buzzard

SO knew to come here for this, what are people considering replacing MDT with, I've only really used SCCM etc but that's not something I'd consider for the little on prem AD stuff I still have left? OSD Cloud look interesting but I've never really come across it or know of anyone who could vouch for it? Interested in peoples opinions!

Importing into which system??

Just checking when you say Entra A3, is that Office 365 Education A3? looking online it should be covered? - Microsoft 365 Education - Service Descriptions | Microsoft Learn are you giving the user time to sync and update its licence from 365 as its licenced to the user.

On ours, this is run under State Restore > Custom Tasks folder

We did this and I run the below script in MDT which I've not had issues with on W10 boxes when reimaging to W11. (I'm sure I may have posted this a few days ago on another thread!?) If you have no other choice to use the older unsupported hardware this may be a way around the licencing. If its activating via MS then you're fine <# Reads Windows OA3 product key from BIOS/UEFI and installs the key and activates Windows Written by Ben Drew 2017 #> $ProductKey = (Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ipk $Productkey" Start-Sleep 5 Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ato"

I've done this by flattening them once you've deleted any hardware hash from MDM/Autopilot\Cloud systems etc, and had a task sequence in MDT to put on the licenced edition of the OS (I bought all devices with pro), I then had a script fire as a step to grab the OS key from the BIOS and then activate it. Then given as is with no warranty etc. This obviously depends on there being an OS key embedded! <# Reads Windows OA3 product key from BIOS/UEFI and installs the key and activates Windows Written by Ben Drew 2017 #> $ProductKey = (Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ipk $Productkey" Start-Sleep 5 Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ato"

Oh I meant to add as well @HyperTech you could request from the MSP/MAT Intune Admin role or Entra Joined Local Admin role which would allow you to fix most end user issues rather than needing the GA role which might help in the short term

Working at an MSP as a head of department we had a mix of edu customers with admin rights and those without. The relationship has to be really tight and as the MSP, we had to trust that the school staff know their stuff. It all came down to having defined processes and a shared responsibility document detailing what changes could be made and what the change management would be around this. If you where to pull that together and say this is how you propose it could work to the MSP and the school, that may be a way in, especially then with the value you add to the service to the school\students. Be mindful of all the work you action would be taking revenue away from the MSP, so it all depends on how the MSP is motivated as may want to protect this.

I *think* places like 2Simple et al, used to have everything as flash but they rewrote much of their content using newer tech so they could continue selling their resources.

