I'm starting an effort to migrate local admin privileges to a managed tool. Since EPM is included, I'm obligated to try it out before saying CyberArk is the only way.

The environment is simple. You have you standard account and if you have local admin, you have an admin account.

So now that the audit policy has been running for a couple weeks, why do I have events like regular accounts running chrome.exe as an unmanaged elevation? Or cmd.exd having over 32k elevated events

And then I cant export the reports?

I feel like I have to be doing something wrong because this experience is just horrible.

Stop me if I'm reading this wrong, but it seems to me that in order to use any of the features in the new AutoPilot device association feature you would have to remove every single device from their box, power it on, and perform a registration and/or export of TPM data. That seems to defeat the whole point of AutoPilot, especially when you have hundreds of laptops to deploy.

Hi All,

We've recently moved to using Autopilot for all builds & are seeing some inconsistency with regional/language/keyboard settings.

I've had our service support team run through some builds specifically testing for following the same process & they are assuring me they are selecting the US, followed by Australia, which should give the intended result... However on 2 devices they tesed, one ended up correct & the other ended up giving them a En-GB keyboard layout (which throws out special character mapping on keyboard).

Is there a good guide out there for making sure we end up with correct settings for an Australian system? Would be good to make sure its correct during AUtopilot plus also enforcing it after the fact via Remediations.

Greetings Intune admins. I am setting up Autopilot and I was wondering if anyone has used the WriteToHkcuFromSystem.ps1 script with Autopilot with success.

I am still troubleshooting but it appears that it is failing.

SCCM has been my thing for years, this is new. Other apps install fine.

Thank you for your feedback.

Cross-posting from the Defender subreddit as there’s a like-minded crowd here managing similar IT stacks.

This morning, a large number of our Intune-managed Windows 11 devices displayed a toast notification saying Defender signatures were out of date. However, the Defender portal shows those devices as up to date and healthy. We’re expecting some user concern given the conflicting information.

We had an issue in August, resolved in September, where Defender was incorrectly reported as disabled due to a Windows Security Center (WSC) signal issue. That also caused Intune compliance issues, as the check for whether Defender was active relied on those signals.This feels potentially similar.

Anyone else seeing these notifications today, or noticing any corresponding changes in device compliance?

Hey Reddit,

Several users have reported getting stuck in pending driver update loops, even after rebooting their PCs. I’m not sure how to fix this, since the usual solutions I’ve tried haven’t worked.

Background on our environment:

1. We have Autopatch set up and enabled, with recommended drivers approved automatically. This worked well until about a month ago. We’re not sure whether the drivers released through Intune are causing the issue.

2. I paused updates for HP drivers, which fixed the issue for those drivers, but the Intel drivers seem to cause the same problem, even after being paused.

3. I created a script to create a new SoftwareDistribution folder. It works, but I need a fix that doesn’t require deploying it to every user.

Has anyone else reported this in the community, or am I the only one? Should I turn off automatic approvals for recommended driver updates and approve them manually? I know drivers can be wonky, and a consultant recommended that we turn automatic approvals on.

Please let me know.

I had a users laptop's SSD die yesterday and am trying to plan out the repair. Since the SSD died, I could not send a wipe command. What is the best way to replace the failed hardware and re-join the PC?

Since the SSD is the only thing that died (and replaced) the hardware hash should still be OK....correct? If that is the case, what is the recommended method to re-join? Just manually delete the device object in Intune and then replace the SSD and re-join via Autopilot? I think that this should work, but it almost seems too easy. Am I correct with the methodology? If not, please help bring me up to speed on best practices for handling this.

TIA

Regarding : https://techcommunity.microsoft.com/blog/microsoft-entra-blog/platform-sso-during-automated-device-enrollment-is-now-generally-available-for-m/4436813

I've introduced the setting RegistrationDuringSetup (Enabled). It's in a configuration profile that a mac is getting when enrolling thru Enrollment program tokens.

It doesn't work... I still have to use the Company Portal prompt to complete the Platform SSO.

I didn't find any other documentation beside that article.

Have you tried that setting ?

