Відео

Glad it helped and thank you for your kind comment it’s much appreciated. 👍👍👍

@@thedeploymentguy Random question that occurred to me. Is there a way to set this up so I have the option to run control panel as admin so once the system is live I can remote in and help users easier?

Thank you for your wonderful comment. Glad my video helped. ❤️

Have you deleted it in autopilot aswell as Intune?

@@thedeploymentguy yes deleted

@@thedeploymentguy device deleted from Intune completely

If you are using Autopilot to prep your devices I’m assuming your using Intune to manage them and Entra AD as your identity provider rather than an on-prem Domain controller. The user would literally be able to sign in from anywhere and it will contact Entra AD to authenticate them rather than them having to be onsite and the device having to contact a domain controller to authenticate.

Personally I’ve always deployed start menus to users even in my GPO and SCCM days so I’ve not actually tried deploying to devices. Try it and let me know how you get on.

If I’m honest I’m inclined to agree with you. I’ve literally been on 2 support calls with Microsoft this week and even they used Quick Assist. Just thought I’d do a video showcasing Remote Help to let people make their own minds up.

You would use the admin account. This is simply to import the device into Autopilot at which point you would then assign it a deployment profile. Once the profile is assigned you would run through OOBE and if you have used a user-driven deployment profile it will prompt the end user for credentials and the device would then enrol in Intune.

Quite possibly the nicest comment I’ve had on this channel. Thank you my friend much appreciated!

Hi do you mean this? Save Time with Microsoft Intune: Setting a Default Domain Tutorial ua-cam.com/video/OSg312s6XFg/v-deo.html

Life saver !@@thedeploymentguy

Various reasons. One of the big ones is that when you package it as an Intunewin file there’s a decent amount of compression involved. This is obviously a good thing when having to upload it to Intune and then each endpoint downloading it.

Did you get anywhere with this issue as I'm having the same thing with a AVD multi session VM?

No worries pal hope it helped.

Hey no probs at all 😊

No this should be by default if you have reporting services installed on your sccm server.

question, though you already have enrollment the device it should be Joined to a intunes group in order to Applying some policy for app installation right?

Yes this will just import it into AutoPilot. You then need to setup a deployment profile and assign it to a group. I typically use either a dynamic group which pulls all Autopilot devices in or a dynamic group based on a group tag which you can set on the device in Autopilot.

Thank you so much. I’m a relatively new and small channel so it means a lot when people provide positive comments.

@@thedeploymentguy The only problem I can think of is if you wanted to grant access to display settings for a visually impaired pupil so they could make adjustments if they needed to.

Thanks. Glad you liked the video.

You may have to have somebody add you as a Device Enrollment Manager in Intune. learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment-manager-enroll

Thanks for the reply. I am a Intune Administrator and listed under the enrollment managers but still get flagged. I'll try it again and see if it works. it's been a while since I tried. Thanks again!@@thedeploymentguy

Yeah using the settings picker is a lot easier. I remember the string you had to use with GPOs for visibility and you can still use it with oma uri but this way is much easier lol.

No probs. I will try and do a video for locking down settings and control panel for Students this week. I’m slowly trying to compile a list of videos I can create most of which will be based around an educational setup.

Great question! As long as the admin isn’t part of that group that the policy has been applied to then you should be fine. I have just logged into the VM in the video with an admin account and was able to see every setting in the control panel.

I’ve also had this problem, eventually the device will realise an admin is logged in and revert to default settings but in my experiences it can take a while!

You could target per user too I imagine, so if x user is part of group endusers then block control panel.That is p much what I have done, you can also mark admins as exempt from this ruling.

Hey I appreciate that thank you. Don’t forget to subscribe to the channel if you haven’t already.

Thank you so much I really appreciate that. I’ve not been able to make many videos recently due to being busy with projects at work but I’m hoping to start again in the coming weeks so stay tuned.

Thank you

I have recently launched a website to compliment this channel and I have posted a tutorial on there today as it was much quicker than doing a video. You can get to it via www.thedeploymentguy.co.uk

@@thedeploymentguy Thank you but that link is not working.

@@bella2028volleyball For now I am concentrating on the UA-cam channel. I decided to take the website down but it may be something I do again in the future if this channel grows enough.

Yes it should prompt them with more information needed and then guides them through setting it up. I was in same boat as you because I also work in schools and was worried about staff constantly being prompted for MFA but this has done the job for me. I’d suggest creating a group with some test users and then point the policy to this group first just to make sure it does what you expect.

@@thedeploymentguy Awesome! Huge thanks for that!!

Sorry I missed this comment. When you say right corner do you mean how to pin icons to the right of the start button on the taskbar?

@@thedeploymentguy Hi, no problem. I mean the small icons next to the date on the taskbar. Now, most of them are hidden. Tray icons they are called, I think.

Did you give it time to sync and did you check your device in Intune to see if the state of the policy had succeeded? One thing Intune isn't is quick.

Thanks will do! Hopefully I start getting more confident and can do some longer videos.

If im honest I always try and avoid using .exe's whether it be with ConfigMgr or Intune. A lot of the time .msi installers are available from the vendor or if they only provide an exe file I use the trick where you run the exe and it spits an msi into %temp% and then you can take that and edit it with Orca for example and make changes to shortcuts etc. If an exe is the only option I tend to script the install and uninstall and then wrap these in with the exe in the win32 app. From here you would point the install and uninstall commands in Intune to the relevant script i.e. install.cmd, uninstall.cmd. If you are adamant you want to wrap the exe as it is then you need to know the switches to install the exe which are easy to find using something like USSF or if you have been packaging for a while you know the usual ones to try. In Intune in the install command field you would simply put the name of the executable followed by the switches i.e. "npp.8.4.9.Installer.x64.exe" /S. The uninstall field is slightly harder to work out. I tend to obtain the uninstall string from HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Uninstall and then the uninstall command line in Intune would be this string from the reg or it might be a GUID which you would use with msiexec /x with. Obviously with the detection method they wont auto populate either so you need to do a bit of work to work out the product codes, installed exes or reg files.

@@thedeploymentguy thanks for the extensive answer! Orca and ussf are good suggestions. So I guess I was on the right track and it really is that painful haha. Good thing Microsoft is doing win32 winget apps. I love this series! Keep up the good and clear answers about intune

Hi Josh. Yes going forward I am looking at talking through and explaining what I am doing. I am very very new to uploading videos to UA-cam so the ones I have done so far are test ones.

@@thedeploymentguy I understand and appreciate the efforts. In the video the syntax you used to pull the devices into the dynamic group is that value from the PO?

@@joshplaster1172 Yes it can be. If you get the vendor to register the devices for you rather than doing it yourself they can tag each device with a PO/Order Number. I typically use it to determine the use of a device such as a 1to1 or shared device but this obviously depends on the environment where you work. I would then typically assign an Autopilot deployment profile accordingly i.e. user-driven to 1to1 devices group and self-deploying to shared devices. If you don't have a need to use both deployment profiles and you only use user-driven for example you can use the below syntax with your dynamic group which will pull all devices registered with Autopilot. (device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))

@@thedeploymentguy yeah that’s what I figured you are using the PO. We only have 1 profile currently and use the syntax you provided. Using another profile for Kiosks would be a great use case. Haven’t played around with AP and the kiosk settings yet. Maybe another video you could do! Thanks for the info!

@@j05hh86 Yeah sure. I only have 1 kiosk device where I work but im sure I can do a video on how i set up the configuration profiles for it.