georgeescott

Still battling with MS Support on this one. Trying to get them to acknowledge it as an issue and not 'by design'. It also affects SSO for all MS apps e.g. Edge, Word etc. after the profile has been deleted, not just OneDrive. If you manually sign-in to an MS app after the profile has been previously removed e.g. OneDrive, the other MS apps then work, and on subsequent logins too. Very weird.

Although Don't run specified Windows applications would probably do, without AppLocker it wouldn't stop the user from having a renamed copy of it that they could run. We've blocked it via AppLocker but allow it for Administrators. Here's our AppX XML for it:

Sadly, I don't think this is the cause of our issue. I've run the PowerShell commands to reinstall the Microsoft.AAD.BrokerPlugin plugin, as well as following Microsoft's article on this https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/authentication/automatic-authentication-fails, no change. Edge/Office apps will silently sign-in, it only seems to be OneDrive that doesn't (after the profile has been removed previously). Back to MS support...

We've been configuring and testing OneDrive via Intune recently. I can confirm, this is also happening to us on our test devices. OneDrive will auto-launch at login and silently sign-in on the first and subsequent logins, but it then stop's silently signing-in after removing the user's profile and signing in again. We have some Entra-joined devices that have been autopilot-ed in both user-driven and self-deploying. This is happening on both our user-driven devices (has a primary user and no Shared PC mode enabled) devices as well as our self-deploying (no primary user and Shared PC mode enabled) devices. There's a new OMA-URI policy setting EnableSharedPCModeWithOneDriveSync to get OneDrive working in Shared PC Mode which we're using rather than the 'legacy' workaround of DisableOneDriveFileSync and MDMWinsOverGP.

We've started seeing this in MS Edge 122.0.2365.92 this week. At the time of writing, their latest ADMX policies haven't yet added Chrome's equivalent of 'Enable zstd content-encoding support'. However, you can set the relevant registry key to disable it until they add it to their ADMX policies: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge] "ZstdContentEncodingEnabled"=dword:00000000

Ok, so I'm getting closer and have it working on one Lenovo 300e DfE laptop. But still getting 'Securing your hardware (0x800705b4)' on other ones i'm testing with. Starting to think it could be a hardware problem versus a Windows/Intune problem. I've found a way to update the TPM firmware to fix the vulnerability. It looks like the TPM updates are coming down through Windows Update and most aren't provided on the TPM/device manufacturers websites. As it's an optional driver update, it isn't installing before the Device Preparation phase of Autopilot/ESP. So, the TPM update process for Windows 11 is: After Autopilot, wait for the device to get to the ESP Press SHIFT+F10 to open CMD Run "tpmtool GetDeviceInformation" to confirm the TPM's Manufacturer Open Windows Updates; either by running "start ms-settings:windowsupdate" or by pressing Windows Key+Pause/Break Check for updates Go to Windows Updates -> Advanced options -> Additional options -> Optional updates -> Driver updates Hopefully the TPM manufacturer's name will be listed as a firmware update. On my Lenovo 300e, it was listed as "Nuvoton - Firmware - 0.0.0.6". Tick the required firmware update and click Download & install The update(s) will begin installing. Restart when prompted and the TPM firmware should begin updating After it boots back in to Windows and the ESP page, press SHIFT+F10 to open CMD Run "tpmtool GetDeviceInformation" again to confirm that the "Tpm Firmware Vulnerability" property is no longer listed, and that the "TPM Has Vulnerable Firmware" is "False" Restart Autopilot or wipe the device and it might go through the Device preparation -> Securing your hardware step this time You can normally restart the ESP process without needing to wipe the device by: Press SHIFT+F10 to open CMD Run regedit Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\AutopilotSettings\ Delete the following keys: DevicePreparationCategory.Status DeviceSetupCategory.Status [*]In CMD, run shutdown /r /t 0 to restart and the ESP should start from the beginning again I've got a ticket logged with Microsoft to troubleshoot why 0x800705b4 is happening so I'll post back if I get anywhere..

Had this same 'Securing your hardware (0x800705b4)' error today when testing Autopilot self-deploying with our Dfe Lenovo 300e's. Running tpmtool GetDeviceInformation on the device shows: Tpm Firmware Vulnerability: 0x00000002 ADV190024 - ECDSA key generation (tpm.FAIL) https://call4cloud.nl/2022/08/ready-for-attestation-a-true-underdog-story was helpful diagnosing this. Lenovo have an advisory on it https://support.lenovo.com/us/en/product_security/ps500286-st-microelectronics-tpm-firmware-ecdsa-signature-generation-vulnerability but don't list the 300e's. They're out of warranty now so can't log a ticket with Lenovo without paying for support but have posted in the Forums hoping someone may have seen it before. Running latest BIOS and have cleared TPM. Has anyone managed to resolve this with the Lenovo DfE laptops? Or did you have to resort to the user-driven Autopilot profile.

