#Modern Workplace

Ever been in a situation when the state of the device is so bad, so unusable that it feels like you have exhausted all options and there is no hope? I think it is safe to say that most of us in the world of endpoint management, would have such days at some point in our lives. I recently delt with a device that was in a deadlock state. To give some more context, here is a snapshot of what I was dealing with - 1. The device reset had failed from Microsoft Intune and as part of the process was also deleted from the admin portal. 2. To make matters worse, the device object was deleted from Entra ID as well. (Don't ask why, it's just the way it is.:-) ). 3. The enrolled user had standard permissions and in order to elevate the permissions, one would need either a GA role or LAPS. While LAPS was configured, due to step 2, there was no way to retrieve the password, even through Graph. 4. GA wouldn't work as well as the device had lost trust with Entra ID. 5. Even if you rebooted i...

I recently encountered an issue as part of a project involving Entra hybrid join for existing domain joined devices and Co-management where devices stopped connecting to corporate wireless access points automatically. The devices would complain about missing credentials, resulting in authentication errors and eventually give up on connecting to the corporate Wi-Fi. Here is a snapshot of one such error - The environment is configured with Cisco ISE as the RADIUS solution with an authentication policy relying on PEAP MSCHAPv2 as the authentication protocol. The logs on the Cisco side reflected the same ' Internal authentication error ' as seen in the event viewer of the endpoints. This was strange at first because there was nothing set up in Intune or otherwise as part of the Co-management configuration that would interfere with the WiFi settings in general. On further investigation, it was discovered that the issue could very well be related to Credential Guard on the devices. ...

Enrolment time grouping for Android Enterprise is finally here. I had been using it for Autopilot Device Preparation (APDP) and now that it supports Android OS, I wanted to experience it first hand and capture all the caveats or gotchas. For those who are not familiar with the feature, enrolment time grouping was first introduced for Windows OS as part of Autopilot Device Preparation to speed up app and policy provisioning during device enrollment. The feature allows enrolment time grouping when you can add a Microsoft Entra security group in the enrolment profile so that devices are added to the group during enrolment, rather than after. This pre-knowledge of the security group that the device will become member of after enrollment enables Intune to deliver the configurations to the device quickly on enrollment, not only reduces post-enrolment latency but also improves productivity. If you don't configure enrolment time grouping, then Microsoft Intune can only determine the apps a...

When it comes to capturing BitLocker encryption status, there are multiple options available in the Windows compliance policy in Intune. From  Require BitLocker , Require Secure Boot to be enabled on the device , and Require code integrity under Device Health attestation, to  Require encryption of data storage on device which not only captures the encryption status of the OS drive against BitLocker, but even non-Microsoft encryption solutions. However, it is a known fact that due to delays in getting BitLocker encryption compliance to report in a timely and accurate manner, it can rather be challenging in getting the right compliance settings in place. Especially if the device compliance state is being used in Entra ID conditional access policies. Another issue that I have come across is lack of compliance reporting against BitLocker recovery key escrow. This is especially common in Co-management scenarios when the BitLocker Drive Encryption management has moved to Intune an...

Replacing a third party AV solution like Sophos with Microsoft Defender for Endpoint on Windows endpoints can be a harrowing experience. However, if you know the ins & outs of the process, then it can make things a little easier. I recently dealt with the task of removal of Sophos AV as part of an implementation project for Defender for Endpoint and thought of writing a blog post on it. Hope it helps. Let's look at some of the key steps first 1. Ensure that the devices are checking into Sophos Central and are healthy. 2. Turn off Tamper Protection on the endpoints. Just like other third party AV products in the market, Sophos does support removal of their products by running the relevant product uninstallers, however, in my experience this is a hit or miss and therefore, I resorted to using Sophoszap utility which gave me consistent results. It is important to note that you should use the latest Sophoszap utility, so always check the Sophos official vendor's website for lat...

I believe most will agree when I say that OEM branded configuration on Windows devices can be both unwanted and frustrating to remove. Especially when you provisioning devices using Autopilot and want to apply organization's configuration policies. I recently encountered an issue with Lenovo Windows 11 devices that came pre-installed and configured with things that the customer didn't want. While the procurement process gets worked out with the supplier to provide a clean image, I still needed to address these unwanted items. One of the items were pre-configured Edge bookmarks that had no place in the bookmarks that I was putting in place. It was obvious that they had to go.  The bookmarks are located under  C:\Users\<Userprofile>\AppData\Local\Microsoft\Edge\User Data\Default If you open it then you can match contents with what shows up in the favorites on Edge. Solution I created a simple 1 line script to delete the Bookmarks file as part of the Autopilot provisioning ...

Citrix Workspace app for Windows provides access to a user’s resources using Citrix Virtual Apps and Desktops. These resources include SaaS, web and legacy applications and desktops. Citrix Workspace app provides access from the desktop, start menu, Citrix Workspace user interface and web browsers. Now in an Active Directory infrastructure, Citrix Workspace app can be centrally configured using Microsoft group policies. This requires that the administrative templates (the ADMX and ADML files) for Citrix Workspace app are copied to your Group Policy Central Store. Part of these setting include configuring  Client Selective Trust registry keys which allows controlling the user permission prompts in a Citrix session related to access of resources on the device like local drives, webcams, microphones etc. But how does one address this on devices that are Azure AD joined only? If you are managing devices using Intune, then one can using PS scripts to configure the necessary registry ke...