Search the Community

Looking to reach out to anyone in schools in wales with experience in using the hwb provided Intune offering to replace local AD. Ideally looking to find out what the painpoints are, any lessons to be learnt, any regrets etc but also any possitives.

I’d like to know about other schools’ experiences migrating from on-premise file storage to OneDrive/SharePoint. Did you move to OneDrive user profiles? How do your user profiles work? Are they 100% cloud only? Currently we store on a NAS (all the usual file server features) and folder redirection. How do you handle the key Downloads/Pictures/Music? For those with apps like Adobe/Unity, anything to be aware of? Currently on AD/domain-joined so not Intune joined just yet. I am in the position to trial this with a small set of users, which will also tie in with an Intune migration eventually. Thanks.

Using Autopilot Group Tags + Dynamic Groups (Intune) Here’s a guide on something I’ve been working on around Intune, Dynamic Groups, and Autopilot. With MDT effectively reaching end of life, I wanted to put something in place that could act as a solid replacement and also set the groundwork for how we use Autopilot going forward. This all started while looking into Group Tags (OrderID) — I discovered the character limit is 2048, which opens things up quite a bit. From there, I started experimenting with more structured tagging and dynamic grouping. Where to set the Group Tag Just to clarify (as this wasn’t obvious at first), Group Tags are set in the Intune portal here: Devices → Windows → Enrollment → Devices Select your device Click Edit Populate the Group Tag field That’s the value the dynamic group queries will pick up and evaluate. The basic idea Instead of manually putting devices into groups, just use the Autopilot Group Tag (OrderID) to store useful info about the device, then build dynamic groups off that. Once it’s set up properly, everything just sorts itself. Tagging devices When importing devices into Autopilot (or after), set a tag like this: dept=SCI|role=Teacher|site=SiteA|building=BlockA|room=LAB1|dtype=LAP|os=WIN It looks a bit heavy at first, but it lets you store everything in one place: department role location device type Dynamic groups You can then create dynamic groups that match against any part of that tag. Example: all teacher devices device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\brole=Teacher\\b") Example: department device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\bdept=SCI\\b") Example: room device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\broom=LAB1\\b") What this gives you Once those groups exist, you just assign: apps policies configs …and devices land in the right place automatically when they enrol. No more dragging devices into groups. Slightly less obvious bit (worth doing) While testing, I came across something really useful — if you add the following as an owner of your dynamic group: Intune Autopilot ConfidentialClient …it helps the group behave more like an authoritative source. Why this helps Without it: People can still manually fiddle with group membership Devices can drift away from your tagging logic With it: The group effectively becomes “hands off” Membership stays driven by Autopilot + your tags Devices stay correctly associated, even after things like an Autopilot reset Things to watch Be consistent with your tag format (biggest one) Dynamic queries must match values exactly Regex needs testing before rollout Keep tags readable — easy to overcomplicate Simple vs structured tags You can do this: Staff-Laptop …but you lose flexibility. Structured tags like: dept=SCI|role=Teacher|room=LAB1 give you much more control without needing loads of extra groups. Final thoughts Once it’s set up properly, it’s one of those “why didn’t I do this earlier” things. Devices get: the right apps the right policies the right config …just based on how they’re tagged. It would be great if there was a proper tag generator or database tool for this, as it’d make maintaining consistency much easier. At the moment I’ve just been using a Copilot-built Excel-style lookup, which works but can be a bit slow. ✅ Hopefully this helps someone — happy to share more examples or what I’ve tested if useful 👍

Hi, We've run into a few challenges when configuring (self-deploying) intune devices for shared computer labs, and I was hoping to get some advice from those who have achieved this. We've learned the hard way that certain policies just don't work as expected on machines that are in self deployment mode. For example, Microsoft Office activation fails, and OneDrive doesn't automatically log in. While we've configured many of these settings for devices rather than users, it's still not applying. Given this, what’s the best approach for setting up devices for shared student use, where no single user "owns" the device? If we were to revert to user provisioning, it seems like we'd still need a primary owner, which isn't ideal in this case. What solutions have worked for your student labs? Thanks

We received two models of HP's from the DFE over the pandemic. The HP 250 G7 we had no problems joining to intune but HP 255 G7 model is failing with the error code 0x800705b4 on the securing your hardware stage. I understand this can point to an error with the TPM chip but the model does have a TPM 2.0 chip.I have created a blank autopilot profile that is assigned no compliance or config profiles but I still get the same error. I have bypassed our firewall/filter to rule out an error with the internet requests being blocked.Any suggestions to get around this would be greatly appreciated!

