Elevating in user context using Endpoint Privilege Management

by

This week is all about the new feature that was recently introduced in Endpoint Privilege Management (EPM), and that feature is the ability to elevate as the current user. Elevating files, or processes, as the current user enables it to run under the signed-in user account. That enables organizations to address one of the last gaps in the product, which is being able to access personal files while running elevated files, or processes. That means that it is actually running in the user context for that specific action, instead of using the virtual account that is normally used in EPM. It maintains the same user identity. That provides the user with access to the user profile, environment variables, and personalized settings, but also keeps audit …

Read more

Managing account management on Shared PCs

by

This week is all about a closer look at Shared PC Mode on Windows 11. More specifically, this week is all about managing account management capabilities in Shared PC Mode. Account management in Shared PC Mode is about managing the accounts on the device, determining the users that can sign on to the device, and configuring what automatically starts. This post will mainly focus on the first, managing the accounts on the device. Especially on a device that is being shared between many users, it is important to make sure that those accounts are managed properly to prevent the disk from filling up completely. Luckily, within the capabilities of Shared PC Mode there are options for managing those accounts, including cleaning up accounts when needed. …

Read more

Easier configuring Shared PC mode with OneDrive sync enabled

by

This week is all about easier enabling Shared PC mode with OneDrive sync. That was already possible for many years, as described here, but the configuration became a lot easier. Starting with Windows 11 version 22H2 a setting was introduced that enables IT administrators to enable Shared PC mode with OneDrive sync. For a long time that setting was not available for easy configuration and would require custom configurations to be enabled. That on its turn could create duplicate and conflicting configurations, often caused by multiple policies enabling Shared PC mode. As everything can now be configured via a single policy, those types of issues can be prevented. An IT administrator can now use a single policy to manage everything around Shared PC, even when OneDrive …

Read more

Customizing only the initial Start menu layout

by

This week is all about customizing only the initial Start menu layout on Windows 11. That on itself is nothing new, as customizing the Start menu layout has been possible since the early days of Windows 11. The main configurations related to customizing the Start menu layout are described in this post. That also means that the ideas around customizing the Start menu layout have not changed. Customizing the Start menu layout enables organizations to create a standardized layout for their users by pinning apps, removing default apps, ordering apps and more. To create a standardized layout for Windows 11, the IT administrator should use a JSON-file that contains the configuration of the Start menu layout. What makes it extra interesting is the added functionality …

Read more

Configuring the visibility of the Settings pages

by

This week is not about something new, this week is about configuring the visibility of the different Settings pages. The Settings app is the Windows application that provides a unified interface to manage the different system settings. Almost everything that was configurable in the old days via Control Panel, is now configurable via the Settings app. With some exceptions of course. The main reasons to make adjustments to the visibility of the different Settings pages, are to create a more controlled and secure environment. That can be especially useful for specific types of devices, such as kiosk devices and student devices. In those cases, limiting the access to different Settings pages can help with preventing unauthorized changes and maintaining a consistent user experience. The good …

Read more

Removing preinstalled Microsoft Store apps using native functionality

by

This week is all about the native functionality to remove preinstalled Microsoft Store apps. Very useful. When working with Windows devices in an enterprise environment, a common request is to control the preinstalled Microsoft Store apps. These default apps, which ship as part of the Windows image, often include consumer-oriented or redundant functionality that does not align with corporate standards. Removing these apps often requires custom scripting, or other creative solutions. Starting with Windows 11 version 25H2, however, there will be native functionality available to facilitate the removal of most preinstalled Microsoft Store apps. That enables the IT administrator to easily remove those preinstalled Microsoft Store apps. Those configurations are available via Group Policy and via Configuration Service Provider (CSP), enabling basically any deployment scenario. …

Read more

Easily getting started with Intune Management Extension as managed installer

by

This week is all about the latest addition to the ability to easily configure the Intune Management Extension as a managed installer on Windows devices. That addition is the ability to easily configure the Intune Management Extension as a managed installer for a specific group of Windows devices. Before it was already really easy to get started with the Intune Management Extension as a managed installer, but that was a tenant-wide configuration, meaning that it was immediately applicable to all Windows devices within the environment. And that now changed. That configuration can now be assigned to specific group of Windows devices. That assignment provides a lot more flexibility with introducing and testing the Intune Management Extension as managed installer. Eventually, that will make the introduction …

Read more

Using offline mode and app access without signing in on Android Enterprise dedicated devices

by

This week is all about the recently introduced functionalities of offline mode and app access without signing in. Those functionalities are specifically created for Android Enterprise dedicated devices that are enrolled into Microsoft Entra shared device mode and that are using the Managed Home Screen as launcher for other approved apps. Both of these functionalities are focused on scenarios in which the user is required to sign in to the device before the apps on the device can be used. With these functionalities, however, the IT administrator can enable specific apps to be available even when the device is offline, and even before signing in to the device. That makes sure that the user can still be productive when the device is offline, and can …

Read more

Installing Windows security updates during the Windows out-of-box-experience

by

Important: While writing this post the news came that this capability got delayed again to help ensure delivery of the best possible experience. As the configuration is still available in Microsoft Intune, this post can still provide value. This week is all about the new functionality to install Windows security updates during the Windows out-of-box-experience (OOBE). That functionality is focused on making sure that Windows devices are secure and up-to-date at the moment that the user will actually start using the device. At this moment, one of the main challenges is that organizations have to rely on the preinstalled Windows version on the device. That might not – and often does not – include the latest Windows security updates. This new functionality can help with …

Read more

Preventing accidental device wipe with multiple administrative approval in Microsoft Intune

by

This week is all about the preventing accidental device wipes by using multiple administrative approval in Microsoft Intune. Multiple administrative approval on itself is nothing new, but the latest addition to that functionality makes it a lot more powerful. Before, multiple administrative approval was mainly focused adding apps and scripts to Microsoft Intune. Nowadays, multiple administrative approval can also be used for Intune roles and the most critical device actions. Those device actions include device wipe, device retire, and device delete. With those device actions, there will be a little safety net for IT administrators when performing impactful device actions without really giving in on security. Multiple administrative approval will help with preventing accidentally wiping a device. Every device wipe will require an approval from …

Read more