edubri

So for example my last xml post in here how should it look like ?

Tried today I just cant seem to get it to work I get this error and my latest xml is <RuleCollection Type="Exe" EnforcementMode="Enabled" Id="{A1B2C3D4-E5F6-47AA-8899-112233445566}"> <FilePathRule Id="{11111111-2222-3333-4444-555555555555}" Name="Allow Administrators All" Description=""> <UserOrGroupSid>S-1-5-32-544</UserOrGroupSid> <Conditions> <FilePathCondition Path="*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{66666666-7777-8888-9999-AAAAAAAAAAAA}" Name="Allow Windows Directory" Description=""> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{BBBBBBBB-CCCC-DDDD-EEEE-FFFFFFFFFFFF}" Name="Allow Program Files" Description=""> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{12345678-90AB-CDEF-1234-567890ABCDEF}" Name="Allow Program Files x86" Description=""> <Conditions> <FilePathCondition Path="%PROGRAMFILES(x86)%\*" /> </Conditions> <Action>Allow</Action> </FilePathRule> <FilePathRule Id="{ABCDEFAB-CDEF-ABCD-EFAB-CDEFABCDEFAB}" Name="Allow Homemode" Description=""> <Conditions> <FilePathCondition Path="C:\ProgramData\Homemode\Homemode.exe" /> </Conditions> <Action>Allow</Action> </FilePathRule> </RuleCollection> I've spent so much time trying to get this to work The applocker service is running on my text client machine The version of windows is 11 - Education Is there anything I'm missing? other than my sanity lol

Cheers everyone not able to look at this today - but im hoping i can get this working

Thanks for this just trying this

T I guess i could but i think i would face same issue with XML being compatible with the appolocker CSP - its kinder driving me mad - Ive even tried a powershell app but that didn't work - If i had WDAC on the tenancy I feel it coudl be achieved that way

Thanks for this however it doesnt stop a user from copying an exe from USB, or network share or running a exe from downloads etc . What it does it blocks installing exe.msi software from the internet is this enough ? I think Applocker or something needs to be in place for this?

No matter what I try I cant get the CSP for applocker working I have got ASR rules running I have the scripts blocked in Education portal I just would like to block EXE's from running outside their usual locations like a group policy applocker or in Intune is it less of an issue? The laptop is running applocker service Its a Win 11 Education laptop I've tried so many variants of the original XML script and I just cant get it to work. Has anyone had any luck with getting this working? Thanks

Microsoft Deployment Toolkit (MDT) - Immediate Retirement Notice - Configuration Manager | Microsoft Learn Here suggests it will no longer recieve updates, fixes or support, so i suspect soon it will stop working

We are in a halfway house with regards to our devices, we have some in Intune and we have on premise, with MDT basically gone, how are people re-imaging on premise devices these days ? Intune for clearing a device is fine using wipe. which got me thinking about maybe using hybrid for the on premise devices - we could use that for re-image using wipe, and have all the apps sent out via groups in intune. Its just a thought at the moment has anyone tried this ? Biggest thing really is we need an option for MDT replacement, don't really want to go down the SCCM route. If anyone has any suggestions for thsi it would be great thanks

We prob going to go to Veeam Vault

I may have had a lightbulb moment while writing this up - i think i need to push out the service to run - this could be it

Hi all, I've been having a lot of (non)fun trying to block exe's The education intune portal is able to stop powershell, cmd etc, I got ASR stopping most things other than exe's as there isnt anything there i can see that can stop exe's. I've tried a XML applocker in creating a policy ./Device/Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/EXE/Policy using this <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <!-- Baseline allow: Windows folder for Everyone --> <FilePathRule Id="11111111-1111-1111-1111-111111111111" Name="Allow - Windows Folder (Everyone)" Description="Baseline allow so Windows binaries run" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <!-- Baseline allow: Program Files (64-bit) for Everyone --> <FilePathRule Id="22222222-2222-2222-2222-222222222222" Name="Allow - Program Files (Everyone)" Description="Baseline allow for 64-bit Program Files" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <!-- Baseline allow: Program Files (x86) for Everyone --> <FilePathRule Id="33333333-3333-3333-3333-333333333333" Name="Allow - Program Files (x86) (Everyone)" Description="Baseline allow for 32-bit Program Files" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="C:\Program Files (x86)\*" /> </Conditions> </FilePathRule> <!-- Allow: %USERPROFILE%\Desktop\home.exe for Users --> <FilePathRule Id="44444444-4444-4444-4444-444444444444" Name="Allow - Staff Desktop home.exe (Users)" Description="Allows home.exe from the user's Desktop for Users group" UserOrGroupSid="S-1-5-32-545" Action="Allow"> <Conditions> <FilePathCondition Path="%USERPROFILE%\Desktop\home.exe" /> </Conditions> </FilePathRule> <!-- Allow: %USERPROFILE%\Desktop\Home.exe for Users --> <FilePathRule Id="55555555-5555-5555-5555-555555555555" Name="Allow - Staff Desktop Home.exe (Users)" Description="Allows Home.exe from the user's Desktop for Users group" UserOrGroupSid="S-1-5-32-545" Action="Allow"> <Conditions> <FilePathCondition Path="%USERPROFILE%\Desktop\Home.exe" /> </Conditions> </FilePathRule> <!-- Admin exemption: allow EVERYTHING for local Administrators --> <FilePathRule Id="66666666-6666-6666-6666-666666666666" Name="Allow - All for Administrators" Description="Full exemption for local Administrators" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> <!-- Global deny: EVERYTHING for Users (non-admins) --> <FilePathRule Id="77777777-7777-7777-7777-777777777777" Name="Deny - All for Users" Description="Blocks all EXEs for Users unless explicitly allowed above" UserOrGroupSid="S-1-5-32-545" Action="Deny"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> </AppLockerPolicy> I can't get this working in my test group /environment, am I missing something ? I want it to work simliar to the old group policy applocker I get error code -2016345596 Is there a better way in intune to achieve this ? Thanks all