Hi all. Had a breakthrough today. Went full azure, Intune and autopilot last year. All has been good apart from one thing... no native logon script support. We've tried all the janky methods and settled on Task Scheduler for some time, but it's unreliable. Queue last week, I thought 'There must be a better way!' Lo and behold, there is. I've also not seen anyone else try this, not even in obscure forums deep on the internet (I tried everything to find a good method before!) so this may be the first documented method for this and it's also the BEST way hands down. 1. Firstly, you need to configure Logon Scripts in Local Group Policy on a test/admin PC, by going to: User Configuration > Policies > Windows Settings > Scripts. 2. Add all your logon scripts in here, the same way you used to when you managed your site with Group Policy (except locally) then hit apply. 3. Once you manually add those logon scripts via local GP on a test machine, it will create and populate a folder in "C:\Windows\System32" called "GroupPolicy" 4. Copy the entire "GroupPolicy" folder somewhere else. I copied to Desktop and put it into a folder called "LogonScriptsApp" 5. Open the "GroupPolicy" folder you copied off and make sure the scripts you added can be found in "GroupPolicy\User\Scripts\Logon" if not, move them into this folder. 6. If you had to manually add the scripts to the "Logon" folder, navigate to "GroupPolicy\User\Scripts" and open the file "psscripts.ini" 7. Ensure the .ini file is laid out in this format (I have called the scripts "yourscript1" and "yourscript2" for the purpose of the demonstration): [Logon]0CmdLine=yourscript1.ps10Parameters=1CmdLine=yourscript2.ps11Parameters= 8. As you can see, it should just say CmdLine=*scriptname* - if it has a path before the name of the script, it's not looking in the "Logon" folder discussed above. It must be looking in the Logon directory because we are going to wrap all of this into a Win32 app. 9. If you need to, once those scripts are copied into the "Logon" folder, edit the .ini file and ensure there isn't a path string before the script name and then save the .ini file. 10. Now, you need to make a PowerShell script that will copy all the files from the script root into the "Windows\System32" folder and create/replace the "GroupPolicy" folder and all it's contents, taking ownership of it and setting permissions to allow the file replace to take place. Here is the script below I used to do this, you can copy this exactly as is: # Take ownership and set full control permissions for 'Everyone' on the GroupPolicy folder$destinationFolder = "$env:windir\System32\GroupPolicy"takeown /f $destinationFolder /r /d yicacls $destinationFolder /grant Everyone:(OI)(CI)F /t# Define the source folder based on the script's location$sourceFolder = Join-Path -Path $PSScriptRoot -ChildPath "GroupPolicy"# Use robocopy to mirror the directory structure and files, replacing the destination contentsrobocopy $sourceFolder $destinationFolder /MIR /COPYALL /R:5 /W:1$GroupPolicyFolder = "C:\Windows\System32\GroupPolicy"$acl = Get-Acl $GroupPolicyFolder$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","Allow")$acl.SetAccessRule($perms)Set-Acl $GroupPolicyFolder $acl 11. Save this script as "install.ps1" and put it into the "LogonScriptsApp" folder on the Desktop (Which should also contain the copied off "GroupPolicy" folder and all it's contents as discussed earlier) 12. Now use the win32 app packaging tool to package the app. The source folder is the "LogonScriptsApp" folder on the Desktop and the setup file is the script we just saved as "install.ps1" 13. Upload the new app to Intune, name it etc. and then use this for the install command: %windir%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "install.ps1" This is super important because if you don't run PowerShell from the "sysnative" directory, the script will run and move the files into the SysWOW64 folder instead of System32 because of file redirection restrictions in Windows. 14. Ensure you deploy in system context and not user and also in the 64 bit context, then use one of the script files in the "Logon" folder as the detection rule. 15. You will now have fully native logon scripts using local GP on every machine you deploy to. This method simply uses the native logon scripts functionality from Local Group Policy/Group Policy and so is very reliable. So far, for us it has worked every single time. I really hope this helps somebody and if you have any questions please ask.