I couldn't tell if you already have created the AD accounts or you just wanted folders created and permissions set correctly, I wrote this a fair few years ago (and probably got some from a forum) but this is what i use to find and fix permission issues on home folders, it will create the folder and a desktop/documents/fav subfolder if it doesn't exist which you can commented out if not needed. Its not the prettiest and was written in circa 2018 so don't judge! use at your own risk! You just need to amend the fields in the variable section <############################################################################# Script: Set-ACL_HomeFolders.ps1 Author: Ben Drew Date: 14.11.2018 Keywords:Permissions Comments: Pre-Requisites: Admin rights to AD. +------------+-----+---------------------------------------------------------+ | Date | Usr | Description | +------------+-----+---------------------------------------------------------+ | 14/11/2018 | BD | Initial Script | +------------+-----+---------------------------------------------------------+ | 07/06/2019 | BD | Rewritten to include setting owner and subfolder | | | | creation. | +------------+-----+---------------------------------------------------------+ DISCLAIMER ========== THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER. Notes ===== This script will look to the OU defined in $searchbase and pull every username it finds, it will then check in the directory defined in $searchbase to see if theres a folder and create if they're not already there and then set the permission. This script is to be used on the Folder Redirection Folder and/or Home folders !!!!! RUN FROM THE C:\Scripts FOLDER !!!!! #############################################################################> # ===================================== # Variables - ONLY EDIT IN THIS SECTION # ===================================== # $Right = "Modify" $domain = "999" $searchbase = "OU=Users,OU=!9990,DC=999,DC=com" $HomeDirPath = "D:\FolderRedirection" $logpath = "C:\Scripts\Logs\Set-Create-HomeFolders-Log.txt" $DC = 'DC01.999.com' # #> $AdjustTokenPrivileges = @" using System; using System.Runtime.InteropServices; public class TokenManipulator { [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen); [DllImport("kernel32.dll", ExactSpelling = true)] internal static extern IntPtr GetCurrentProcess(); [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); [DllImport("advapi32.dll", SetLastError = true)] internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); [StructLayout(LayoutKind.Sequential, Pack = 1)] internal struct TokPriv1Luid { public int Count; public long Luid; public int Attr; } internal const int SE_PRIVILEGE_DISABLED = 0x00000000; internal const int SE_PRIVILEGE_ENABLED = 0x00000002; internal const int TOKEN_QUERY = 0x00000008; internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; public static bool AddPrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_ENABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } public static bool RemovePrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_DISABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } } "@ #### Lets start to do some actual work - Don't edit below unless you want to unlease hell #### # Check to see if the Powershell AD module is available otherwise connect to the DC if (Get-Module -ListAvailable -Name ActiveDirectory -ErrorAction silentlycontinue) { Write-Host -ForegroundColor Magenta "AD module available locally, no need to connect to a DC" Import-Module ActiveDirectory } #End the IF statement else { Write-Host -ForegroundColor Cyan "Creating a PS Session to a DC" $S = New-PSSession -ComputerName $DC Import-Module -PSsession $S -Name ActiveDirectory } #End the Else Statement # Automatic Variable to get ad user list $ADUsers = Get-ADUser -Searchbase $searchbase -Filter * | Select-Object samaccountname # Performing loop foreach ($Account in $ADUsers) { $user = $account.samaccountname $principal = "$domain\$user" Write-Host -ForegroundColor Cyan "Testing Home dir path for $user account" $pathtest = Test-Path $HomeDirPath\$user if ($pathtest -eq $true) { # Path is true, defining the right ACL to the right folder $path = "$HomeDirPath\$user" Write-Host -ForegroundColor Green "Ok, path exists on $pathtest for $user" $rule = new-object System.Security.AccessControl.FileSystemAccessRule($Principal, $Right, "ContainerInherit,ObjectInherit", "none", "Allow") $ACL = Get-Acl $path $ACL.setaccessrule($rule) Set-Acl $path $ACL Write-Host -ForegroundColor Green "Succesfully set permissions for $user" # Try and set the user as the owner of the Folder Add-Type $AdjustTokenPrivileges $Folder = Get-Item $Path [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) Write-Host -ForegroundColor Green "Succesfully set the owner for $Path to $user" } #End the If Statement Else { # Path is false, logging to the log file Write-Host -ForegroundColor Cyan "Path for $user does not exist on destination path" Write-Output "$pathtest does not exist for $user" >> $logpath $path = "$HomeDirPath\$user" New-Item -Path "$path" -ItemType directory Write-Host -ForegroundColor Green "Created root user directory for $user in $HomeDirPath" # Create Desktop path if it doesn't already exist If(!(Test-Path -path "$path\Desktop")) { New-Item -Path "$path\Desktop" -ItemType directory #Set the Owner for Desktop Add-Type $AdjustTokenPrivileges $Folder = Get-Item "$path\Desktop" [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the If Statement # Create Documents path if it doesn't already exist If(!(Test-Path -path "$path\Documents")) { New-Item -Path "$path\Documents" -ItemType directory #Set the Owner for Documents Add-Type $AdjustTokenPrivileges $Folder = Get-Item "$Path\Documents" [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the If Statement # Create Favorites path if it doesn't already exist If(!(Test-Path -Path "$path\Favorites")) { New-Item -Path "$path\Favorites" -ItemType directory #Set the Owner for Favorites Add-Type $AdjustTokenPrivileges $Folder = Get-Item "$Path\Favorites" [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the Else Statement # Path is true, defining the right ACL to the right folder $path = "$HomeDirPath\$user" Write-Host -ForegroundColor Green "Ok, path exists on $path for $user" $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Principal, $Right, "ContainerInherit,ObjectInherit", "none", "Allow") $ACL = Get-Acl $path $ACL.SetAccessRule($rule) Set-Acl $path $ACL Write-Host -ForegroundColor Green "Succesfully set permissions for $user" # Try and set the user as the owner of the Folder Add-Type $AdjustTokenPrivileges $Folder = Get-Item $Path [void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") [void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") [void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") $NewOwnerACL = New-Object System.Security.AccessControl.DirectorySecurity $NewOwner = New-Object System.Security.Principal.NTAccount($domain, $user) $NewOwnerACL.SetOwner($NewOwner) $Folder.SetAccessControl($NewOwnerACL) } #End the Else Statement Write-Host -ForegroundColor Magenta "The script had a problem as $user didn't have a folder, but we've created it now and set the correct permissions." } #End the Loop ##################################### ### Stop PS Session to the DC ### ##################################### Remove-PSSession -ComputerName $DC -ErrorAction SilentlyContinue ##################################### ### Clear Variables ### ##################################### Remove-Variable -Name * -ErrorAction SilentlyContinue ##################################### ### Post Completion Msg ### ##################################### Write-Host -ForegroundColor White -BackgroundColor DarkGreen "***************************************************************************************************************" Write-Host -ForegroundColor White -BackgroundColor DarkGreen " Script has now completed, please check all Folders and permissions have been created as expected! " Write-Host -ForegroundColor White -BackgroundColor DarkGreen "***************************************************************************************************************" [Console]::ResetColor()

I know its not what you're asking, but from a security perspective, I would get staff to look for newer software as Flash is completely unsupported and Adobe flash player has been EoL since circa 2020. I'd be really surprised if you can get that working properly on a fully up to date system. I work in finance now and having anything like that would have alarm bells ringing and questions asked immediately!

