Inlägg

Using Intune Registry Inventory to Validate Windows Kiosk Devices

Bild
Introduction Microsoft recently introduced the ability to collect Windows Registry data using Device Inventory and the Properties Catalog in Intune. While most examples focus on application-specific registry data, I wanted to explore a practical use case for Windows kiosk devices. In environments such as libraries, schools, and public-access workstations, kiosk devices often rely on specific registry settings for automatic sign-in and user experience configuration. When these settings change unexpectedly, troubleshooting can become time-consuming and often requires remote access, PowerShell scripts, or manual registry inspections. With Registry Inventory, administrators can now verify these settings directly from Intune and gain visibility into device configurations without connecting to the endpoint. Why This Matters One of the most common support issues for kiosk devices is that: Automatic sign-in stops working The wrong local account is configured A device is rebuilt incorrectly Reg...

Windows SSO: How to Manage Single Sign-On Prompts with Microsoft Intune

Bild
With recent changes introduced for users in the European Economic Area (EEA), Windows 11 users may see an additional consent prompt when Microsoft apps attempt to use the account already signed in to Windows. For managed environments, this extra prompt can create unnecessary user interaction. Microsoft has introduced a new policy that allows administrators to automatically approve this permission on supported devices. In this post, I'll show you how to deploy this configuration using Microsoft Intune Remediations. 📌 Prerequisites Before you begin, make sure the following requirements are met: Windows 11 version 24H2 or later July 2026 security update installed (KB5101650 or later) Device enrolled and managed by Microsoft Intune User signed in with a Microsoft Entra ID account Microsoft Intune Remediations license 📦 Deployment Options There are several ways to deploy this configuration across Windows devices: Group Policy (GPO) – Suitable f...

🚀 Remote Help in Intune – Setup, Roles & How to Avoid the UAC Black Screen

Bild
If you’re still using Quick Assist in enterprise environments, it’s time to move forward. With Remote Help in Intune , you get: ✅ Entra ID integration ✅ Role-based access control (RBAC) ✅ Elevation support ✅ Auditing and logging 🔔 Important: Starting June 2026, Remote Help is included in Microsoft 365 E3 and E5 licenses — removing the need for separate licensing and making it the natural choice for enterprise remote support. 🔐 Step 1 – Assign Required Roles (Important!) Before anything else, you must assign the correct roles. Navigate to: Intune admin center → Tenant administration → Roles ✅ Recommended roles: Help Desk Operator Remote Help Operator (if available in your tenant) Required permissions: Remote Help usage Device interaction User support capabilities 👉 Without proper role assignment, Remote Help will either fail or run in limited mode. Step 2 – Enable and Configure Remote Help Go to: Intune admin center → Tenant administration → Remote Help Enable the following: ✅ En...

📊 Understanding the New Secure Boot Status Report in Windows Autopatch

Bild
🆕 What’s New in the Report ✅ Confidence Level A new column indicates how safe it is to deploy Secure Boot certificate updates. High confidence → Safe to auto-deploy Under observation → Test before rollout No data observed → Manual validation required Temporarily paused → Known issues — take no action Not supported → Cannot be updated automatically 👉 This significantly reduces the guesswork when planning updates. 🔑 Secure Boot Trust Configuration Shows how the device validates boot components: Microsoft only Microsoft + OEM 👉 This helps explain why some devices appear “Up to date” even when certain certificates are missing. 🔍 Interactive Certificate Status The Certificate status field is now clickable. 👉 You can now drill down and see: Which certificates are missing Which certificates are applicable Previously, only a generic status was shown — now you get full visibility. 🚨 Alerts A new column highlights issues per device. 👉 This helps you quickly identify: Devices that ...

🛠️ Fix BitLocker Recovery Loop After BIOS or Secure Boot Changes

BitLocker Recovery Loop Guide 🛠️ BitLocker Recovery Loop – Enterprise Troubleshooting Guide This guide explains how to troubleshoot repeated BitLocker recovery prompts after BIOS, TPM, Secure Boot or hardware changes in enterprise environments. 💡 Root cause: TPM PCR mismatch (especially PCR7 related to Secure Boot) after firmware or boot configuration changes. 🧠 Root Cause Explained (Important) BitLocker uses TPM PCR measurements to verify boot integrity. When firmware, Secure Boot or boot configuration changes, the TPM measurements no longer match → BitLocker triggers recovery mode. BIOS/UEFI update changes firmware measurements Secure Boot keys or DB/DBX changes TPM firmware update or reset Boot order / UEFI configuration changes Docking station affecting hardware hash 🌲 Decision Tree 1. Does BitLocker ask for recovery every boot? → Yes: TPM integrity issue (PCR mismatch) 2. Did it start after BIOS/firmware update? → Yes: Suspend ...

Mastering Intune Management Extension (IME): Detection, Remediation & Real-World Fixes

📌 Description This guide focuses on a critical Windows Intune component: Intune Management Extension (IME) . IME is responsible for Win32 app installations, PowerShell scripts, and proactive remediations. Detection scripts can either prevent remediation or intentionally trigger maintenance tasks.   🚀 Features IME health monitoring Automated log cleanup Detection of stalled Win32 processing Safe reset scenarios   🛠️ Prerequisites Device enrolled in Intune Proactive Remediations enabled Scripts running as SYSTEM Detection – IME Service Health ⧉ $service = Get-Service -Name IntuneManagementExtension -ErrorAction SilentlyContinue if (-not $service) { exit 1 } if ($service.Status -ne "Running") { exit 1 } exit 0 Remediation – Restart IME Service ⧉ Restart-Service IntuneManagementExtension -Force -ErrorAction SilentlyContinue Detection – Log Cleanup (Always Ru...

Windows Autopilot – Hardware Hash (HWID) Extraction with Group Tag

📌 Description This PowerShell script is used to extract the Windows Autopilot hardware hash (HWID) from a device and save it as a CSV file directly to a USB drive . Each file is created with a unique filename based on device model, serial number, and timestamp. During execution, you are prompted to enter a Group Tag . The Group Tag is written directly into the CSV file and is later used by Windows Autopilot to automatically assign the device to the correct device groups, deployment profiles, and Microsoft Intune policies. This approach is commonly used when manually collecting hardware hashes instead of paying a hardware vendor to unpack devices and pre-register them in Autopilot. By extracting the HWID in-house (for example during OOBE) and saving it to USB, organizations can reduce costs , keep full control , and still ensure devices are fully prepared for automated deployment.   🚀 Features Extracts Windows Autopilot hardware hash (HWID) Automatically adds a...