Roaming Chrome settings with Intune MDM

In the Modern Management scenario, Chrome’s best method of roaming settings is your Google Profile, tied to your google account.

For those of you for whom this is not a good option, allow me to present a simple and elegant alternative through OMA-URI. First, ensure you have loaded an ADMX backed template for Chrome and grabbed the Chrome MSI from Google.

Then, add a new Device Configuration Profile with two Custom OMA-URI’s:

The first custom OMA URI you should configure:

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/RoamingProfileSupportEnabled

RoamingProfileSupportEnabled enables roaming of your chrome settings, preferences, etc and disables all other roaming features of Chrome.

The second custom OMA URI you should configure:

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/RoamingProfileLocation

As you may have noticed, I’m using an environment variable here called ${DOCUMENTS}. This variable is a google-specific variable, you can’t use environment variables here like %APPDATA%, if you want to roam to a different location, use my Ultimate redirection script

Ultimate folder redirection for Onedrive, Teams and Sharepoint

In the post-Onedrivemapper era where we have Files On Demand, there is still room for improvement in client side configuration of Onedrive for Business. Onedrive Known Folders isn’t up to par yet, doesn’t support any customization and there are situations where I want to be able to redirect local folders to other places than Onedrive like Teams or Sharepoint.

Therefore I present to you “Invoke-O4BAutoMount“; the ultimate Onedrive/Sharepoint/Teams sync and redirect solution in modern workplace scenario’s, no WebDav, just the NSG Onedrive Client and native Intune Management Extension:

  • Single PS script
  • User does NOT have to be an Admin
  • Per special folder configuration of redirection settings
  • Extra (symlink) redirection for ANY folder (specific appdata subfolders anyone?)
  • Automatically runs at logon and/or at specified intervals
  • Can be unassigned (removing a user from the target group in Intune stops the script from running)
  • Can redirect to subfolders, even nested
  • Handles automatic creation of any folders
  • Supports variables in paths
  • Registers Environment Variables for the new locations if you configure it to
  • Can hide target folders (appdata likes to hide)
  • Multi-user support (Windows Virtual Desktop / Server 2019)

How to use in 8 easy steps:

1. Configure the tenant ID and how often you want to script to run:

2. Then get the ODOpen URL of any libraries you wish to sync:

Use Chrome or Edge, do not use Internet Explorer!

3. paste the URL into the script in the syncUrl section and configure the site and list titles:

User experience: The site and list title will show in explorer like “siteTitle – listTitle”

4. if you only need Onedrive and don’t want to sync any sharepoint/teams libraries, configure like this:

5. Pick which folders you want to redirect, and where you want to redirect them to:

This example redirects the My Documents and Desktop folders to the user’s Onedrive, and the Pictures folder to a subfolder in a teamsite called “AutoMapTestTeam”, the subfolder is automatically created using the user’s email address.

6. Configure any special folders that normally cannot be redirected

This example will redirect the local Skype folderin APPDATA to a user’s Onedrive, thus roaming Skype contacts and profile information to Onedrive

7. Upload to Intune as a PowerShell script:

Make sure you set it to 64 bit AND to run as system instead of the user’s logged on credentials

8. Deploy to your users (you can also deploy to machines, but then you need to set autoRerunMinutes to > 0 and it might not run at logon)

Further recommendations

This script assumes you’ve already Configured Onedrive to automatically log the user in and I strongly recommend to run Onedrive in Per Machine Mode for faster config.

I haven’t extensively tested running this script when multiple users are active on a device at the same time (ie: citrix, wvd, remoteapp); I’d love to hear about your results!

Thanks and inspiration

Michael Mardahl for giving me the ODOPEN and IME hack examples

Aaron Parker for writing on Folder Redirection with PowerShell

Justin Murray for showing me how to impersonate another user

Per Larsen for writing on silent config / admx stuff regarding Onedrive

Olivier Kieselbach for his three deep dives on the Intune Management Extension

Notice

As always, this is a free script and no guarantees are given, use at your own risk.

Troubleshooting

Log locations:

c:\\users\\appdata\\local\\temp\\Invoke-O4BAutoMount.log for the user portion.

C:\\Windows\\Temp\\Invoke-O4BAutoMount.log for the SYSTEM portion

If the script isn’t running at all (no log file), check the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Policies subkeys for error info from the script. Make sure the config section of the script is correct or it won’t run.

Also check Olivier’s deep dives for general troubleshooting of Powershell scripts with Intune

Moving to Onedrive Per machine mode in intune

The Onedrive Per Machine install is the future recommended method of Microsoft to install and deploy Onedrive for Business.

Especially in multi-user / shared computer scenario’s Onedrive is much faster in Per Machine mode.

Here is a quick tutorial on deploying Onedrive in Per Machine mode to your Windows 10 Intune / MDM users, keep in mind:

  • no user interaction is required
  • updates etc still work in the same manner
  • existing data/accounts are adopted automatically
  1. Start by downloading the latest Onedrive.exe from Microsoft to e.g. C:\temp\Onedrive Per Machine\Source
  2. Download the IntuneWinAppUtil.exe from Microsoft
  3. Doubleclick IntuneWinAppUtil.exe
  4. Follow the prompts, e.g.:
  5. Create a new Windows App (win32) in Intune under Client apps and configure ‘Program’ as follows:
    1. Install command: OnedriveSetup.exe /allusers
    2. Uninstall command: OnedriveSetup.exe /uninstall
    3. Install behavior: System
  6. Configure Requirements as follows:
    • 32-bit is, btw, also fine if you for some reason have 32 bit W10 machines
  7. Manually configure your detection rule as follows:
    • If you intend to manually patch (which I don’t recommend), make sure you actually check the precise version here

12. Deploy to all computers in your environment 🙂

Onedrive ADMX Recommendations

For reference, these are my recommended Intune settings when deploying and/or managing Onedrive for Business.