Hi, Any AutoPilot experts out there I can chat with either via email/dm or phone? Many thanks Gareth

Hi All, Firstly, thank you for checking out my query and thank you in advance for any input you may have. I am looking for a little advice if possible regarding Office365 and permitting mobile phones to only be permitted access to Exchange and Teams. We will likely need to at some point enroll them into intune device management at some point, however as they are iOS this will mean factory resetting the devices thus this is not acceptable at present. I would like to allow certain users the ability to add exchange email and teams to their mobile device, blocking access to all other paps, I particularly wish to block access to Sharepoint or onedrive on these mobile devices. I currently have two core conditional access policies which are assigned to all users (with exclusions): 1. Require Compliant Device for ALL Apps. 2. Require MFA for ALL Apps. The mobile users who require email and teams on their mobile device are excluded from the policy (1) requiring compliant device. Is it my understanding that I should now create two new CA policies assigned to the mobile users: 1.CA policy requiring a compliant device for ALL apps with the exception of exchange and teams. This should then block access to anything other than exchange or teams from the mobile devices. 2. CA policy targetting Android & iOS forcing MFA, Approved Apps & App Protection Policy I have an app protection policy for iOS and Android, enfocing a password for apps and blocking copy and paste etc. Does this sound like an acceptable way of securing these mobile devices? Any thoughts greatly appreciated. Thanks MM

Hi, Have promethean or are promethean looking to provide Intune deployment instructions for ActivInspire and the accompanying software? Thanks

A big massive thank you to Ben Whitemore! After countless hours spent researching how to bypass universal print and deploy out a network printer I found a 100% working solution. The best thing is that it is actually really simple to deploy. So... The process is the following, we are going to create a Win32 App which has all of the printer drivers and two powershell scripts, one is a install script and the other is a uninstall script. We do not edit the scripts at all and instead set all of our parameters for printer ip, driver names etc in the install command itself. 1. Create a folder wherever you want to work out of, I chose C:\Temp 2. Download IntuneWinAppUtil.exe and place it in the temp folder 3. Create a new folder in Temp called Printer (C:\Temp\Printer) 4. Create two powershell scripts in the Printer folder by copying and pasting the code below Install-printer.ps1 Uninstall-printer.ps1 5. Download the printer driver for the printer and place all the files in the C:\Temp\Printer folder, the printer driver files will be where the .inf file is 6. Find out what the printer driver name is by opening the .INF file or by installing the printer driver and getting the driver name from the list 7. Open CMD as a Administrator and run the following command cd C:\Temp\ .\IntuneWinAppUtil.exe Source Folder: C:\Temp\Printer Setup File: Install-Printer.ps1 Output Folder: C:\Temp\Printer Catalog: N We have now created the Win32 App in C:\Temp\Printer and are now going to deploy the app via Intune 8. Go to Intune Admin Center, Apps, Add a App, Win32App and select the Win32App you just made 9. Enter the Install and Uninstall command and obviously change it to your driver name, ip etc (the bits in bold) Install Command: powershell.exe -executionpolicy bypass -file .\Install-Printer.ps1 -PortName "IP_192.168.1.1" -PrinterIP "192.168.1.1" -PrinterName "Printer Colour" -DriverName "TOSHIBA Universal Printer 2" -INFFile "eSf6u.inf" Uninstall Command: powershell.exe -executionpolicy bypass -file .\Uninstall-Printer.ps1 -PrinterName "Printer Colour" 10. Set the requirements to the below: 11. Set the Detection Rule to the following but change the bold text, so at the end of the keypath needs to be the printer name and the value needs to be the printer name. Rule Type: Registry Key Path: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\Printer Colour Value Name: Name Detection Method: String Comparison Operator: Equals Value: Printer Colour 12. Set your deployment groups / users 13. Thank this post 14. Have a great day! Do you need technical advice, SharePoint migration assistance, or have general Microsoft Cloud queries? Visit Contact Us - Holker IT for expert support and guidance.

