buzzard

SO knew to come here for this, what are people considering replacing MDT with, I've only really used SCCM etc but that's not something I'd consider for the little on prem AD stuff I still have left? OSD Cloud look interesting but I've never really come across it or know of anyone who could vouch for it? Interested in peoples opinions!

Importing into which system??

Just checking when you say Entra A3, is that Office 365 Education A3? looking online it should be covered? - Microsoft 365 Education - Service Descriptions | Microsoft Learn are you giving the user time to sync and update its licence from 365 as its licenced to the user.

On ours, this is run under State Restore > Custom Tasks folder

We did this and I run the below script in MDT which I've not had issues with on W10 boxes when reimaging to W11. (I'm sure I may have posted this a few days ago on another thread!?) If you have no other choice to use the older unsupported hardware this may be a way around the licencing. If its activating via MS then you're fine <# Reads Windows OA3 product key from BIOS/UEFI and installs the key and activates Windows Written by Ben Drew 2017 #> $ProductKey = (Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ipk $Productkey" Start-Sleep 5 Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ato"

I've done this by flattening them once you've deleted any hardware hash from MDM/Autopilot\Cloud systems etc, and had a task sequence in MDT to put on the licenced edition of the OS (I bought all devices with pro), I then had a script fire as a step to grab the OS key from the BIOS and then activate it. Then given as is with no warranty etc. This obviously depends on there being an OS key embedded! <# Reads Windows OA3 product key from BIOS/UEFI and installs the key and activates Windows Written by Ben Drew 2017 #> $ProductKey = (Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ipk $Productkey" Start-Sleep 5 Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ato"

Oh I meant to add as well @HyperTech you could request from the MSP/MAT Intune Admin role or Entra Joined Local Admin role which would allow you to fix most end user issues rather than needing the GA role which might help in the short term

Working at an MSP as a head of department we had a mix of edu customers with admin rights and those without. The relationship has to be really tight and as the MSP, we had to trust that the school staff know their stuff. It all came down to having defined processes and a shared responsibility document detailing what changes could be made and what the change management would be around this. If you where to pull that together and say this is how you propose it could work to the MSP and the school, that may be a way in, especially then with the value you add to the service to the school\students. Be mindful of all the work you action would be taking revenue away from the MSP, so it all depends on how the MSP is motivated as may want to protect this.

I *think* places like 2Simple et al, used to have everything as flash but they rewrote much of their content using newer tech so they could continue selling their resources.