Create a Device Configuration Profile

Configure the following policy settings:

  1. Allow syncing OneDrive accounts for only specific organizations
  2. Enable OneDrive Files On-Demand
    • Enabled
  3. Silently configure OneDrive using the primary Windows account
    • Enabled
  4. The maximum size of a user’s OneDrive for Business before they will be prompted to choose which folders are downloaded
    • Enabled
    • Linked to your tenant and set to 25 GB (25600MB), in multi-user scenario’s lower this value
  5. Set the default location for the OneDrive folder
    • Disabled
  6. Prevent users from changing the location of their OneDrive folder
    • Enabled
    • Value 1 for your tenant ID
  7. Prevent users from synchronizing personal OneDrive accounts
    • Enabled

Simplify Logon scripts in Intune without Schedules

Intune does not have a native solution for logon scripts. The community has designed some interesting solutions to this problem using the Intune Management Extension, such as Nicola’s Azure storage based method, Michael Mardahl’s IME reset method and my own hidden vbscript scheduled task method.

The problem with all these solutions is that they rely on scheduled tasks. This is not the most reliable method as the user can easily influence it, and it usually does not support uninstalling or unassigning the script unless you write a specific script for that, assign it to the user, etc yada yada.

This solution can run at logon, at set intervals or both and supports ANY script you write in Intune. invoke-asIntuneLogonScript on Git

Upload to Intune as usual, and set the properties as follows and assign to your users:

Edit: doesn’t happen often that people create the same thing on the same day, but Michael wrote the almost exact same thing so he’s not using scheduled tasks anymore either 🙂

Uploading a file to onedrive for business with Python

For a Raspberry Pi project that’ll take a number of pictures of my house for an as of yet unknown period of time I’m sharing my very first Python script with you.

All it has to do is upload all files from a given folder to a given Onedrive for Business path, as obviously the Pi can’t store much data on its tiny SD card. You’ll need to register an azure ad app and give it the appropriate permissions. You’ll have to consent to the application once (url format = https://login.microsoftonline.com/common/adminconsent?client_id={client-id}).

Then the schedule below Python script on your Pi, it will retrieve an Azure token without the need for external libraries, parse the directory and upload everything in it to the given onedrive for business URL, simple as that! It can also be used for Sharepoint or Teams by adjusting the path.

import requests 
import json
directory = r"c:\temp\uploads"
data = {'grant_type':"client_credentials", 
        'resource':"https://graph.microsoft.com", 
        'client_id':'XXXXX', 
        'client_secret':'XXXXX'} 
URL = "https://login.windows.net/YOURTENANTDOMAINNAME/oauth2/token?api-version=1.0"
r = requests.post(url = URL, data = data) 
j = json.loads(r.text)
TOKEN = j["access_token"]
URL = "https://graph.microsoft.com/v1.0/users/YOURONEDRIVEUSERNAME/drive/root:/fotos/HouseHistory"
headers={'Authorization': "Bearer " + TOKEN}
r = requests.get(URL, headers=headers)
j = json.loads(r.text)
print("Uploading file(s) to "+URL)
for root, dirs, files in os.walk(directory):
    for filename in files:
        filepath = os.path.join(root,filename)
        print("Uploading "+filename+"....")
        fileHandle = open(filepath, 'rb')
        r = requests.put(URL+"/"+filename+":/content", data=fileHandle, headers=headers)
        fileHandle.close()
        if r.status_code == 200 or r.status_code == 201:
            #remove folder contents
            print("succeeded, removing original file...")
            os.remove(os.path.join(root, filename)) 
print("Script completed")
raise SystemExit

Import a PBIX to PowerBI using PowerShell

Reading up on the PowerBI API to import PBIX files to the PowerBI service and an example on the actual request I decided to write a PowerShell function to import a PowerBI PBIX file to the PowerBI service.

The PowerBI Import API is quite specific and kept giving me 400’s like:

  • “Bad Request” with no details
  • UnknownError pbi.error exceptionCulprit 1 (loved this one)
  • MultiPartMimeStreamFormatException
  • RequestedFileIsEncryptedOrCorrupted

Eventually I figured out how to import my reports directly into PowerBI, so to help you automate importing your reports into workspaces or directly to customers using PowerShell, I’ll share my PowerShell function with you:

GitLab: Import-PBIXToPowerBI.ps1

Azure AD sign in and audit log retention

Often we, as cloud admins, need our audit or sign in logs. Usually, we need real-time data because, for example, we’re debugging why that one user has conditional access issues. But sometimes, we need to go back further than 30 days. And that is not something Azure does by default, but can be enabled:


Our options when exporting logs are limited to a Storage account, Log Analytics or an Event Hub. All these options offer multiple extraction methods to cover your transport needs to other systems. The default retention period is then forever, which is nice as we might need audit info going back a bit as hacks are usually discovered after about 206 days.

If you don’t have specific tools or requirements, I recommend setting up a Log Analytics workspace and connecting that to Azure AD:

Whichever method you choose, a P1 or P2 license is required. You only need a single license for the entire tenant when using the export audit / singin log functionality of AzureAD. Once configured, the Logs option directly bring you to the Log Analytics workspace search results:

I’ve briefly shown how to configure AzureAD to send audit and sign in logs to Log Analytics so you can go back further than 30 days. Stay tuned for the next post that will utilize these logs to dive deeper into Guest User activity.

Devices that lack a bitlocker recovery key in AzureAD

With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.

But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.

Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):

GitLab source download link

Office 365, Azure, Enterprise Mobility and DevOps