isn’t it? So they’d show as ‘registered’ and not ‘joined’ or ‘hybrid joined’ wouldn’t it? So we can only control them with limited policies I think. We’ve gone for user-driven enrollment and then we remove the primary user from the device. Although we still need to test if a Device Enrollment Manager will be a more viable workaround: http:// https://learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment-manager-enroll.

We're also deploying a custom start2.bin file as per https://quake.blog/configure-windows-11-start-menu-using-only-group-policy.html. The ConfigureStartPins registry key workaround sadly seems to have been 'fixed' in 23H2. We set 'Apply once and do not reapply' so that they can customise it after they get the default one.

I was told by Intel and Microsoft that the OEM has to fix the TPM firmware bugs. They’ve fixed it in other laptop models with a firmware update, so just need to issue one for this model. You can use it in user-driven mode, just not self-deploy or use pre-provisioning as the TPM bug then breaks this.

Nope, you’ll need to log a ticket with HP to fix the TPM firmware I’m afraid. They won’t do it if they’re not under warranty though. That’s where I got to.

You can mass-collect the hardware hashes a few ways: https://learn.microsoft.com/en-us/autopilot/add-devices#collect-the-hardware-hash. We did ours primarily using Configuration Manager (SCCM). We then imported the CSV from ConfigMgr in to Autopilot and already had dynamic device groups set up to assign them an Autopilot profile. We also did some using Windows Autopilot deployment for existing devices (only supports user-driven, not self-deploy) which uses a JSON file during a task sequence to enrol them and register the device in Autopilot. For all of our devices, we did a clean Windows 11 install, worked well! You could probably modify the PowerShell script to save the hash to a SMB share or something if you don't have ConfigMgr though.

We’ve been able to make it work without any need to download the NPS certificate to student devices. We’ve tested it working with either a Public NPS certificate or with the NPS server cert generated from the CA. If their Android phone still has the option, select: CA certificate: Don’t validate If they don’t have that option (usually on Android 11+), select: CA certificate: Use system certificates or Use installed certificates (same setting but named differently on some phones) Online certificate status: Don’t validate Domain: yourdomain.com or ad.your domain.com We’ve also had a few newer Android phones like the Google Pixel’s pre-fill the word ‘anonymous’ in the ‘anonymous identity’ field, which users have to clear out to be able to connect or it fails with Reason Code 8 ‘The specified user account does not exist’.

https://www.ifixit.com/Answers/View/171333/iPhone+5+stuck+on+recovery+mode+error+(9). seems to suggest Apple reject the restore with error code 9 when non-OEM hardware is installed. In that post, someone disconnected their 3rd party screen, restored from iTunes and then reconnected the screen after and it worked. Worth a shot!

The MS Intune team basically closed the ticket asking us to log it with the Windows team instead. We don’t have a support contract so it’s a no-go for further troubleshooting. It’d probably need Dell/HP to issue a TPM firmware update anyway (we don’t have any under warranty any more so can’t log it with them either). We’re either going to do user-driven enrolments and remove primary user, or might look at using a Device Enrollment Manager (DEM) https://learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment-manager-enroll.

An updated list for 2024 for the most popular UK operators: [TABLE=width: 849] [TR] [TD]MCC[/TD] [TD]MNC[/TD] [TD]ISO[/TD] [TD]Country[/TD] [TD]Country Code[/TD] [TD]Network[/TD] [TD]3GPP Network Domain[/TD] [/TR] [TR] [TD]234[/TD] [TD]0[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]BT Group[/TD] [TD]epdg.epc.mnc000.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]76[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]BT Group[/TD] [TD]epdg.epc.mnc076.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]8[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]BT OnePhone[/TD] [TD]epdg.epc.mnc008.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]34[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]EE (Orange)[/TD] [TD]epdg.epc.mnc030.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]30[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]EE/Everything Everywhere[/TD] [TD]epdg.epc.mnc031.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]31[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]EE/Everything Everywhere[/TD] [TD]epdg.epc.mnc032.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]32[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]EE/Everything Everywhere[/TD] [TD]epdg.epc.mnc033.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]33[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]EE/Everything Everywhere[/TD] [TD]epdg.epc.mnc299.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]299[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Failed Calls[/TD] [TD]epdg.epc.mnc026.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]26[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Lycamobile[/TD] [TD]epdg.epc.mnc051.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]51[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]now broadband[/TD] [TD]epdg.epc.mnc002.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]2[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]O2[/TD] [TD]epdg.epc.mnc010.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]10[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]O2[/TD] [TD]epdg.epc.mnc011.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]11[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]O2[/TD] [TD]epdg.epc.mnc034.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]57[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Sky[/TD] [TD]epdg.epc.mnc057.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]16[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Talk Talk[/TD] [TD]epdg.epc.mnc016.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]20[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Three[/TD] [TD]epdg.epc.mnc020.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]94[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Three[/TD] [TD]epdg.epc.mnc094.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]38[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Virgin Mobile[/TD] [TD]epdg.epc.mnc038.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]7[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Vodafone[/TD] [TD]epdg.epc.mnc007.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]15[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Vodafone[/TD] [TD]epdg.epc.mnc015.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]77[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Vodafone[/TD] [TD]epdg.epc.mnc077.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]89[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Vodafone[/TD] [TD]epdg.epc.mnc089.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]91[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Vodafone[/TD] [TD]epdg.epc.mnc091.mcc234.pub.3gppnetwork.org[/TD] [/TR] [TR] [TD]234[/TD] [TD]92[/TD] [TD]gb[/TD] [TD]United Kingdom [/TD] [TD]44[/TD] [TD]Vodafone[/TD] [TD]epdg.epc.mnc092.mcc234.pub.3gppnetwork.org[/TD] [/TR] [/TABLE] If your firewall supports it you could probably just do epdg.epc.mnc*.mcc234.pub.3gppnetwork.org or *.mcc234.pub.3gppnetwork.org.