Hi everyone, I'm looking to roll out Intune across the school I work in and remove the onsite AD. I'm looking into what policies we should be applying at both a user and device level, should we just be applying the same as we have been doing using AD or do people have a tick list that they use when creating new tenants? Any help would be greatly appreciated!

Hi Guys, Has anyone managed to sucessfully replace the "Other User" text on the login screen VIA intune, so far we have tried wrapping a powershell script into a windows app, running powershell scripts. I have also tried poiting to an external source (one drive) to download the DLL file and replace it. If anyone has done this, I would greatly appreciate some help!

We recently setup a Data Collection Policy in Intune so we can see if our devices were Windows 11 Ready under Endpoint Analytics > Work from Anywhere > Windows. We had a lot of devices showing as needing a System Firmware Update so we carried these out over 24 Hours ago but they are still showing in Endpoint Analytics as requiring them. Does anyone happen to know how often these reports update and look for any changes? Had a look around Microsoft Documentation but can't seem to find any real answer.

Hi all, We are steadily moving towards Intuning our PCs - however, some of our staff when trying to browse are getting treat as Students. Looking in the web filter logs, it says the username is the PC's ip address, which indicates that this PC isn't getting authenticated. Now, if they go to something that students can't access, they get prompted to sign in, and can sign in with their credentials (their username and password as stored on local AD, not email and password as per Intune/M365), which is a solution, but i'd rather try to understand how to get Intune logins to naturally authenticate as themselves. We have a directory setup for use with Azure AD, but also have our previous directory set up with Local AD - do we have to change the order of our directories so the Azure AD one is above the IDex directory or our Local AD directory?

Hi, All, How do you go about applying content filtering via your firewall etc? Do you have the students login a second time to a captive portal of the firewall? Kind regards, Si

Hi All, Just wondering how the majority go about setting up a staff laptop? We're looking at giving our staff laptops and replacing the computers in classrooms. Up until now only a few staff have staff laptops, so we've done a solution that works but wondering what people think is best now for moving to mass laptop use. The laptops will be imaged through SCCM/MECM with drivers/software installed through the task sequence. In terms of then users using the device both in school and at home, I'm aware of the 2 options below, but wondered what people think of these and if you guys do anything different: Option 1: Following the domain build, have the staff member log on to their device. Log off of the device. IT log on as admin and load up System Properties > Advanced > User Profiles, select the staff member and convert their profile to local. With the above being done, the staff member can then log on both in school and at home. Option 2 (less ideal, best for home use only really): Following the domain build to install the relevant software, remove the device from the domain. Create a local user account on the device for the staff member to use. I'm looking to enable MECM/InTune Co-Management so that we can use this to manage laptops externally too. What process to people use if none of the above for configuring staff laptops on mass? Also - for the few staff who have laptops already, we have enabled Offline Files and sync their user area to the device, but Microsoft's offline files seems archaic and sometimes just doesn't sync. Not because the files are in conflict (edited both in school and at home) but the file shows 0bytes in the folder for example. Are there any credible alternatives to offline files to help sync staff's user areas to the devices? (They will be bitlocker drive encrypted so security shouldn't be an issue). Thanks in advance.

The basic Question is Does MDT support windows 11, i ask because when looks at the Microsoft documentation windows 11 is not listed.... is it not officially supported? Or did they forget to update the docs? https://docs.microsoft.com/en-us/mem/configmgr/mdt/release-notes#supported-platforms The reason i ask, is as we move away from SCCM to Intune, we would like a quick way to PXE and image a machine and install the Intune enrollment package (For machine that don't have an OS or need a clean install), and was wanting to use MDT. Does Microsoft plan to continue to support MDT?