Category Archives: EMS

Roaming Chrome settings with Intune MDM

In the Modern Management scenario, Chrome’s best method of roaming settings is your Google Profile, tied to your google account.

For those of you for whom this is not a good option, allow me to present a simple and elegant alternative through OMA-URI. First, ensure you have loaded an ADMX backed template for Chrome and grabbed the Chrome MSI from Google.

Then, add a new Device Configuration Profile with two Custom OMA-URI’s:

The first custom OMA URI you should configure:

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/RoamingProfileSupportEnabled

RoamingProfileSupportEnabled enables roaming of your chrome settings, preferences, etc and disables all other roaming features of Chrome.

The second custom OMA URI you should configure:

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/RoamingProfileLocation

As you may have noticed, I’m using an environment variable here called ${DOCUMENTS}. This variable is a google-specific variable, you can’t use environment variables here like %APPDATA%, if you want to roam to a different location, use my Ultimate redirection script

Ultimate folder redirection for Onedrive, Teams and Sharepoint

In the post-Onedrivemapper era where we have Files On Demand, there is still room for improvement in client side configuration of Onedrive for Business. Onedrive Known Folders isn’t up to par yet, doesn’t support any customization and there are situations where I want to be able to redirect local folders to other places than Onedrive like Teams or Sharepoint.

Therefore I present to you “Invoke-O4BAutoMount“; the ultimate Onedrive/Sharepoint/Teams sync and redirect solution in modern workplace scenario’s, no WebDav, just the NSG Onedrive Client and native Intune Management Extension:

  • Single PS script
  • User does NOT have to be an Admin
  • Per special folder configuration of redirection settings
  • Extra (symlink) redirection for ANY folder (specific appdata subfolders anyone?)
  • Automatically runs at logon and/or at specified intervals
  • Can be unassigned (removing a user from the target group in Intune stops the script from running)
  • Can redirect to subfolders, even nested
  • Handles automatic creation of any folders
  • Supports variables in paths
  • Registers Environment Variables for the new locations if you configure it to
  • Can hide target folders (appdata likes to hide)
  • Multi-user support (Windows Virtual Desktop / Server 2019)

How to use in 8 easy steps:

1. Configure the tenant ID and how often you want to script to run:

2. Then get the ODOpen URL of any libraries you wish to sync:

Use Chrome or Edge, do not use Internet Explorer!

3. paste the URL into the script in the syncUrl section and configure the site and list titles:

User experience: The site and list title will show in explorer like “siteTitle – listTitle”

4. if you only need Onedrive and don’t want to sync any sharepoint/teams libraries, configure like this:

5. Pick which folders you want to redirect, and where you want to redirect them to:

This example redirects the My Documents and Desktop folders to the user’s Onedrive, and the Pictures folder to a subfolder in a teamsite called “AutoMapTestTeam”, the subfolder is automatically created using the user’s email address.

6. Configure any special folders that normally cannot be redirected

This example will redirect the local Skype folderin APPDATA to a user’s Onedrive, thus roaming Skype contacts and profile information to Onedrive

7. Upload to Intune as a PowerShell script:

Make sure you set it to 64 bit AND to run as system instead of the user’s logged on credentials

8. Deploy to your users (you can also deploy to machines, but then you need to set autoRerunMinutes to > 0 and it might not run at logon)

Further recommendations

This script assumes you’ve already Configured Onedrive to automatically log the user in and I strongly recommend to run Onedrive in Per Machine Mode for faster config.

I haven’t extensively tested running this script when multiple users are active on a device at the same time (ie: citrix, wvd, remoteapp); I’d love to hear about your results!

Thanks and inspiration

Michael Mardahl for giving me the ODOPEN and IME hack examples

Aaron Parker for writing on Folder Redirection with PowerShell

Justin Murray for showing me how to impersonate another user

Per Larsen for writing on silent config / admx stuff regarding Onedrive

Olivier Kieselbach for his three deep dives on the Intune Management Extension

Notice

As always, this is a free script and no guarantees are given, use at your own risk.

Troubleshooting

Log locations:

c:\\users\\appdata\\local\\temp\\Invoke-O4BAutoMount.log for the user portion.

C:\\Windows\\Temp\\Invoke-O4BAutoMount.log for the SYSTEM portion

If the script isn’t running at all (no log file), check the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Policies subkeys for error info from the script. Make sure the config section of the script is correct or it won’t run.

Also check Olivier’s deep dives for general troubleshooting of Powershell scripts with Intune

Moving to Onedrive Per machine mode in intune

The Onedrive Per Machine install is the future recommended method of Microsoft to install and deploy Onedrive for Business.

Especially in multi-user / shared computer scenario’s Onedrive is much faster in Per Machine mode.

Here is a quick tutorial on deploying Onedrive in Per Machine mode to your Windows 10 Intune / MDM users, keep in mind:

  • no user interaction is required
  • updates etc still work in the same manner
  • existing data/accounts are adopted automatically
  1. Start by downloading the latest Onedrive.exe from Microsoft to e.g. C:\temp\Onedrive Per Machine\Source
  2. Download the IntuneWinAppUtil.exe from Microsoft
  3. Doubleclick IntuneWinAppUtil.exe
  4. Follow the prompts, e.g.:
  5. Create a new Windows App (win32) in Intune under Client apps and configure ‘Program’ as follows:
    1. Install command: OnedriveSetup.exe /allusers
    2. Uninstall command: OnedriveSetup.exe /uninstall
    3. Install behavior: System
  6. Configure Requirements as follows:
    • 32-bit is, btw, also fine if you for some reason have 32 bit W10 machines
  7. Manually configure your detection rule as follows:
    • If you intend to manually patch (which I don’t recommend), make sure you actually check the precise version here

12. Deploy to all computers in your environment 🙂

Devices that lack a bitlocker recovery key in AzureAD

With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.