On the app installs, did you say you are mixing w32 and LOB? I have had these clash as the processes run simultaneous so that's why I wrap everything in w32 these days. Is the user you're signing in with allocated an Intune licence?

I assume these are Domain joined devices that you manage Hybrid? Are these going into the Computers CN in AD and your EntrID sync is targeted on a specific OU?

Sorry, just scanned the thread, I didn't see if you are deploying apps to users or to devices? I only ever assign apps to devices as that's the only reliable way I've found if its a shared device (even as hot spares). I had no end of issues if I assigned to users, I believe best practice is to not mix up both user and computer assignment.

If these are existing domain machines, I'd rebuild. For this I prefer to use MDT and have a task sequence that flattens them, cleans up the vanilla system and preloads some of the apps using PSADK (which is what we use in Intune) so it speeds up the builds. I waste too much time waiting for apps to install from the cloud so prefer to have tighter control over the process. Using the autopilot and ESPs to manage it once its rolling is fairly straightforward and well documented. I did have a TS in MDT that fired off an onboarding PS script which initiated the process but I never got around to finishing it properly!

Sorry that didn't work what where the issues you came across when trying to set the policies via PS?

No worries, I've been here a long time and not posted much so its great to be able to contribute!

This was the first time I used it for a PS script, I'm old now and am used to doing it all by hand!

You should be able to Powershell this to loop through each channel and configure this. I'd be surprised if this setting isn't covered. If I get a chance I'll see what I can knock up A quick AI search is giving # Connect to Teams Connect-MicrosoftTeams # Replace with your actual team and channel ID/name $teamId = "your-team-id" $channelId = "your-channel-id" # Set channel moderation to allow only moderators to post Set-PnPTeamsChannel -Team $teamId -Identity $channelId -UserNewMessageRestriction OnlyModerators So you could wrap this in a loop and then run Set-PnPTeamsChannel against each team. EDIT: so a quick copilot result would be :- (please test first!!) # Install and import Microsoft Teams PowerShell module Install-Module -Name PowerShellGet -Force Install-Module -Name MicrosoftTeams -Force Import-Module MicrosoftTeams # Connect to Microsoft Teams Connect-MicrosoftTeams # Get all teams $teams = Get-Team # Loop through each team and update moderation settings foreach ($team in $teams) { Write-Host "Updating moderation settings for: $($team.DisplayName)" Set-Team -GroupId $team.GroupId -AllowUserEditMessages $false -AllowUserDeleteMessages $false -AllowOwnerDeleteMessages $true } Write-Host "Moderation settings updated to allow only owners to manage messages."

Not sure if its still an issue for you but as @Davit2005 said, you need to put each AP in as with unifi each AP is a RADIUS client, although you can put them in as a range rather than individually (best set on a reserved IP address in DHCP)

Hi, I've been asked to develop a tool for Student BYOD program (Student owned and provided) so that the students check if their device has successfully enrolled in Intune. I've written the tool using PS with a small windows form, I have it looking at the prerequisites and it adjusts some minor settings but the bit I'm struggling on is how can I monitor and display the enrolment state of the device in Intune as the end user to the end user? Does anyone know of something locally on the device that I can check against either in the Reg/Event Viewer etc? The whole idea that SLT want is that the student enrols their own device over the summer holiday themselves and, following a pilot last year, many thought they'd enrolled their device but actually hadn't. We are trying to avoid a repeat of this and make the process more interactive and not consume time at the start of term. At present all I have is it opening the Windows store on the company portal, then the user will manually install the company portal and then initiate the enrolment through this as per the MS BYOD suggested route here Any help or suggestions as to how we can achieve anything like this or again if its not achievable. Open to any feedback!

Did you verify the domain in 365? If so no one can take it without updating the MS TXT code in your DNS record.

We stopped redirecting it to and then excluded the directories from roaming profiles to stop the bloat. We also had a startup script to clear the cache folders on c:\Users\*\Appdata\Teams etc of all the cache folders as they where filling with bloat from Teams. Not had any adverse effects yet!

We use the Epson iProjection app as we have Epson projectors that are compatible. The projectors are wired onto our BYOD LAN as the staff also have MS Surfaces that are MDM controlled so don't need to be on the school LAN. This way the teachers can still control whats projected. We did suggest the teams screen share but they weren't impressed with that as an option because not everyone uses Teams?!

After a recent procurement exercise Senso.cloud won hands down for us, ticked all of the boxes on our specification and they where by far the best company to work with. We worked with Chris Spink at Senso, really decent guy and went out of his way for us!