Skip to main content

Intune

Applications​

Before Migrating​

Sadly, Intune is very limiting so 1-to-1 feature parity with MECM and or Active Directory/Group Policy is not there, and additional changes will need to be made. Before migrating to Intune, theses items need to be completed to replicate or improve functonality with the OAL management workflow.

Guest Accounts​

Move Common Folders to OneDrive​

Workstation Status​

Unlike Active Directory, Intune's devices cannot authenticate with each other. For Workstation Status to continune you would need to move to a API and Agent structure rather than current Server gathering structure.

Imaging Database​

Currently, the MECM task sequence fetches the Description\Friendly Name from the computer's Active Directory object. For Auth devices this is adequate, but for Intune it is nonfunctional.

To improve both there is a need to move it towards a traditional database that can be fetched and edited from a API. The idea was to add this database to Workstation Status.

Expand Entra Group Sync​

To replicate the Role system in Intune, you will need to create Device Collections that utilize Entra Group Sync. There currently are 2 in the OAL-Entra Synced that are syncing test and dev devices to DSG - OAL - TEST Devices & DSG - OAL - DEV Devices.

FSLogix​

General Information​

While FSLogix is partially supported it is not recommended to use. Microsoft wants to enterprises to use Enterprise State Roaming. There is a list of settings it can move over, but it is not as granular as FSLogix.

I (Neil Feagan) personally don't recommend using Enterprise State Roaming because you are not able to configure it as granularly as FSLogix.

Mounted Drives and Folder Redirects​

Mounted Drives​

Intune does not support mounted drives so the only way to mount them is running a script on the computer using a Scheduled Task.

Microsoft wants you to use OneDrive.

Redirects​

Intune only supports OneDrive redirects, so all redirects are done by script in a Scheduled Task.

Policies​

Enterprise Policies​

Theses policies are the shared policies and apps that are required or recommended for basic functionality. These also include some security policies for compliance. All of these are deployed by via the ESG - 02 - STND - Enterprise Device Experience - DEVICE POLICIES Entra group.

List of Enterprise Policies

  • 00-AC11-SessionLock-15min-v1
  • 00-AC7-AccountLockout-v1
  • 00-AC8-SystemUseNotification-v1
  • 00-CM1-ChangeDefaultPassword-LAPS-v1
  • 00-IA5-PasswordComplexity-v1
  • 00-SI3-MaliciousCodeProtectionPolicy-v2
  • 02-EPR-MGMT-EnableCloudKerberosTicketRetrieval-v1
  • 02-EPR-MGMT-EnableDriveMapping-v1
  • 02-EPR-MGMT-Powershell Script Execution-v1
  • 02-STND-OPS-PreferredEntraTenant-v1
  • 02-EPR-MGMT-TrustedCert-AUTH-CA-v1
  • 02-EPR-MGMT-TrustedCert-PatchMyPC-v1
  • 02-EPR-MGMT-TrustedCert-TAMU-CA-Cert-v1
  • 02-EPR-MGMT-WinEditionUpgrade-v1
  • 00-CM1-WindowsUpdates-QUALITY
  • 00-CM1-WindowsUpdates-DRIVERS

List of Enterpise Apps

  • Microsoft Remote Help
  • TAMU Wallpaper Images

OAL - Workstation - App-V 5.0 Configuration​

This is a clone of the OAL-AppV5 GPO.

OAL - Workstation - Baseline Experience​

This is mostly a clone of OAL-Default_W10. All registry edits have been moved to OAL - Registry Customizations script.

OAL - Workstation - Firewall​

The OAL-Firewall-Workstation has been split into these 3 policies.

  • OAL - Workstation - Firewall
  • OAL - Workstation - Firewall Rules for Third-Party Applications
  • OAL - Workstation - Firewall Rules for Windows Components

This is because Intune spit the Firewall confiuration into multiple components.

OAL - Workstation - FSLogix Configuration - DEV​

OAL - Workstation - FSLogix Configuration - TEST​

OAL - Workstation - FSLogix Configuration - PROD​

OAL - Workstation - FSLogix Configuration​

This is a clone of OAL-FSLogix policy.

OAL - Workstation - Local Group Configuration​

This is a policy that configures the local Administrator group.

OAL - Workstation - Lockscreen Wallpaper​

Configures the lockscreen. Can be moved to into the OAL - Workstation - Baseline Experience policy.

OAL - Workstation - OneDrive Settings​

Configures OneDrive, will need to be expanded for future needs.

OAL - Workstation - Power Settings​

Configures the Power Settings of the device. Intune cannot utilize the Power Management Policies in MECM, so each Role needs its own policy at some point.

Registry Edits​

Scheduled Tasks​

Remediation and Platform Scripts​

As a important note, there is a hard limit on remediation scripts of 200. Platform scripts seem to be unlimted but only return success or failure.

OAL - Registry Customizations​

You are not able to directly make registry edits in Intune. The best way is to make a remediation script that sets all the desired values. The caveat is that Intune has a max of 200 total scripts in the Tenant. That is why all Registry Edits OAL does are inside one script.

OAL - Set FSLogix Local Group Members​

Intune does not have the ability to edit local groups on a computer. The closest you can get is making an XML for a LocalUsersAndGroups CSP Policy, but outside of the default groups like Administrators, you would have to specify the exact SID of the local group. There is also a limitation in that you can only apply one LocalUserAndGroups policy/XML to the same device.

Since Intune devices are inherently in WORKGROUP, name resolution with Entra groups does not natively exist. Using the built-in command Get-LocalGroupMember does not work. This remediation then uses the Windows ADSI to get the raw SIDs of the members.

function Get-SIDsInGroup {
    param (
        [string]$Group
    )
    $ADSIComputer = [ADSI]("WinNT://$env:COMPUTERNAME,computer")
    
    $g = $ADSIComputer.psbase.children.find("$Group",'Group') 
    $gm = $g.psbase.invoke("members")
    $m = @()

    $gm | ForEach-Object {
        $SID = $_.GetType().InvokeMember("objectsid",'GetProperty', $null, $_, $null)
        $UserSid = New-Object System.Security.Principal.SecurityIdentifier($SID, 0)
        $m += $UserSid.Value
    }

    $m
}

I put all this behind an easy to use function to hide away the complexity. The remediation checks to see if the exclusion and inclusion groups have the correct memebers.