Brilliant thanks

Thanks I have used this - I want to also remove the "Microsoft 365 Copilot" shortcut also that appears - have you had any joy with that ?

Hi all, I'm looking for a way to remove the Solitaire & Casual Games Microsoft as well as Xbox as well as Copilot on student profiles and not getting much joy, has anyone had any joy in removing these in Intune? Many thanks Brian

I'm currently testing this right now - I've just got hide C: on, I've inherited a lot of settings in group policy that I'm looking through - it looks like there are other measures in place that prevent access to c:\ drive as well not sure yet, although it let me create the test student onedrive. i on the c:\ drive (i did create a exe rule in applocker for students under this path) My plan is for a while have students use old folder redirection and onedrive - I can't cut off the old method just yet

I know I'm dragging up an old post - however I'm in this situation myself - need to have the C:\ drive blocked but blocking it stops OneDrive. Any advice would be great in the best way of doing this - thanks

Hi all, I want to move our folder redirection documents over to onedrive from being on the server for our users, we also have a shared start menu and shared desktop on the Folder redirection. All which i want to move over Has anyone had much success with this ? and what steps did they do in order to achieve this. I've had a test account which only seems to work if there was no folder redirection in first place - its the moving it that seems to be the issue also is it possible to have a shared start menu and desktop that we can add shortcuts to like how the current setup is. Many thanks B

Thanks I've decided to go down a Hybrid solution, using On Premise AD using Intune connector - Still in testing phase at moment

Hi all, one of my tasks is to move windows based machines into intune, I'm currently building policies etc etc mirroring Group policy. The main push really is imaging. Im currently getting the hardware hashes etc and putting them in for Admin staff, with the idea of admin becoming completely in cloud. The question I have is I will also want to have teachers and students hybrid, and Im not sure best way on how to do this, will i need to install the intune connector? do I just add them all into intune but keep some of the group policies ? as I say main reason is for the imaging function side esp true for Teachers and Students, as Teachers and Students don't yet have 1:1 devices. Many thanks B

I also tried packaged app as well I've had no joy - its driven me up the wall today lol !

Unfortunately we don't have AB tutor

Has anyone had any success with this? I've tried with Applocker and GP and it doesn't appear to block the calculator for our exam accounts : also in user config > admin templates I have calc.exe and calc blocked in group policy. Other than uninstalling this Im running out of ideas I've blocked C:\Program Files\WindowsApps\Microsoft.WindowsCalculator* and C:\Windows\System32\calc.exe with a deny access for a student exams group using Applocker. Im thinking about a regedit disable calculator maybe? Spent most of today testing this with no joy - any advice would be great thanks cheers B

Thanks guys, its going to be a summer job now basically need to make DHCP as failover on the DC's rather than split scope, on top of that I need to burn DC 1. Defo need to do some planning with the scopes checking with range is handled by which DHCP server

Hi All, I've inherited a split scope DHCP from my predecessor, which looks like a complete nightmare to unpick, I basically need to decommission a DC and put a new one in place, at the moment DC2 handles some of the DHCP and so does DC1, looking at the ranges and there is so much there very hard to work out which DC is handling which range unless I go into it manually to see what's excluded on one compared to the other, There's at least 60 + scopes split across both. Does anyone know of a quick way of moving this all over. Or a safe way of doing this, I discovered this over Easter holidays! only my 3rd week so I'm discovering many things that i want to fix! I basically want failover DHCP across the 2 servers which I have seen much more than this Thanks everyone