Who is using EPM in large enterprise environments? How was your experience through deployment? Any gotchas or roadblocks? Anyone tried to use it and found it so lacking that you didn’t go to prod?

KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11 - Microsoft Q&A

Careful with that windows update!

Hi everyone,

We are encountering an “AUTOPILOTWHITEGLOVELANDING” error during the Technician Flow of Windows Autopilot pre-provisioning for a Hybrid Azure AD-joined MINIX PC in our test environment.

Interestingly, pre-provisioning completes successfully when we click Try again.

Has anyone encountered this issue before? If so, what was the root cause, and how was it resolved?
Thank you!

Hello

Wondering if anyone has come across similar latency/performance issues with Windows 365 Cloud PCs.

We have an offshore team based in the Philippines using Windows 365 Cloud PCs.

The past week users have been reporting fairly consistent lag and general performance issues when working in their Cloud PCs.

Current setup for these Cloud PC's is

• 4 vCPU
• 16 GB RAM
• 128 GB storage
• Windows 11 Enterprise + Microsoft 365 Apps 25H2
• Users are physically located in the Philippines
• Provisioning policy region groups are set to Hong Kong SAR and Singapore

We've restarted the Cloud PCs when users report the issue, but the latency/lag ends up occurring again.

The users also run Cisco VPN inside the Cloud PC to access a few specific sites and apps.

Initially I thought the VPN might be contributing to the issue, but we've tested the Cloud PCs without the Cisco VPN connected and users are still experiencing the same sort of lag.

I feel like the Cloud PC specs seem reasonable for the workloads, but I'm interested to see if anyone has dealt with a similar setup

I’m setting up 12 company-owned Lenovo Android tablets for a childcare customer. Each tablet will remain in its assigned classroom and will be shared by the different teachers/staff working in that classroom throughout the day.

These are not individually assigned devices. Teachers will simply use a PIN to unlock the tablet, and the tablet is intended to run only Procare. We do not need each teacher signing into Intune or having their own device profile.
I’ve already connected Managed Google Play to Intune and created an Android Enterprise Corporate-Owned Dedicated Device enrollment profile. My plan is to deploy Procare as a required Managed Google Play app and configure the tablets in single-app kiosk mode, essentially making each tablet a dedicated Procare device.

The licensing is where I’m looking for advice. The customer currently only has one Intune-licensed user and has a very limited budget. I know using a single user license to cover 12 devices may not be the correct licensing model, even if enrollment technically works.
For those who have deployed something similar:

Is there a supported way to handle this without purchasing 12 full Intune/M365 user licenses?

Is Android Enterprise Dedicated Device + single-app kiosk the approach you would use?

Can the devices remain userless while teachers simply unlock them with a common/device PIN and authenticate within Procare as needed?

I’m mainly trying to find the most cost-effective supported solution for a small customerh rather than a licensing workaround. Any experience with this type of classroom/shared-device deployment would be appreciated.

Has anyone deployed Office 2024 LTSC via intune and even doing it via autopilot? I've managed to sort the setup out and the config so I can run the

setup /configure config.xml

at a command prompt, then it will install from what was downloaded earlier.

But not sure how you'd package that up to push out via intune or use it in an autopilot roll out.

Based on the Microsoft Learn documentation, leaf certificates issued by Intune Cloud PKI should be revoked when the Configuration Policy settings (except for Name and Description) are changed.

I wanted to test this by changing the Subject name format value in the SCEP settings but my one issued certificate stayed valid although it did get removed from the device. However, this is contrary to what it says here Remove SCEP or PKCS certificates in Microsoft Intune - Microsoft Intune | Microsoft Learn.

On there, it says:

"A SCEP certificate is revoked when:

• An administrator changes or updates the SCEP profile."

I then removed my test device from the group that the SCEP profile is assigned but this still hasn't revoked the certificate, which again, is what should have happened based on the documentation.

"A SCEP certificate is revoked and removed when:

• A user unenrolls.
• An administrator runs the wipe action.
• An administrator runs the retire action.
• The device is removed from a Microsoft Entra group.
• A certificate profile is removed from the group assignment."