We have our Macs bound to AD, but don’t enable ‘mobile accounts’ except for MacBooks going off-site. We use OneDrive for storage (except for Logic as it doesn’t play well). We also found that Adobe Creative Cloud drive was taking up loads of space as it doesn’t do files on-demand like OneDrive does. We’ve disabled Adobe Creative Cloud drive and then have a custom script run via a Jamf policy that runs once a week to remove profiles older than X days (we have it at 45 days which seems to be ok). We also have a Jamf extension attribute script that collects the size of the /Users folder so we can keep an eye on it. Happy to post it if you’re interested.

Have you checked your outbound spam filter policy? We block it by default then assign a custom outbound spam filter policy to mailboxes that need it allowed. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/outbound-spam-policies-external-email-forwarding

Looks like Microsoft are rolling out their 'Clipchamp for Work' product. Which of-course is a paid-for add-on, or included in 'Microsoft 365 Business' Standard and Premium. Not clear if it'll be enabled for educational subscriptions yet though. They have a couple of documents for How to access Microsoft Clipchamp with your work account and Work account support in the Clipchamp app for Windows but no mention of education in those. So far, they're only supporting 'work' accounts for Clipchamp on the web only, and not-yet in their own app. I've tried logging in to https://www.microsoft365.com/launch/clipchamp as an account with 'Office 365 A1 for faculty' and 'Microsoft 365 A3 for faculty' but get 'Clipchamp is not available for you. Please contact your Microsoft 365 admin for assistance'. So it might be some time until it's available for education customers. We're also sticking with Microsoft Photos Legacy/Video Editor (deployed via Intune) on our Windows 10/11 devices that don't have the Adobe Suite. I did discover that there's Clipchamp ADMX templates and a GPO setting to disable Clipchamp, referenced at the bottom of How to enable or disable Clipchamp for users in your organization, so we're using that until they support it for education.

With Jamf, you have several options for deploying macOS apps: Apple App Store Apps (using VPP) - https://learn.jamf.com/bundle/jamf-100-course-current/page/Lesson_35.html Jamf App Installers - https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/App_Installers.html Jamf Packages (dmg, pkg, mpkg) - https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/Packages.html Jamf Patch Management - https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/PatchManagement.html Jamf Title Editor (although this hasn't had an update in a while) - https://learn.jamf.com/bundle/title-editor/page/About_Title_Editor.html I've got a fair few Jamf Packages in our Jamf repository where I've extracted a pkg from a dmg, or I've had to repackage the original installer with Jamf Composer. I've only ever come across one app that I couldn't get to work through Jamf. I try to avoid using the Snapshot feature of Jamf Composer as much as I can. Pacifist is a really helpful tool when inspecting/repackaging macOS apps too! I typically encounter 3 different types of installer from vendors, so I have different processes I use: Standalone pkg - import the pkg in to Jamf DMG or ZIP with pkg inside - extract the contents and then import the pkg in to Jamf DMG (with .app inside) - while something like munki supports these installers natively, Jamf does not. You can use TwoCanoes Repackage or use Jamf Composer to repackage these to copy the .app to /Applications at install. Sibelius isn't available through the App Store or through Jamf App Installers. Sibelius is a DMG with pkg inside, so you'll need to use Jamf Packages by uploading the pkg to Jamf Pro and then deploy it at part of a policy. Below are my simplified personal notes on deploying 'Sibelius Ultimate Multiseat (Network)' via Jamf (but would work with most MDM's): Log in and download the latest Sibelius Mac dmg from https://my.avid.com/products#MyProducts Mount the DMG on macOS Inside the DMG you'll find 'Install Sibelius.pkg'. Extract the .pkg to your Downloads folder. Rename 'Install Sibelius.pkg' to a suitable name. I use the following format "-.pkg". E.g. "AvidSibelius-23.11.1.2251.pkg" If you're using a local Jamf repository, move/save the .pkg there. You may need to compress (zip) this .pkg as sometimes Jamf struggles to download/install large packages. Open Jamf Admin and import the .pkg, categorise it, calculate checksum and save. Jamf Admin will be deprecated this year so there may be a new tool that replaces this step at some point. In Jamf Pro, create a new script that will set the network licence server Give the script a descriptive name Enter the following bash script and update the server name to your own: #!/bin/bash Server=$"sibelius.domain.com:7312" if [ ! -d "/Library/Application Support/Avid/Sibelius/_manuscript/" ]; then mkdir -p "/Library/Application Support/Avid/Sibelius/_manuscript/" fi if [ -d "/Library/Application Support/Avid/Sibelius/_manuscript/" ]; then LicenceServerInfo=$"/Library/Application Support/Avid/Sibelius/_manuscript/LicenceServerInfo" touch "$LicenceServerInfo" chmod 775 "$LicenceServerInfo" echo "$Server" > "$LicenceServerInfo" else # fail as the folder was not created exit 1 fi [*]Create a new computer policy to install the Sibelius .pkg and to run the licence script afterwards. [*]Additionally, you may want to create a Configuration Profile to allow the Avid Link notifications. The Bundle ID is 'com.avid.link'.

