The Onedrive Per Machine install is the future recommended method of Microsoft to install and deploy Onedrive for Business.
Especially in multi-user / shared computer scenario’s Onedrive is much faster in Per Machine mode.
Here is a quick tutorial on deploying Onedrive in Per Machine mode to your Windows 10 Intune / MDM users, keep in mind:
With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.
But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.
Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):
In a Windows 10 full MDM (AzureAD+Intune) scenario, you’ll move your email, app and file workloads to Office 365 (or alternatives).
In your pilot or hybrid phase, you may still need access to certain file shares on your servers, so here’s a simple PowerShell script you can deploy using Intune Device Configuration that maps your desired share. Deploy multiple times for multiple shares (or groups of users).
It will create a shortcut in a location you define, so the mapping is always user-driven, it will automatically suggest your user’s AzureAD login as username. You can of course customize the script to your liking if you did not change your local AD upn yet.
Gitlab home: https://gitlab.com/Lieben/assortedFunctions/blob/master/intuneServerShareMapper.ps1
Requirements:
SUPERCEDED BY Ultimate folder redirection for Onedrive, Teams and Sharepoint
I’ve taken information from several sources and written a single “Do It All – Onedrive For Business configuration script” for the Windows 10 Modern Management (Intune MDM Azure AD Join) scenario.
The script can be deployed through Intune to your Windows 10 MDM clients and will do the following silently:
Update: in recent builds of Windows the BackupToAAD-BitLockerKeyProtector PowerShell command does most of what this used to do 🙂
I recently ran into an article by Pieter Wigleven, based on an original idea of Jan Van Meirvenne that I simply have to share, and expand upon.
When you go cloud first, and do light MDM management of your Azure AD Joined Windows 10 devices, you will likely enable a Bitlocker policy in Intune. What you’ll quickly discover, is that your policy will not automatically enforce/enable Bitlocker on non-InstantGo capable devices.
So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.
Powershell source file
enableBitlockerAndRegisterInAAD_v0.04.ps1 (right click, save as)
MSI file
enableBitlockerAndRegisterInAAd_v0.04.msi (right click, save as)
As Intune won’t let you deploy a Powershell script, I’ve also wrapped the script in an MSI file with Advanced Installer for you. What this will do;
Advanced installer package (.aip)
enableBitlockerAndRegisterInAAD.zip (right click, save as)
Requirements