Anybody else run into this?

I am stuck with this. I am trying to install MS365 apps through intune and I have set it up in apps using an xml - the only thing I’ve added is removal of the home version of office apps because I want to deploy the company/work version of it - all the apps have been downloaded apart from teams, I’m able to see the package through an elevated user and see that it’s staging but the app doesn’t show up, I have tried deploying it as a catalog app, bootstrapper way, packaged up the msix and deployed it and it’s all the same, I can see the package when I log in with admin credentials but can’t see it installed for the local or standard user. I have absolutely no idea what is wrong
Any help will be much appreciated

We've been having a recent uptick in enrollment issues where the user get stuck at the loading screen during initial setup on iOS. The screen is the one that comes up right after putting in the username and password at the Microsoft login. No error, no nothing. Just stays spinning forever. As a test, we left a device on and at that screen... After 2 days it then continued on with the enrollment process. Still using a good ol' enrollment profile with user affinity.

Hey end point Gurus :D

im reviewing our Autopatch quality update rings and would appreciate your feedback

• ~7000 devices.
• Around 90% are switched off on Saturdays and Sundays.
• Hotpatch is enabled
• Avoiding forced Monday-morning restarts is a priority
• Auto reboot before deadline = off

This is the configuration

and here is the notification settings:

Scheduled install and restart / Active hours 8:00 - 17:00 / turn off all notifications excluding reboot

For those using Autopatch in production:

• Would you change these timings, and why?
• How often do weekend shutdowns cause forced Monday restarts?
• Has allowing automatic reboot before deadline improved the user experience?

How are we managing AllowedExtensions for VSCode?

I've recently started looking at setting up extension restrictions due to security requirements, currently I've imported the ADMX from the visual studio main website and created a device policy with the 'AllowedExtensions' attribute, after the important Intune is presenting the setting in single line items rather than just creating the full JSON file as per the example below.

"extensions.allowed": {

"esbenp.prettier-vscode": true,

"ms-azuretools.vscode-containers": false

}

I've tried applying the policy via individual items in each row in the admin portal as the example

row 1"*": false, row 2 "Microsoft": true, row 3 etc.

and I've tried putting them all in one single row but no matter the syntax or how it's entered into intune, it doesn't seem to take? checking the registry, the key is showing but not enforcing, so what am I doing wrong?

My boss has challenged me to come up with some creative IT automations that would really impress our employees and improve their overall experience.

We manage Windows devices through Intune.

One idea he mentioned was a morning popup when employees log in that summarizes important emails, upcoming meetings, updates installed overnight, and whether a restart is needed.

Another idea is using AI or automation to proactively detect and fix device issues, then notify the employee with something like, “We noticed X issue with your laptop and automatically resolved it.”

I’m curious what others have implemented. What are some unique automations you’ve built that employees actually appreciate? Anyone doing anything interesting with AI-driven troubleshooting or self-healing endpoints?

Looking for ideas beyond the typical scripts and software deployments. Would love to hear what’s actually working in your environments!

Hi all,

We are updating our version of citrix workspace LTSR version deplyment package following a vulnerability found in the previous 2607 version. We are now deploying 2607 hotfix 1, which according to the webpage is version 26.7.1.4
Too bad the files are having 26.7.1.2 version embedded in their metadata. Arrange your detection rules accordingly.

Hi all,

We're an MSP managing multiple Intune tenants, and we're struggling with keeping security baselines consistent over time.

Customers were onboarded at different stages, so they're effectively on different baseline versions. When new security recommendations come along, we want to roll them out everywhere, but some customers have legitimate exceptions.

Example: our standard baseline blocks legacy Office file formats, but one customer still needs them for a business application.

How are you handling this?

• One global security baseline + exception policies?
• Separate baselines per customer?
• Any tooling (IntuneCD, Graph, Git, etc.) to help manage this?
• How do you prevent configuration drift over the years?

We're considering a model with a shared security baseline and customer-specific exception policies, but I'd love to hear how other MSPs approach this.

Thanks!