There's a little-known official Apple script that does this for Garageband and Logic Pro called "loops.sh". It's not publicly available though because it's still in Beta. You have to contact Apple to be added to a list for access. I first discovered it last year on the MacAdmins Slack (https://app.slack.com/client/T04QVKUQG/C6G6GLHB7). I contacted Aaron Davis, a Sr. System Engineer at Apple ([email protected]) to sign up for access to the script as I found his email in a post in the MacAdmins Slack about it. We have it deployed to all our Macs that need the GarageBand or Logic Pro sounds. It works about 95% of the time but saves so much time! I have added loops.sh as a Jamf script, then have a Jamf policy that runs the script with the required parameters. E.g. to install all GarageBand Loops, I pass the following parameters: -d garageband-all -i

We're disabling Wi-Fi on iMacs and Mac Mini's using a custom configuration profile in Jamf. Haven't tested on M2 Mac Mini's yet but should do the job. You can also disable the 'Network' system settings pane in a configuration profile. Preference Domain: com.apple.mcxMenuExtras PLIST settings: AirPort.menu Preference Domain: com.apple.MCXAirPort PLIST settings: DisableAirPort Haven't found a way to hide Wi-Fi from the Control Centre yet though..

@CHiLL @Badaz52 @sideone sorry for the delay in posting it, I finally had some time over Christmas! I've uploaded it here: https://github.com/georgeescott/Scripts/tree/main/PowerShell/Remove-ClientSideRenderingPrinterConnections. I've documented which keys I'm deleting and why in the GitHub repo. My script goes a bit further than @scottcopus's and deletes some extra keys I observed being removed on logoff when the 'RemovePrintersAtLogoff' key is set. Give it a test and submit any issues to my repo.

Not when you have lots of Windows-only applications that are needed for lessons/courses! Especially in secondary/further education. Chromebooks might be more feasible for primary schools though!

Here’s our experience… I’ve tested Autopilot and Entra Join (formerly Azure AD Join) for our trust. For shared devices, it just simply doesn’t fit our needs at the moment. For 1:1 staff laptops, it might be possible though. I found that Autopilot wasn’t always that reliable, policies/apps would intermittently fail and diagnosing the failures during OOBE was a nightmare. You can’t easily ‘retry’ anything either so your main option is to wipe/reset and restart the whole process over again. I briefly tested the ‘Shared PC’ mode and ‘Education policies’ but we have things like exam, controlled assessment, staff, student, visitor, open evening etc. accounts that need unique user-based policies that just would never reliably apply using Intune compared with Group Policy that works 99% of the time straight at logon. We have a lot of shared laptop cabinets and computer suites where we need a very autonomous setup/imaging process. Autopilot does now have a self-deploying mode (currently in preview) but this doesn’t support hybrid currently so Autopilot is pretty much a non-starter for our shared devices. Personally, I think 1:1 student devices are a bad idea as they often get damaged at home, and financial consequences are impossible to impact/enforce so the school ends up paying for repairs/replacements. But Microsoft seem to think education can afford 1:1 devices for everyone! We have ConfigMgr, so we’ve setup co-management. The way we’re approaching Intune in our Trust will be using a hybrid of AD, GPO and Intune to get the best of both worlds. We’ll use a ConfigMgr task sequence to play the part of the ‘OEM’ in the Autopilot workflow (https://learn.microsoft.com/en-us/autopilot/pre-provision) which will wipe the device, install Windows, install drivers and Windows Updates. It’ll then also join it to AD and ConfigMgr/GPO will Entra hybrid join and Intune enrol it. We’ll then assign some GPO’s and Intune configuration profiles to these devices. We’re starting with the things Intune does fairly well with - Microsoft Store Apps, WUfB, Defender, LAPS, BitLocker, Remediation Scripts and a few other bits. We’ll then look to maybe start migrating all computer GPO’s to Intune device configuration profiles and keep user-based ones as GPO’s where we need to ensure settings are applied on logon reliably, but I need to test this more yet. If we end up going full Entra join and Autopilot for our 1:1 staff laptops, then there should be a much easier migration path as a lot of things will already be in Intune and we can just assign user configuration profiles to 1:1 devices instead of using the user GPO’s. All our files are on Sharepoint/Teams/OneDrive (although macOS Logic Pro files don’t play well with the OneDrive app) so the storage requirements are a lot less than they used to be when we had on-prem file servers. Any 3rd party services we host internally, we try to migrate to the providers own cloud-hosted solutions where possible and cost-effective. I think having 2 internet connections would be enough and it’s rare that Microsoft services like OneDrive/Sharepoint are completely inaccessible, especially for more than an hour. Interested to see how other people are approaching it though…