I couldn't tell if you already have created the AD accounts or you just wanted folders created and permissions set correctly, I wrote this a fair few years ago (and probably got some from a forum) but this is what i use to find and fix permission issues on home folders, it will create the folder and a desktop/documents/fav subfolder if it doesn't exist which you can commented out if not needed. Its not the prettiest and was written in circa 2018 so don't judge! use at your own risk! You just need to amend the fields in the variable section <############################################################################# Script: Set-ACL_HomeFolders.ps1 Author: Ben Drew Date: 14.11.2018 Keywords:Permissions Comments: Pre-Requisites: Admin rights to AD. +------------+-----+---------------------------------------------------------+ | Date | Usr | Description | +------------+-----+---------------------------------------------------------+ | 14/11/2018 | BD | Initial Script | +------------+-----+---------------------------------------------------------+ | 07/06/2019 | BD | Rewritten to include setting owner and subfolder | | | | creation. | +------------+-----+---------------------------------------------------------+ DISCLAIMER ========== THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER. Notes ===== This script will look to the OU defined in $searchbase and pull every username it finds, it will then check in the directory defined in $searchbase to see if theres a folder and create if they're not already there and then set the permission. This script is to be used on the Folder Redirection Folder and/or Home folders !!!!! RUN FROM THE C:\Scripts FOLDER !!!!! #############################################################################> # ===================================== # Variables - ONLY EDIT IN THIS SECTION # ===================================== # $Right = "Modify" $domain = "999" $searchbase = "OU=Users,OU=!9990,DC=999,DC=com" $HomeDirPath = "D:\FolderRedirection" $logpath = "C:\Scripts\Logs\Set-Create-HomeFolders-Log.txt" $DC = 'DC01.999.com' # #> $AdjustTokenPrivileges = @" using System; using System.Runtime.InteropServices; public class TokenManipulator { [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen); [DllImport("kernel32.dll", ExactSpelling = true)] internal static extern IntPtr GetCurrentProcess(); [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); [DllImport("advapi32.dll", SetLastError = true)] internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); [StructLayout(LayoutKind.Sequential, Pack = 1)] internal struct TokPriv1Luid { public int Count; public long Luid; public int Attr; } internal const int SE_PRIVILEGE_DISABLED = 0x00000000; internal const int SE_PRIVILEGE_ENABLED = 0x00000002; internal const int TOKEN_QUERY = 0x00000008; internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; public static bool AddPrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_ENABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } public static bool RemovePrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_DISABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } } "@ #### Lets start to do some actual work - Don't edit below unless you want to unlease hell #### # Check to see if the Powershell AD module is available otherwise connect to the DC if (Get-Module -ListAvailable -Name ActiveDirectory -ErrorAction silentlycontinue) { Write-Host -ForegroundColor Magenta "AD module available locally, no need to connect to a DC" Import-Module ActiveDirectory } #End the IF statement else { Write-Host -ForegroundColor Cyan "Creating a PS Session to a DC" $S = New-PSSession -ComputerName $DC Import-Module -PSsession $S -Name ActiveDirectory } #End the Else Statement # Automatic Variable to get ad user list $ADUsers = Get-ADUser -Searchbase $searchbase -Filter * | Select-Object samaccountname # Performing loop foreach ($Account in $ADUsers) { $user = $account.samaccountname $principal = "$domain\$user" Write-Host -ForegroundColor Cyan "Testing Home dir path for $user account" $pathtest = Test-Path $HomeDirPath\$user if ($pathtest -eq $true) { # Path is true, defining the right ACL to the right folder $path = "$HomeDirPath\$user" Write-Host -ForegroundColor Green "Ok, path exists on $pathtest for $user" $rule = new-object System.Security.AccessControl.FileSystemAccessRule($Principal, $Right, "ContainerInherit,ObjectInherit", "none", "Allow") $ACL = Get-Acl $path $ACL.setaccessrule($rule) Set-Acl $path $ACL Write-Host -ForegroundColor Green "Succesfully set permissions for $user" # Try and set the user as the owner of the Folder Add-Type $AdjustTokenPrivileges $Folder = Get-Item $Path [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) Write-Host -ForegroundColor Green "Succesfully set the owner for $Path to $user" } #End the If Statement Else { # Path is false, logging to the log file Write-Host -ForegroundColor Cyan "Path for $user does not exist on destination path" Write-Output "$pathtest does not exist for $user" >> $logpath $path = "$HomeDirPath\$user" New-Item -Path "$path" -ItemType directory Write-Host -ForegroundColor Green "Created root user directory for $user in $HomeDirPath" # Create Desktop path if it doesn't already exist If(!(Test-Path -path "$path\Desktop")) { New-Item -Path "$path\Desktop" -ItemType directory #Set the Owner for Desktop Add-Type $AdjustTokenPrivileges $Folder = Get-Item "$path\Desktop" [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the If Statement # Create Documents path if it doesn't already exist If(!(Test-Path -path "$path\Documents")) { New-Item -Path "$path\Documents" -ItemType directory #Set the Owner for Documents Add-Type $AdjustTokenPrivileges $Folder = Get-Item "$Path\Documents" [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the If Statement # Create Favorites path if it doesn't already exist If(!(Test-Path -Path "$path\Favorites")) { New-Item -Path "$path\Favorites" -ItemType directory #Set the Owner for Favorites Add-Type $AdjustTokenPrivileges $Folder = Get-Item "$Path\Favorites" [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the Else Statement # Path is true, defining the right ACL to the right folder $path = "$HomeDirPath\$user" Write-Host -ForegroundColor Green "Ok, path exists on $path for $user" $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Principal, $Right, "ContainerInherit,ObjectInherit", "none", "Allow") $ACL = Get-Acl $path $ACL.SetAccessRule($rule) Set-Acl $path $ACL Write-Host -ForegroundColor Green "Succesfully set permissions for $user" # Try and set the user as the owner of the Folder Add-Type $AdjustTokenPrivileges $Folder = Get-Item $Path [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the Else Statement Write-Host -ForegroundColor Magenta "The script had a problem as $user didn't have a folder, but we've created it now and set the correct permissions." } #End the Loop ##################################### ### Stop PS Session to the DC ### ##################################### Remove-PSSession -ComputerName $DC -ErrorAction SilentlyContinue ##################################### ### Clear Variables ### ##################################### Remove-Variable -Name * -ErrorAction SilentlyContinue ##################################### ### Post Completion Msg ### ##################################### Write-Host -ForegroundColor White -BackgroundColor DarkGreen "***************************************************************************************************************" Write-Host -ForegroundColor White -BackgroundColor DarkGreen " Script has now completed, please check all Folders and permissions have been created as expected! " Write-Host -ForegroundColor White -BackgroundColor DarkGreen "***************************************************************************************************************" [Console]::ResetColor()

I know its not what you're asking, but from a security perspective, I would get staff to look for newer software as Flash is completely unsupported and Adobe flash player has been EoL since circa 2020. I'd be really surprised if you can get that working properly on a fully up to date system. I work in finance now and having anything like that would have alarm bells ringing and questions asked immediately!

On the app installs, did you say you are mixing w32 and LOB? I have had these clash as the processes run simultaneous so that's why I wrap everything in w32 these days. Is the user you're signing in with allocated an Intune licence?

I assume these are Domain joined devices that you manage Hybrid? Are these going into the Computers CN in AD and your EntrID sync is targeted on a specific OU?

Sorry, just scanned the thread, I didn't see if you are deploying apps to users or to devices? I only ever assign apps to devices as that's the only reliable way I've found if its a shared device (even as hot spares). I had no end of issues if I assigned to users, I believe best practice is to not mix up both user and computer assignment.

If these are existing domain machines, I'd rebuild. For this I prefer to use MDT and have a task sequence that flattens them, cleans up the vanilla system and preloads some of the apps using PSADK (which is what we use in Intune) so it speeds up the builds. I waste too much time waiting for apps to install from the cloud so prefer to have tighter control over the process. Using the autopilot and ESPs to manage it once its rolling is fairly straightforward and well documented. I did have a TS in MDT that fired off an onboarding PS script which initiated the process but I never got around to finishing it properly!