Had to allowlist some e-marker.co.uk domains from SSL/HTTPS deep Inspection today. When testing I saw it contact the following domains. Not sure which one(s) exactly don't like being inspected, but we've allowed them all and it's working again for our staff: e1p001dirsev.e-marker.co.uk e1p001script.e-marker.co.uk e1p001marker.e-marker.co.uk e1p002marker.e-marker.co.uk e1p003marker.e-marker.co.uk e1p004marker.e-marker.co.uk e1p005marker.e-marker.co.uk emp001web.e-marker.co.uk idp001web.e-marker.co.uk

I've still got the ticket open with MS, but I suspect it's a CPU/TPM Firmware issue that OEM's are going to have to fix. I did have a Lenovo 300e enrol in self-deploying mode when "TPM Has Vulnerable Firmware" was "True", so seems that it may not be as important to attest as I thought. Must just be the "Ready for Attestation: True" that matters. If you were using user-driven mode previously, it won't use/need the TPM to enrol the device as it'll use the user credentials. Whereas using self-deploying mode (or pre-provisioning with user-driven) would then use the TPM to enrol the device instead. If it's using one of the TPM's that has an issue with TPM attestation, it'll fail to enrol. The only way to fully enrol them is user-driven mode sadly.

You can use https://www.youtube.com/check_content_restrictions to check for DNS/Firewall/ISP enforcement. Not sure if it detects browser GPO enforced restricted mode though.

Just tested on a Windows 11 PC. Store is restricted to 'private' via GPO/Intune Policy. It seems not all apps on apps.microsoft.com are available to download directly. E.g. trying with Adobe Acrobat Reader DC you only have an 'Install' button, but with WhatsApp, you can 'Download' or 'View in Store'. If you 'Install' or 'View in Store', it opens the Microsoft Store app and is blocked. If you 'Download', it launches a download from "blob:https://apps.microsoft.com". The .exe's are digitally signed by 'Microsoft Corporation' as 'Store Installer'. You might be able to use AppLocker to block these. Assuming it doesn't then break the store/updates. Not sure if blocking apps.microsoft.com would also then break app deployments either. A bit annoying that blocking the store doesn't also block these though.

We use an internal DNS server, but for those who are setting an external DNS provider like Google in their DHCP settings, it'd probably be better to use 1.1.1.3/1.0.0.3 (https://one.one.one.one/family/) rather than Google as this blocks Malware and Adult Content via DNS (on top of your own filters).

FYI for those who are using GarageBand/Logic Pro and use the Loops, there's a way to disable the prompts to install them. This is especially needed for Logic Pro 11 which was recently released, which has a bug where even though all Loops are installed, it'll still prompt you to 'Download More Sounds'. For Logic, you can disable the prompts by adding the configuration profile settings listed here: https://soundmacguy.wordpress.com/2024/05/15/logic-pro-11-and-suppressing-prompts-to-install-additional-content/. For GarageBand, it'll be the profile settings listed here: https://www.carlashley.com/media/pdfs/blogarchive.pdf (page 55) as well as RecentWhatsNewPanelVersion. Domain: com.apple.garageband10 Payload: ShowMoreDownloadsDialogGB RecentWhatsNewPanelVersion 99 Or you can create them using something like the iMazing Profile Editor that has templates for GarageBand/Logic Pro.

Yep, that's all you should need to do. I've previously had issues with trusted SSL Certificates on macOS. A reboot normally solves most issues with captive portals and SSL Certificates. I've also had issues with the 'location' and no internet access (which weren't related to SSL deep inspection), and turning it to 'Automatic' solved internet access issues. Not sure on your setup for Home/Work though, but worth a look/test. I've also had issues where Avast or McAfee installed on the device interfering with it.

Ok, so this error appears to be a combination of issues. The JSON file for Windows Autopilot for existing devices We were using the JSON file for Windows Autopilot for existing devices in a ConfigMgr task sequence to wipe devices to Windows 11 and to then enrol them in to Autopilot. However, the JSON file only supports user-driven Autopilot profiles. Self-deploying and pre-provisioning Autopilot profiles aren't supported due to these scenarios requiring TPM attestation. https://learn.microsoft.com/en-us/autopilot/existing-devices. Annoyingly (at the time of writing) the article for this error https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors#securing-your-hardware-failed-0x800705b4 doesn't specify this, so I've logged a GitHub issue to get this updated. TPM firmware vulnerabilities The DfE laptops we have are affected by TPM vulnerabilities. This then impacts TPM attestation during the Autopilot self-deploy mode and the user-mode pre-provisioning, which causes the 0x800705b4 TPM attestation timeout error during ESP. Lenovo 300e (Intel Celeron N4120 CPU, Nuvoton Technology TPM) Tpm Firmware Vulnerability: 0x00000002 ADV190024 - ECDSA key generation (tpm.FAIL) Fixable with a TPM firmware update via Windows Update Dell Latitude 3190 (Intel Celeron N4120 CPU, Intel TPM) INFORMATION_EK_CERTIFICATE No TPM firmware update via Windows Update or OEM HP 250 G7 (Intel Celeron N4020 CPU, Intel TPM) INFORMATION_EK_CERTIFICATE No TPM firmware update via Windows Update or OEM I've tried to reach out to HP/Dell to see if they'll issue a TPM firmware update but as the devices we have are no-longer under warranty, getting support or even talking to a human is proving very difficult. Will keep trying though!