Just for anyone else coming across this post like me, you can add the 'Intel® Serial IO I2C Host Controller' driver which is part of the 'Intel Serial IO Driver' download to your ConfigMgr Boot Image (or MDT Boot Image) and the touchpad then works in the Task Sequence.

Yep, we’ve not had any further issues with printers since applying the RemovePrintersAtLogoff key, and running the script regularly to clear out any remaining keys. I’ll upload the script to my GitHub this week and post a link when it’s done!

Microsoft are turning off basic authentication generally, but they’re keeping basic authentication (SMTP AUTH) enabled for SMTP: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online#pop-imap-and-smtp-auth You can turn SMTP off for all mailboxes except SMTP service accounts and combine this with conditional access to secure SMTP AUTH. Or, use a 3rd party or their own service £££.

Apple haven’t made a configuration setting to turn this off for all wireless networks (annoyingly!), but, if the devices is supervised via MDM then the wireless network can be configured through a configuration profile and I’m pretty sure that it then hides the PSK. But if you’ve manually joined it then it will show to users.

Although it didn't get reported/seen during our initial testing of those registry keys, we too had issues with the default printers not being selected so we also reverted the registry keys back. The last few weeks we've been testing a different combination that was inspired from other forum posts http://www.edugeek.net/forums/windows-10/183649-windows-10-printers-keep-coming-back.html and https://social.technet.microsoft.com/Forums/lync/en-US/71d06204-3735-4473-8bc9-20be9e19090e/problem-with-multiple-instances-of-shared-printers-being-installed-on-client-computers-when-the. We're currently only setting the following registry key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] "RemovePrintersAtLogoff"=dword:00000001 and then having a startup script remove specific keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider It's being tested across our Trust, but early results are promising; we've not had more '0x80070057 The parameter is incorrect' errors being logged. I'll test it for another week or two and then I'll post the script.

We've started seeing an increase in printer mapping issues the last week or so too. Only fix we've found for it so far is to delete "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" and "gpupdate /force". Have been using this command to get the latest error codes for it though: $computer="computernamehere" Get-EventLog -LogName Application -Source "Group Policy Printers" -Newest 5 -ComputerName $computer | Where-Object {$_.EntryType -eq "Warning" -or $_.EntryType -eq "Error"} | FL TimeGenerated,EventID,EntryType,Message What error(s) are you getting?

Ah.. could well be it then. Start by going through your exemptions list I guess. Worth looking at NetFlow/sFlow though, it helped me diagnose bandwidth issues as a previous place using a free instance of PRTG for the sensors/graphs. Other than Windows Updates, you could look at Windows startup, task scheduler and services to spot anything running at startup. Autoruns is helpful http:// https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Any other information your external web filter shows? What are the other top domains being hit? I posted about this in a different thread: /showthread.php?t=231552 Most of the NCSI domains used by Microsoft don’t work. I’ve logged a ticket with MS about it. As others have mentioned, this would primarily be a few bytes for the .txt file or just DNS lookups. It’s unlikely to be the issue.

Does your firewall log enough to tell the highest bandwidth usage vs highest requested domains? Or does your core switch support NetFlow/sFlow?