But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.

Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):

GitLab source download link

Mapping legacy server shares in your Windows 10 MDM Intune pilot

In a Windows 10 full MDM (AzureAD+Intune) scenario, you’ll move your email, app and file workloads to Office 365 (or alternatives).

In your pilot or hybrid phase, you may still need access to certain file shares on your servers, so here’s a simple PowerShell script you can deploy using Intune Device Configuration that maps your desired share. Deploy multiple times for multiple shares (or groups of users).

It will create a shortcut in a location you define, so the mapping is always user-driven, it will automatically suggest your user’s AzureAD login as username. You can of course customize the script to your liking if you did not change your local AD upn yet.

Gitlab homehttps://gitlab.com/Lieben/assortedFunctions/blob/master/intuneServerShareMapper.ps1

Requirements:

  • Windows 10 (MDM)
  • Intune
  • Direct SMB lan connection to share

Onedrive For Business Silent Deployment, Configuration and Folder Redirection through Intune MDM for Windows 10

SUPERCEDED BY Ultimate folder redirection for Onedrive, Teams and Sharepoint

I’ve taken information from several sources and written a single “Do It All – Onedrive For Business configuration script” for the Windows 10 Modern Management (Intune MDM Azure AD Join) scenario.

The script can be deployed through Intune to your Windows 10 MDM clients and will do the following silently:

    • check latest O4B version and update to it
    • detect O4B configuration, start auto config
    • completely silent / invisible configuration with SSO
    • optionally, enable Files On Demand
    • optionally, redirect folders to Onedrive
    • optionally, copy old content

O4BClientAutoConfig + source code.

Automatically bitlocker Windows 10 MDM Intune Azure AD Joined devices

Update: in recent builds of Windows the BackupToAAD-BitLockerKeyProtector PowerShell command does most of what this used to do 🙂

I recently ran into an article by Pieter Wigleven, based on an original idea of Jan Van Meirvenne that I simply have to share, and expand upon.

When you go cloud first, and do light MDM management of your Azure AD Joined Windows 10 devices, you will likely enable a Bitlocker policy in Intune. What you’ll quickly discover, is that your policy will not automatically enforce/enable Bitlocker on non-InstantGo capable devices.

So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.

Powershell source file

enableBitlockerAndRegisterInAAD_v0.04.ps1 (right click, save as)

MSI file

enableBitlockerAndRegisterInAAd_v0.04.msi (right click, save as)

As Intune won’t let you deploy a Powershell script, I’ve also wrapped the script in an MSI file with Advanced Installer for you. What this will do;

  1. Deploy the PS1 file to the machine
  2. Register a scheduled task to run this PS1 file at logon each time
  3. Kick off the scheduled task once so a first reboot isn’t required

Advanced installer package (.aip)

enableBitlockerAndRegisterInAAD.zip (right click, save as)

Requirements

  1. Windows 10, AzureAD Joined
  2. TPM chip
  3. User should be local admin

Deploying the new Onedrive Next Generation Sync client as MSI through Intune to Windows 10

Onedrive for Business’s client, the new Next Generation Sync client, is awesome. Obviously.

So you want it on your devices, but Microsoft distributes it as .exe. Nasty, because I want to manage Windows 10 as mobile devices through Intune, and that only allowes me to distribute as MSI.

I created an MSI for Onedrive for Business’s Next Generation Client using Advanced Installer. Because I’m not allowed to redistribute Microsoft’s .exe, this MSI downloads the .exe from Microsoft’s website, it uses /silent and /takeover as installation switches. Continue reading Deploying the new Onedrive Next Generation Sync client as MSI through Intune to Windows 10

Enterprise Mobility Technical Checklist

Considering to move to an Anywhere, Anyplace, Anytime lightweight IT environment? Throwing out all local IT?

No more Domain Services, just AzureAD? Windows10, or any other mobile modern client? Here’s a short checklist I sometimes use for clients when assessing their intentions / plan:

  • Intune tenant created and policies have been set, including Conditional Access
  • All my non single MSI applications I want to deploy to my clients have been repackaged
  • All my application servers/services have been moved to SaaS or to RemoteApp or the like
  • My identities have been synchronized or copied to Azure AD
  • All users have an Intune or EMS license
  • I have enabled Azure AD automatic MDM enrollment
  • I have enabled Enterprise State Roaming in Azure AD
  • I have published my internal web sites using Azure Application Proxy and added these sites to Intune as Apps
  • DLP policies have been setup for any sensitive data types/locations in my company
  • Personal data has been migrated to Onedrive for Business
  • Group data has been moved to Office 365 Groups or Sharepoint Online

Just to get you started! 🙂

Let us extend Intune MDM msi enrollment!

So, a while back Intune got the ability to deploy native MSI’s to MDM enrolled Windows 8.1 and Windows 10 clients. No Intune client is required, which gives a really awesome out of the box experience.

However, we can only deploy single MSI’s, and we can’t patch them with MSP’s, or deploy installers that are only available as .exe.

To spare us having to repackage them, please vote on my uservoice idea to extend MDM enrollment in Intune.