DOCSEARCHbyAlgolia
Submit Docs

Mecken Swyter: Intune & Endpoint Automation

website·Indexed 31 days ago

https://meckenswyter.com

Technical guides and deep-dives on Microsoft Intune and endpoint automation, covering Win32 app deployment with verbose logging, custom compliance policies, Config Refresh, and Microsoft Entra ID security, including SSPR and emergency access accounts.

Tokens
8.4K
Snippets
17
Records
60
Agent score
56%

What's inside Mecken Swyter

  1. Overview of Windows 11 Config Refresh

    Config Refresh is a Windows 11 feature (not an Intune-specific feature) designed to remediate configuration drift by refreshing Configuration Service Provider (CSP) policy-backed settings at a specified interval. It works by creating a Task Scheduler job on the endpoint that executes the deviceenroller.exe binary with specific arguments to trigger the refresh.
    %windir%\system32\deviceenroller.exe /ConfigRefresh /o {GUID}

  2. Overview of Intune Custom Compliance Policies

    Custom compliance policies in Microsoft Intune allow administrators to monitor for configuration drift or specific system states that are not covered by out-of-the-box compliance settings. This is achieved by deploying a PowerShell detection script and a corresponding JSON configuration file to endpoints. The Intune Management Extension (IME) orchestrates the retrieval and execution of these scripts to determine if a device is compliant.

  3. Use Intune Custom Compliance for non-native settings

    While Microsoft Intune provides built-in compliance settings for monitoring configuration drift (e.g., BitLocker status, minimum OS version, and Antivirus), some specific settings or states may not be available out-of-the-box. In these cases, Intune allows the use of PowerShell scripts to detect and report custom compliance information from an endpoint.

  4. Use Intune Custom Compliance policies for PowerShell-based detection

    While Microsoft Intune provides built-in compliance settings (such as BitLocker status, minimum OS version, and Antivirus), some specific device states or settings are not available out-of-the-box. For these scenarios, Intune allows the use of PowerShell scripts to detect specific information on an endpoint and report it back as part of a custom compliance policy.

  5. Use PowerShell for Intune Custom Compliance Policies

    Microsoft Intune provides built-in compliance settings for monitoring configuration drift (e.g., BitLocker status, minimum OS version, and Antivirus). For settings or device states not included in the out-of-the-box options, Intune allows the use of PowerShell scripts to detect specific information on an endpoint via custom compliance policies.

  6. Use PowerShell for Intune custom compliance policies

    While Microsoft Intune provides built-in compliance settings (such as BitLocker status, minimum OS version, and Antivirus), you can use PowerShell scripts to detect specific settings or device states that are not included in the out-of-the-box configuration options. This allows for the creation of custom compliance policies based on custom-detected information from the endpoint.

  8. Migrate user files to OneDrive using SharePoint Migration Manager

    The SharePoint Migration Manager allows for the migration of files from a network share to a user's OneDrive without user intervention. This assumes the Migration Manager agent is already installed on a Windows Server with access to the network share.

    Migration Steps:

    1. Go to Microsoft 365 admin center > ... Show all > SharePoint.
    2. Select Migration in the left pane.
    3. Under File shares, click Get started (or View tasks).
    4. Under the Scans tab, click + Add source path.
    5. Specify a single source path (e.g., \\server\share\username).
    6. Enable Add all subfolders as source paths and Automatically scan content, then click Add.

  9. Scan for OneDrive path length errors using PowerShell

    OneDrive has a maximum path length limit of 247 characters. Because OneDrive prepends the Microsoft 365 organization name to the path, existing files may exceed this limit. Use the ScanFolderRedirectionPaths PowerShell module to identify problematic paths before migration.

    1. Import the module:

    Import-Module -Name "C:\Path\To\ScanFolderRedirectionPaths.psm1"

    1. Run the scan using Test-FolderRedirectionPaths.
    # Show a summary of all users
Test-FolderRedirectionPaths -RootPath "\\server\home\" -TenantName "<M365TenantName>" -ShowProgress -Summary | Format-Table

# Scan a single user and export results of paths over the 247 limit to csv
Test-FolderRedirectionPaths -RootPath "\\server\home\" -TenantName "<M365TenantName>" -UserName "user1" -ShowProgress | Where-Object {$_.RequiresAction -eq $True} | Export-Csv -NoTypeInformation "results.csv"

  10. Create a Win32 app in Microsoft Intune

    To deploy a prepared .intunewin package, create a new Win32 app in the Intune portal. Required configuration sections include App information (package file, name, description, publisher), Program (install/uninstall commands), Requirements, and Detection rules.
    Intune admin portal > Apps > All apps > + Create > Windows app (Win32)

  11. Prerequisites for securing GlobalProtect with Entra ID

    To secure Palo Alto GlobalProtect VPN with Microsoft Entra ID, the following requirements must be met:

    • Microsoft Entra ID P1 license or higher (required for Conditional Access policies).
    • A user account with at least the Cloud Application Administrator role in Entra ID.
    • An active Palo Alto GlobalProtect VPN installation.

  12. Retrieve Intune Management Extension (IME) logs remotely

    When using Win32 app deployment, installation logs are stored locally on the client machine at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. These logs can be collected remotely via the Intune admin portal without needing physical access to the device.

    Intune admin portal > Devices > All devices > [Select Device] > Collect diagnostics > Yes

    To download: [Select Device] > Device diagnostics > (...) > Download