edubri

So for example my last xml post in here how should it look like ?

Tried today I just cant seem to get it to work I get this error and my latest xml is <RuleCollection Type="Exe" EnforcementMode="Enabled" Id="{A1B2C3D4-E5F6-47AA-8899-112233445566}"> <FilePathRule Id="{11111111-2222-3333-4444-555555555555}" Name="Allow Administrators All" Description=""> <UserOrGroupSid>S-1-5-32-544</UserOrGroupSid> <Conditions> <FilePathCondition Path="*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{66666666-7777-8888-9999-AAAAAAAAAAAA}" Name="Allow Windows Directory" Description=""> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{BBBBBBBB-CCCC-DDDD-EEEE-FFFFFFFFFFFF}" Name="Allow Program Files" Description=""> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{12345678-90AB-CDEF-1234-567890ABCDEF}" Name="Allow Program Files x86" Description=""> <Conditions> <FilePathCondition Path="%PROGRAMFILES(x86)%\*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{ABCDEFAB-CDEF-ABCD-EFAB-CDEFABCDEFAB}" Name="Allow Homemode" Description=""> <Conditions> <FilePathCondition Path="C:\ProgramData\Homemode\Homemode.exe" /> </Conditions> <Action>Allow</Action> </FilePathRule> </RuleCollection> I've spent so much time trying to get this to work The applocker service is running on my text client machine The version of windows is 11 - Education Is there anything I'm missing? other than my sanity lol

Cheers everyone not able to look at this today - but im hoping i can get this working

Thanks for this just trying this

T I guess i could but i think i would face same issue with XML being compatible with the appolocker CSP - its kinder driving me mad - Ive even tried a powershell app but that didn't work - If i had WDAC on the tenancy I feel it coudl be achieved that way

Thanks for this however it doesnt stop a user from copying an exe from USB, or network share or running a exe from downloads etc . What it does it blocks installing exe.msi software from the internet is this enough ? I think Applocker or something needs to be in place for this?

No matter what I try I cant get the CSP for applocker working I have got ASR rules running I have the scripts blocked in Education portal I just would like to block EXE's from running outside their usual locations like a group policy applocker or in Intune is it less of an issue? The laptop is running applocker service Its a Win 11 Education laptop I've tried so many variants of the original XML script and I just cant get it to work. Has anyone had any luck with getting this working? Thanks

Microsoft Deployment Toolkit (MDT) - Immediate Retirement Notice - Configuration Manager | Microsoft Learn Here suggests it will no longer recieve updates, fixes or support, so i suspect soon it will stop working

We are in a halfway house with regards to our devices, we have some in Intune and we have on premise, with MDT basically gone, how are people re-imaging on premise devices these days ? Intune for clearing a device is fine using wipe. which got me thinking about maybe using hybrid for the on premise devices - we could use that for re-image using wipe, and have all the apps sent out via groups in intune. Its just a thought at the moment has anyone tried this ? Biggest thing really is we need an option for MDT replacement, don't really want to go down the SCCM route. If anyone has any suggestions for thsi it would be great thanks

We prob going to go to Veeam Vault

I may have had a lightbulb moment while writing this up - i think i need to push out the service to run - this could be it

Hi all, I've been having a lot of (non)fun trying to block exe's The education intune portal is able to stop powershell, cmd etc, I got ASR stopping most things other than exe's as there isnt anything there i can see that can stop exe's. I've tried a XML applocker in creating a policy ./Device/Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/EXE/Policy using this <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <!-- Baseline allow: Windows folder for Everyone --> <FilePathRule Id="11111111-1111-1111-1111-111111111111" Name="Allow - Windows Folder (Everyone)" Description="Baseline allow so Windows binaries run" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <!-- Baseline allow: Program Files (64-bit) for Everyone --> <FilePathRule Id="22222222-2222-2222-2222-222222222222" Name="Allow - Program Files (Everyone)" Description="Baseline allow for 64-bit Program Files" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <!-- Baseline allow: Program Files (x86) for Everyone --> <FilePathRule Id="33333333-3333-3333-3333-333333333333" Name="Allow - Program Files (x86) (Everyone)" Description="Baseline allow for 32-bit Program Files" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="C:\Program Files (x86)\*" /> </Conditions> </FilePathRule> <!-- Allow: %USERPROFILE%\Desktop\home.exe for Users --> <FilePathRule Id="44444444-4444-4444-4444-444444444444" Name="Allow - Staff Desktop home.exe (Users)" Description="Allows home.exe from the user's Desktop for Users group" UserOrGroupSid="S-1-5-32-545" Action="Allow"> <Conditions> <FilePathCondition Path="%USERPROFILE%\Desktop\home.exe" /> </Conditions> </FilePathRule> <!-- Allow: %USERPROFILE%\Desktop\Home.exe for Users --> <FilePathRule Id="55555555-5555-5555-5555-555555555555" Name="Allow - Staff Desktop Home.exe (Users)" Description="Allows Home.exe from the user's Desktop for Users group" UserOrGroupSid="S-1-5-32-545" Action="Allow"> <Conditions> <FilePathCondition Path="%USERPROFILE%\Desktop\Home.exe" /> </Conditions> </FilePathRule> <!-- Admin exemption: allow EVERYTHING for local Administrators --> <FilePathRule Id="66666666-6666-6666-6666-666666666666" Name="Allow - All for Administrators" Description="Full exemption for local Administrators" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> <!-- Global deny: EVERYTHING for Users (non-admins) --> <FilePathRule Id="77777777-7777-7777-7777-777777777777" Name="Deny - All for Users" Description="Blocks all EXEs for Users unless explicitly allowed above" UserOrGroupSid="S-1-5-32-545" Action="Deny"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> </AppLockerPolicy> I can't get this working in my test group /environment, am I missing something ? I want it to work simliar to the old group policy applocker I get error code -2016345596 Is there a better way in intune to achieve this ? Thanks all

Brilliant thanks

Thanks I have used this - I want to also remove the "Microsoft 365 Copilot" shortcut also that appears - have you had any joy with that ?

Hi all, I'm looking for a way to remove the Solitaire & Casual Games Microsoft as well as Xbox as well as Copilot on student profiles and not getting much joy, has anyone had any joy in removing these in Intune? Many thanks Brian